Integrating threat scores into an internal security risk model

Use Case Overview

Integrating threat scores into an internal risk model

Base Operations delivers standardized, street-level threat scores through a REST API so security and data teams can feed location risk straight into the model they already run. Instead of logging into another dashboard, a global technology company wired the API into its internal Global Security Risk System, pulling a full crime-subcategory breakdown for every office worldwide on a scheduled cadence. This use case shows how to replace a single legacy crime metric with a granular, globally comparable crime taxonomy that becomes the authoritative risk vocabulary across the business.

Who Benefits

This use case is valuable for Chief Security Officers and Global Security Directors standardizing how risk is measured across a distributed footprint, Security Data and Analytics teams building or maintaining an internal risk model, and Security Analysts who need consistent, comparable inputs for every location. It's especially relevant for technology companies, financial services firms, and any enterprise managing security across hundreds of sites in multiple regions.

Protection Impact

A single, consistent threat taxonomy for every location lets teams compare risk apples-to-apples worldwide. An office in São Paulo can be measured against one in Singapore, subcategory for subcategory. That comparability surfaces the sites and threat types that need attention first, so teams can direct controls and resources before incidents occur.

Operational Improvements

Traditional internal risk models often rely on a single aggregated crime score, manual data sourcing, or inconsistent inputs that don't translate across regions. Base Operations transforms this approach by providing:

• A single global threat ontology that makes every location directly comparable
• 13 individually scored crime subcategories in place of one legacy crime bucket
• API-native delivery that drops risk data into existing models and pipelines
• Coverage for international and sparse-data locations through Base Engine

Use Case Walkthrough

The pipeline is simple: a scheduled pull, a clean set of inputs, and a risk model that does the rest. Base Operations sits at the front of it as the source of truth for location risk.

Step 1: Pull the data

Each quarter, the API returns a composite Base Score plus 13 individually scored crime subcategories for every office. One call pattern, one global ontology, and isGTM=true so international and sparse-data locations are covered by Base Engine.

Step 2: Ingest as inherent-risk inputs

Those subcategory scores enter the internal model as inherent-risk inputs that capture the outside-the-fence reality for each site.

Step 3: Apply internal controls

The company's own security controls are layered on top to produce a residual risk score per site.

Step 4: Standardize the risk vocabulary

The Base Operations threat ontology replaces a single aggregated crime bucket. It now feeds the company's internal LLM as the authoritative risk vocabulary.

The endpoints behind it

What comes back

Every location returns the same shape: one composite Base Score (0–100), plus a Base Score for each of the 13 crime subcategories underneath it. Because the ontology is identical worldwide, an office in São Paulo is directly comparable to one in Singapore, subcategory for subcategory.

Conclusion

Standardizing location risk takes a common framework that every team can reason with. By integrating the Base Operations API, a security team turns one legacy crime score into 13 comparable, model-ready subcategory scores, and adopts a threat taxonomy that becomes the definitional foundation for how it structures and classifies risk across every location.

This is the shift from reactive to proactive: consistent, street-level intelligence delivered directly into the systems teams already use, so risk is measured the same way everywhere and acted on before incidents occur.