⚠
Risk register builder
ComplianceTurn a finding, incident or threat into a structured risk-register row: inherent likelihood × impact, existing controls, treatment, owner and residual risk.
The routing recipe
Job typeStructured extractionPolicyBalanced
routes to
GPT-OSS 20B groq
groq:openai/gpt-oss-20b
88.8
match score
80.9
task fit
100
cost
96.4
speed
Why this model from benchmarks & capabilities
- "Structured extraction" leans hardest on instruction; GPT-OSS 20B scores 78/100 there — #23 of 40.
- Strength on this class of work shows up on IFEval, IFBench (instruction following), where OpenAI (open-weight) models are competitive.
- Cost: free tier. Speed: ~1000 tok/s on Groq LPU.
- Chosen over Qwen3 Coder 480B-A35B Instruct for faster.
| Capability the job needs | Weight | GPT-OSS 20B | Catalog rank |
|---|---|---|---|
| instruction | 1.00 | #23 of 40 | |
| tool_use | 0.60 | #25 of 40 | |
| speed | 0.60 | #1 of 40 |
Relevant benchmarksIFEval IFBench (instruction following)
EconomicsCost: free tier.
Speed: ~1000 tok/s on Groq LPU. vs runner-upChosen over Qwen3 Coder 480B-A35B Instruct for faster. (Qwen3 Coder 480B-A35B Instruct, score 86.3)
Speed: ~1000 tok/s on Groq LPU. vs runner-upChosen over Qwen3 Coder 480B-A35B Instruct for faster. (Qwen3 Coder 480B-A35B Instruct, score 86.3)
Example result
Sample input ▾
Pentest found our staging S3 bucket was publicly listable (no sensitive data today, but staging mirrors prod IaC, so the same template could expose prod).
RISK-0042 — Publicly listable S3 bucket (IaC drift)
Category: Cloud misconfiguration
Description: Staging bucket allows public listing; shared Terraform module risks the same on prod.
Inherent: Likelihood 4 × Impact 4 = 16 (High)
Existing Controls: None on the module; manual review only.
Treatment: Mitigate.
Action: Add `block_public_access=true` to the shared module + a tfsec/Checkov CI gate. Owner: Platform Eng.
Residual: Likelihood 1 × Impact 4 = 4 (Low). Review: 90 days.
Test it on your own data