slug: riot
provider: Riot
generated_by: planning/capability-mapping/scripts/classify_capabilities.py
model: claude-opus-5
frame:
- Software & Technology
min_confidence: 0.7
capability_model:
  source: https://github.com/vincentmakes/turbo-ea-capabilities
  license: CC-BY-4.0
  attribution: Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities,
    CC BY 4.0
  notice: NOTICE
edge_count: 5
edges:
- tag: Awareness
  spec_file: riot-awareness-api-openapi.yml
  capability_id: BC-620.60
  capability_id_l1: BC-620
  capability_name: Security Awareness Management
  confidence: 0.9
  evidence: GET /v1/courses/statistics 'Get awareness program statistics'; 'List all employees' courses
    progress'
  reason: Security awareness training course delivery and employee progress tracking — directly Security
    Awareness Management.
- tag: Simulation
  spec_file: riot-simulation-api-openapi.yml
  capability_id: BC-620.60
  capability_id_l1: BC-620
  capability_name: Security Awareness Management
  confidence: 0.85
  evidence: GET /v1/campaigns/{campaign_id}/attacks 'List attacks'; schemas 'AttackTemplateSchema', 'attack_login_domains'
  reason: Phishing/smishing simulation campaign management against employees is the phishing-simulation
    element of security awareness programmes.
- tag: Breaches
  spec_file: riot-breaches-api-openapi.yml
  capability_id: BC-620
  capability_id_l1: BC-620
  capability_name: Cybersecurity Management
  confidence: 0.75
  evidence: GET /v1/breaches/{breach_id}/compromised-employees 'List compromised employees for a breach';
    schema 'BreachCriticalitySchema'
  reason: Credential breach exposure monitoring for employees is a cybersecurity capability; the sub-capability
    is ambiguous between threat detection and vulnerability/exposure management, so only L1 is asserted.
- tag: Inbox
  spec_file: riot-inbox-api-openapi.yml
  capability_id: BC-620.30
  capability_id_l1: BC-620
  capability_name: Threat Detection & Response Management
  confidence: 0.7
  evidence: POST /v1/email_reports/report_attack_from_message_id 'Report a phishing simulation attack
    by Message-ID'; schema 'InboxEmailAnalysisClassifiedEvidence'
  reason: Employee-reported suspicious email triage with classified findings, severity and fraudulent-ticket
    statistics is security threat detection and response workflow.
- tag: SCIM
  spec_file: riot-scim-api-openapi.yml
  capability_id: BC-4230.50
  capability_id_l1: BC-4230
  capability_name: Tenant Identity Federation
  confidence: 0.7
  evidence: GET /scim/{workspace_id}/v2/Users 'List SCIM users'; 'Create a SCIM group'; 'Get SCIM service
    provider configuration'
  reason: Workspace-scoped SCIM 2.0 provisioning endpoints exposed by the SaaS vendor for tenant user/group
    lifecycle — tenant identity federation; could alternatively be read as generic IAM plumbing, hence
    moderate confidence.