Platform
Seven modules. One register. One audit trail.
Each module solves a specific problem. Together they give you one prioritised view of your security work.
AuditPilot
Know exactly where you stand against the frameworks that matter.
Run Essential Eight and ISO 27001 assessments, track controls, evidence and risk treatment.
- Versioned Essential Eight with maturity shown per mitigation strategy
- ISO 27001 assessment structure with referenced control IDs
- Control owners, review dates and status history
- Evidence, risk register and treatment plans
- Gap analysis — never an automatic 'compliant' claim
AuditPilot · Essential Eight
Maturity assessment — FY26 review
Controls assessed
41 / 52
Evidence items
64
3 awaiting review
CyberPosture
See what the internet sees about your domains.
Verify domain ownership, then monitor DNS, TLS certificates and HTTP security headers.
- Domain ownership verification by DNS TXT record
- TLS certificate details and expiry tracking
- HTTP security header checks
- DNS observation and scheduled re-checks
- Read-only checks only — no port scanning or exploitation
PhishGuard
Make it harder for attackers to send email as you.
Analyse SPF, DMARC and DKIM configuration and ingest DMARC aggregate reports.
- SPF and DMARC policy analysis
- DKIM validation for the selectors you provide
- DMARC aggregate report ingestion
- Sender-source and pass/fail trends
- Practical spoofing-protection guidance
VendorShield
Understand the risk your suppliers bring with them.
Classify vendors, issue questionnaires and track third-party risk and remediation.
- Vendor directory with criticality and data sensitivity
- Reusable questionnaire templates
- Expiring links for vendors to respond
- Vendor claims kept distinct from verified evidence
- Review and renewal reminders
VendorShield
Vendor risk register
| Vendor | Criticality | Data | Assessment | Next review | Residual risk |
|---|---|---|---|---|---|
| Payroll provider | Critical | Highly sensitive | In review | 18 Nov | High |
| Cloud email service | Critical | Sensitive | Complete | Mar 2027 | Low |
| IT support contractor | High | Sensitive | Questionnaire sent | 30 Nov | Medium |
| Marketing platform | Medium | Internal | Complete | Jun 2027 | Low |
| Courier integration | Low | Internal | Not started | — | — |
Vendor-supplied answers are marked as claims until supporting evidence is reviewed.
IncidentDesk
Run every incident from first alert to lessons learned.
Track security incidents from triage to closure with a preserved timeline and tasks.
- Statuses from New through Closed
- Timeline, tasks and assigned responders
- Containment, recovery and root cause
- Private, access-controlled evidence
- Post-incident reports
IncidentDesk
INC-0031 · Suspicious mailbox forwarding rule
Timeline
- 09:12Alert raised: external forwarding rule createdSystem
- 09:20Triage — confirmed rule not created by mailbox ownerJ. Patel
- 09:41Containment — rule removed, sessions revoked, password resetJ. Patel
- 10:05Investigating sign-in logs for the past 30 daysM. Chen
Tasks
SecureDev
Bring application security findings into the same queue.
Inventory applications and repositories, import SAST and dependency findings, triage.
- Application and repository inventory
- Import structured SAST and dependency findings
- CVE references and false-positive triage
- Assign fixes to developers
- Source code is never sent to AI without explicit permission
Security Findings
Findings register
| ID | Finding | Severity | Status | Owner | Due |
|---|---|---|---|---|---|
| F-0142 | SPF record exceeds 10 DNS lookups PhishGuard · example.com | High | In Progress | J. Patel | 12 Nov |
| F-0141 | Missing Content-Security-Policy header CyberPosture · portal.example.com | Medium | Open | Unassigned | — |
| F-0139 | lodash prototype pollution advisory SecureDev · customer-api | High | Open | M. Chen | 8 Nov |
| F-0137 | MFA not enforced for admin accounts AuditPilot · Essential Eight · MFA | Critical | Open | A. Ruiz | 3 Nov |
| F-0133 | Vendor has no incident notification SLA VendorShield · Payroll provider | Medium | Accepted Risk | M. Chen | — |
| F-0127 | TLS certificate expires in 6 days CyberPosture · portal.example.com | High | Open | J. Patel | 4 Nov |
| F-0121 | DMARC policy set to p=none PhishGuard · example.com | Medium | Mitigated | A. Ruiz | — |
RiskGuard
Give every IT team a risk register they will actually keep up to date.
Run your cyber, IT and compliance risk register with team ownership, appetite, treatment and scheduled reviews.
- Inherent, residual and target risk on a 5x5 scale
- Organisation risk appetite with alerts when risks exceed it
- Risks owned by IT teams, with treatment actions and due dates
- Review cadences with reminders before risks go stale
- Links to controls, findings, vendors and incidents