Upstream Solutions.

Upstream Solutions, a Minneapolis-based software firm, has developed a new application it calls an Inferential Risk Model tool. The IRM applies a statistical analysis to really understand the security and compliance risks a company faces, especially under the plethora of new laws, including Sarbanes-Oxley.

The eight-year-old company says the new product uses statistical analysis--gleaned from 15 years of information technology data--to determine the probability of risk to information assets. The outcome is a risk index, which serves as a bar for an organization to move on a scale of 0 (no risk) to 100 (maximum risk). Upstream Solutions then devises scenarios that will illustrate how a risk index can be reduced.

Art Drake, Upstream's Director of Business Assurance Services, says that customers can choose from a variety of options, from doing a baseline report to regular monitoring to detect changes. The company has been working since last year to refine the product with a couple of clients, one of which is Piper Jaffray, the regional brokerage firm.

Drake says Upstream has a history in product assurance testing that it is using to build business assurance models that focus on four principal criteria: security, continuity, reliability and quality. At this point, Upstream is focused on several vertical markets--among them financial services, health care, utilities and government--that are subject to compliance laws like Gramm-Leach-Bliley and HIPAA.

Pricing of the IRM product is based on a company's number of IP (Internet) addresses, Drake says. He adds that based on the experience with Piper Jaffray, a risk assessment could be completed in a couple of weeks.

Web: www.upstreamsolutions.com