open-source risk assessment