Quantifying Risk Reduction: AI-Driven Model for Automating Access Certification and Segregation of Duties (SOD) Controls

The traditional Access certification and SOD controls are an integral part of compliance yet they hardly ever possess quantitative metrics to reflect financial ROI. The QRR Model and its basic metric, ARI — Access Risk Index, attempt to initiate a conversation towards bridging the existing huge gap between qualitative compliance and measurable security value that is currently associated with these areas. The model uses AI and ML which will convert from manual access reviews campaigns to fully automated continuous governance control. Access Risk Index assigns risk score 0 or 1 to users by calculating potential risk and threat with entitlement criticality, user role, activities in system, amount of SOD violation and behavioral anomalies. This paper describes an API based automation framework which drives human intervention based on the result evolutions. This framework improves overall enterprise security posture and based on six-month comparison it has shown a significant drop in average Access Risk Index (ARI) to 89% and 96% fall in Toxic Combination Density which could have created high security risk. Based on results it proves that this automation framework is effective in detecting and remediating security risk..