Environment & People
Know who and what can reach your data — and how.
Explore →Platform overview
How secure are we — and what do we do next?
One platform answers both. It aggregates what you already run, validates what it actually covers, and unifies it with what we build natively into one inventory, one control model, one answer.
- Identify & Aggregate
- Protect & Validate
- Unify & Manage
Three pillars. Three motions, continuous across all of them. Hover to explore.
Environment & People
Know who and what can reach your data — and how.
Technology & Threats
Know your exposure. Manage the risks that matter to your business.
Policy & Process
Prove your standards are enforced every day, not just on audit day.
Identify & Aggregate
- Environment & People — Every account, device, cloud service, domain and subdomain from every connected source — Microsoft 365, Google Workspace, AWS, CSV, manual entry — into one inventory, with an owner against each.
- Technology & Threats — Findings from our scanners and yours — external exposure, web application scans, cloud misconfiguration, internal CVE matching, pen test reports — collected against the same assets.
- Policy & Process — Every framework you answer to, and the evidence you already hold — policies, reports, scan output, directory data — gathered once into the Evidence Vault.
Protect & Validate
- Environment & People — MFA read live in three states — enabled, disabled, unknown — dormant accounts flagged, credentials checked against breach data. Declared state is never taken on trust.
- Technology & Threats — Every finding validated against NVD, EPSS and CISA KEV, weighted by asset importance and the controls already in place, explained in plain English. Consented active testing when you choose to run it.
- Policy & Process — Each control marked Evidenced, Declared or Unknown. Policies drafted for your organisation and validated against the frameworks they serve. A green tick never means "someone said so".
Unify & Manage
- Environment & People — One directory and one asset register that the other two pillars and every framework read from, with joiners, movers and leavers tracked as they happen.
- Technology & Threats — One prioritised queue across four posture lanes, each scored on its own terms — never one blended number — with the fix, the owner and the control it affects.
- Policy & Process — One control model across 31 frameworks — evidence gathered for one counts everywhere it genuinely applies, and stays current between audits, not just on the day.
Three pillars. Twelve point products. One platform.
The pillars are not product categories — they are the three dimensions of a complete programme, and they run at the same time. Some of these you may already run elsewhere and we aggregate; some we validate; the rest we provide natively. All of it unifies into one result.
Environment & People
Identity governance (IGA) People Directory & Identity Posture Every person, their access and their MFA state — read live from Microsoft 365 or Google Workspace, never re-declared. Dark-web monitoring Credential Breach Monitoring Breached credentials tied to your domains, surfaced before they are used against you. Asset inventory (CAASM) Asset Intelligence Every device, cloud service, domain and subdomain in one inventory — with an owner, and what it talks to. SBOM tooling Software Inventory & SBOM Installed software on every asset, matched to CVEs, exported as CycloneDX.
Technology & Threats
Vulnerability management (VM) Vulnerability Prioritisation Findings scored by EPSS exploit probability and CISA KEV, not raw CVSS — each explained in plain English. Cloud posture (CSPM) Cloud Posture AWS, Azure and GCP checked against CIS Benchmarks through a read-only, revocable role. Web app scanning (DAST) Web Application Scanning OWASP ZAP baseline scans on every domain you register, findings mapped to the controls they affect. External attack surface (EASM) External Attack Surface Exposed services, weak TLS, certificate changes and look-alike domains — the outside-in view. Threat intelligence (CTI) Threat Intelligence & Reputation Open-source intelligence and reputation feeds, prioritised against your assets rather than the internet at large. Pen-test tooling Testing & Validation Consented, admin-gated active testing against your own estate — deliberately kept out of your posture score.
Policy & Process
GRC / compliance automation Compliance Engine & Security Universe 31 frameworks, 2,396 controls, one control model — evidence gathered once counts everywhere it genuinely applies. Policy & evidence tooling Policy Vault & Evidence Vault Policies drafted for your organisation, controls validated, every capability marked Evidenced, Declared or Unknown.
What you actually see
Start your free trial to explore the live platform.
What you get out
Every assessment produces evidence your leadership, your auditors, and your insurers can act on.
Gap Analysis Report
Which controls are missing, ranked by risk, mapped to the specific framework requirements they affect. Generated by the platform, reviewed by you.
See what's inside →Compliance Posture PDF
Your compliance score, completed controls, and outstanding actions — exported as a branded PDF. Built for board packs, auditor submissions, and cyber insurance applications.
See what's inside →Security Universe Export
A high-resolution map of your compliance cross-coverage — 31 frameworks, ATT&CK edges, and your organisation's position within the landscape.
Open Security Universe → See what's inside →Scan reports (PDF)
Every web and cloud scan exports as a branded PDF: severity breakdown, per-finding detail, remediation guidance. Built to hand to a client, a board or an insurer.
See what's inside →The first fourteen days
What you'll see, and when.
Start free, no card. Every line below is something the trial shows you on that day — not something we say about ourselves.
Connect
Microsoft 365 or Google Workspace, a domain and a cloud account — a read-only connection each, minutes not a project. By the end of the day you have every account with its MFA state, and the assets and subdomains you didn't know you had.
See
Exposed services, look-alike domains, credentials already in a breach, and your first prioritised queue — ranked by what attackers are exploiting, not by raw severity, each finding explained in plain English.
Prove
A gap report against your first framework, every control marked Evidenced, Declared or Unknown — and the evidence you already hold counted where it genuinely applies.
Stay
A new starter, a new device, a new vulnerability, a new exposure — you're told what changed and what to do. Pick a plan when you're ready; the mapping work you've done comes with you.
Start free → No card. No sales call. No annual commitment on monthly plans.
See what's actually there.
Connect your directory, a domain and a cloud account. Fourteen days, no card, no sales call — and you will find something you didn't know you had.