Insider Code Manipulation Framework
ICMF defines a structured taxonomy for identifying patterns of financial manipulation hidden inside enterprise code. It is the first framework focused exclusively on detecting deliberate financial logic abuse in ERP and business-critical software.
No framework existed for financial code manipulation
MITRE ATT&CK gave defenders a language for adversary tactics. OWASP gave developers a language for web vulnerabilities. ICMF gives auditors, CISOs, and security teams a language for something that had no standard before: deliberate manipulation hidden inside legitimate-looking enterprise code.
Traditional SAST tools scan for CVEs and injection patterns. They are built for the external attacker model. ICMF addresses the insider model — where the actor has access, has commit rights, and introduces risk through syntactically correct code that only becomes suspicious when analyzed in context.
Five ICMF technique categories
Each category defines a distinct class of manipulation that can be detected, classified, and reported.
Financial Calculation Manipulation
Techniques that alter financial computations to redirect value. Rounding direction changes, fee rate drift, threshold manipulation, exchange rate staleness exploitation. Even fractional changes compound to significant amounts at transaction scale.
Audit Suppression
Techniques that reduce visibility of financial activity. Exception swallowing that prevents failed transactions from being logged, time-based log deletion, conditional audit trail skipping. Makes activity invisible to monitoring systems.
Authorization Bypass
Techniques that circumvent approval workflows in ERP systems. Hardcoded approval conditions, system-user bypasses, threshold changes that avoid dual-approval requirements for financial postings.
Master Data Tampering
Techniques targeting reference data that controls business rules. Vendor master records, bank account numbers, pricing tables, tax configurations. A single account number change can silently redirect all payments.
Cross-System Exfiltration
Techniques that move data or value outside the intended system boundary. Unexpected external API calls, data written to accessible locations, cross-company transfers without proper authorization checks.
Not tool-specific
ICMF is publicly defined. Any security tool, audit team, or organization can apply it independently of SecodX. The framework documents patterns — SecodX operationalizes them into production-grade detection.
Explore full technique library →
From framework to production detection
SecodX implements ICMF detection rules for every technique category, maps each finding to its ICMF code, and displays ICMF badges throughout the interface so audit teams can reference findings by standard technique ID.