-
-
Front Page of OnojacoAuditNexus
-
Scan Results
-
Audit Report
Inspiration
Working across audits, one pattern kept showing up: compliance and security live in two different worlds that never talk to each other. An auditor checks whether a control satisfies NIST, ISO 27001, or COBIT — often re-running the same evidence-gathering exercise three separate times for three separate frameworks. Meanwhile, the technical side runs vulnerability scans that produce a pile of findings with no clear link back to which control, or which framework, they actually affect. The result: audit reports that are technically "compliant" while real, exploitable risk sits unscored and disconnected from the paperwork. I wanted to build something that closed that gap — one platform where compliance mapping and technical risk scoring live together instead of in separate spreadsheets and separate teams.
What it does
onojacoAuditNexus is an audit and compliance platform that:
Maps a single audit's controls simultaneously to NIST, ISO 27001, and COBIT — so one audit cycle produces evidence usable across multiple frameworks instead of three redundant processes. Runs vulnerability scans directly against infrastructure and scores every finding using CVSS, giving auditors a real severity measure instead of a binary pass/fail. Connects the two: compliance gaps and technical vulnerabilities sit in one view, so risk and governance teams are finally looking at the same picture.
How we built it
The core design challenge was building a mapping layer flexible enough to represent the same control across three frameworks with different structures, language, and granularity — NIST, ISO 27001, and COBIT don't organize controls the same way, so a naive one-to-one mapping doesn't hold up. On top of that, I integrated vulnerability scanning and CVSS scoring so that technical findings feed directly into the same audit record as the compliance mapping, rather than living in a separate tool.
Challenges we ran into
The biggest challenges were technical and practical — time, skills, and tooling. Building a working audit-to-framework mapping engine alongside a functioning vulnerability scanning and CVSS scoring pipeline meant learning and stitching together tools I hadn't worked with before, largely outside of work hours, while balancing this against my day job and ongoing PhD work. Getting the scanning integration reliable enough to trust for real audit evidence took the most iteration.
Accomplishments that we're proud of
Getting a single platform that genuinely unifies compliance mapping (NIST/ISO 27001/COBIT) with live, CVSS-scored vulnerability data — rather than treating them as two separate deliverables — feels like solving the actual problem I set out to fix, not just a smaller piece of it. The project was also shortlisted for the Data Science Nigeria AI Awards, which was a strong signal the gap I saw was real.
What we learned
Building AuditNexus sharpened my understanding of how differently NIST, ISO 27001, and COBIT structure the same underlying security concepts, and how much of "compliance work" is really translation work between frameworks. It also deepened my technical grounding in vulnerability scoring — knowledge that connects directly to my current PhD research in cybersecurity.
What's next for OnojacoAuditNexus
Next steps are hardening the scanning integration for broader infrastructure types, expanding framework coverage beyond NIST/ISO 27001/COBIT, and refining the reporting layer so audit output is submission-ready for regulators and certification bodies.
