Intelligence
Platform
Northgate Union BankFictional bank · synthetic data
Powered by Mesh API
Search
Jump to a page or a control
Jump to a page or a control
Northgate Union Bank · Complex IT profile · supervised by BSP
15 of 17 items an examiner asks for on day one are already held as evidence. 5 root causes explain 8 of the 15 open findings, and BSP's self-assessment is due Mar 31, 2027.
Open findings
CCSA domains at target
/ 6
Days to CCSA filing
Evidence collected in 24 hours
Grouped by root cause, then ranked by exposure. Fixing one cause closes several findings.
Branch workstation refresh
2 findings · 740 hosts were imaged without CMDB registration or a healthy sensor.
736 branch hosts run in detection-only mode; prevention covers 94.1% of reporting hosts.
Partial · Endpoint Security
The branch refresh added 740 hosts that the CMDB does not hold, so the inventory is not authoritative.
Partial · IT Operations
Payments migration
2 findings · A temporary firewall rule and unrecorded changes were left behind.
A temporary payments-migration rule lets any corporate source reach the cardholder database tier on port 1521.
Gap · Network Security
9 of 41 security platform changes in the last 30 days have no matching change record.
Gap · Infrastructure Security
Unobserved AI
2 findings · A branch assistant calls a model provider directly, outside the gateway.
The branch knowledge assistant calls a model provider directly, with no gateway in front of it, so its prompts and outputs are unobserved.
Gap · Office of the CISO
Outbound inspection does not cover model-provider endpoints, so prompts are not checked for customer data.
Gap · Data Protection
Licence headroom
1 finding · Log retention was cut to save licence volume, with no change record.
The core banking index keeps 180 days against 365. Retention was cut for licence headroom with no change record.
Gap · Security Operations
Patch window
1 finding · Internet-facing criticals wait for the monthly window.
Internet-facing criticals close in a median of 21 days against the 15-day standard; 6 are open beyond it.
Partial · Infrastructure Security
Other findings
23 service accounts with domain privilege sign in outside the vault, so their use is neither attributable nor recorded.
Gap · Identity and Access
12 privileged administrators still approve sign-ins by push, and 84 legacy branch users are excluded from the MFA policy.
Partial · Identity and Access
Two legacy channels still accept an SMS one-time PIN as the only factor for high-risk transactions. The Circular 1213 deadline passed on Jun 25, 2026.
Partial · Digital Channels
The payments gateway and card management system have gone 16 and 14 months without a restore test.
Gap · Technology Resilience
Newest first. Read-only collectors, hashed on arrival.
52 evidence items cover 28 common controls and 81 requirements across 5 frameworks. Collected once, counted everywhere they apply.
BSP Circular 1232 tiers by domain, against the Managed target for a complex IT profile.
Detected on the estate and scored against the controls they move.
MFA exception for the legacy branch group outlived its approval
Entra IDSystem9 h agoPR-02 →
Three new service accounts hold domain privilege outside the vault
Privilege CloudDiscovery26 h agoPR-01 →
Model-provider traffic found leaving a production segment, outside the gateway
PanoramaDiscovery34 h agoGV-02 →PR-09 →
Core banking log retention cut from 365 to 180 days for licence headroom
Enterprisejdelacruz2 days agoDE-01 →
12,480 endpoints · Northgate Union Bank is fictional and every figure is synthetic · statuses are set by rules, never by a model
