Payroll Processing Platform

Security Authorisation Assessment

SA
System Security Digital Twin

System Model

A living, machine-understandable representation of the architecture, identities, information flows, trust boundaries, controls and dependencies VERIDION reasons against.

Synced 11:21Model Confidence 94%
Components

48

Information Assets

12

Trust Boundaries

6

External Dependencies

9

Privileged Identities

17

Active Findings

8

100%
External / InternetIdentityAzure EdgeApplication Trust ZoneData Trust ZoneEnterprise Security ServicesThird-Party Services
Internet UsersExternal Actor
Payroll AdministratorsPrivileged Actor
Corporate UsersStandard Actor
InternetNetwork Boundary
Microsoft Entra IDIdentity Provider
Conditional AccessAccess Policy
Privileged Identity MgmtPrivilege Governance
Azure Front Door / WAFEdge / WAF
Azure FirewallNetwork Firewall
Private Network ZoneNetwork Segment
Azure API ManagementAPI Gateway
REASSESSMENT REQUIRED
Payroll Web ApplicationWeb Application
IMPACTED
Payroll Application ServiceApplication Service
IMPACTED
Azure SQL Payroll DBRelational Database
IMPACTED
Document StorageBlob Storage
Audit Log StoreImmutable Log Store
Defender for CloudCloud Security Posture
Microsoft SentinelSIEM
Enterprise SOCMonitoring Function
HR Master Data ServiceExternal Dependency
Banking Payment GatewayExternal Dependency
Email Notification ServiceExternal Dependency
ingressroutes toforwards toinvokesreads / writes payroll data
Assurance State
EffectivePartially EffectiveIneffectiveReassessment RequiredInheritedExternalImpacted — review
Component

Azure API Management

Reassessment Required

System state changed since the last assurance conclusion. The existing assessment may no longer be reliable and needs review — it has not been marked ineffective.

TypeAPI Gateway
EnvironmentProduction
ClassificationPROTECTED
ExposureINTERNET ACCESSIBLE
AssuranceReassessment Required
Last ChangedToday 09:42
Model Assertions
  • ExposureInternet Accessible
    Source: Azure Resource InventoryObserved: Today 09:42Confidence: High
  • ClassificationPROTECTED
    Source: Architecture Design DocumentValidated by: Security Architect
  • AuthenticationMicrosoft Entra ID
    Source: Entra ID ConfigurationObserved: 10:54Confidence: High
Relationships
  • Receives traffic from Azure Front Door / WAF
  • Routes to Payroll Web Application
  • Protected by Conditional Access administrative controls
  • Logs to Microsoft Sentinel
  • Processes PROTECTED payroll information
Controls

12 applicable

9 Effective · 2 Partial · 1 Reassess

Evidence

17 artefacts

Findings

1 High

Threat Paths

3 active

Internet exposure changed after the last assurance assessment. VERIDION identified 12 dependent assurance objects and recalculated affected threat paths. Existing conclusions have been preserved but flagged for human reassessment.

Recent Change · 09:42

Endpoint exposure changed

PRIVATEINTERNET ACCESSIBLE
Model Conflict
Architecture Document States

API Endpoint = Private

Observed Azure Configuration

API Endpoint = Internet Accessible

Observed configuration is newer. VERIDION has flagged the architecture documentation as potentially stale and is awaiting human review — it does not resolve the conflict automatically.

  • Architecture Design Document

    Updated 4 days ago

    AI Extracted + Architect Validated

  • Azure Resource Inventory

    Synced 11:21

    Automated Read-Only Collector

  • Entra ID Configuration

    Synced 10:54

    Automated Read-Only Collector

  • CMDB

    Synced yesterday

    Automated Import

  • Security Architect Validation

    Completed 2 days ago

    Human Validation

Model Assertions

286

Human Validated

241

Machine Observed

198

Conflicts to Review

3

Current Security Reality

Documents are sources. The Digital Twin is VERIDION's structured representation of current system reality — continuously reconciled against documents, technical evidence and human validation. Every later control assessment, threat path, risk conclusion and authorization decision reasons against this system model.