Essentials
£249/mo
or £199/mo billed annually
compliance, plus automation
Start free →Latest from the platform
What's new
What's shipped, what we've improved, and what's on the way. Nothing here is marked live until it's actually deployed — that discipline is the point.
New Shipped and live
- Data classification, sites and resilience details Set your data classification scheme (with presets for Qatar NIA, Saudi NDMO and UAE IA), turn locations into sites, and record each asset's classification, personal data, hosting countries, scope, RTO/RPO and end of support. Classification stays separate from criticality.
- Risk register Score risks on a 5×5 heat map, record treatment and who accepted what is left, and review them on a cycle. Raise a risk straight from a scan finding. A kept register counts towards the risk-management requirements in ISO 27001, NIST CSF, NIS2, DORA and the GCC frameworks.
- Supplier register Track the suppliers you rely on: how critical they are, what data they hold and where, contract and exit plans, and their SOC 2 or ISO certificates with expiry dates. Start from the cloud services already in your asset directory.
- Leaver access revocation, evidenced Record a leaver, work a checklist built from their own devices and the controls they own, and let the next directory sync confirm the account really went disabled — then attach the report to an assessment answer.
- Capability gap analysis See exactly where each control is met — by documentation, tooling, or a partner — with every gap routed to the fix that closes it.
- Cloud posture / CSPM is live Misconfiguration checks across your AWS, Azure and GCP accounts against CIS Benchmarks — surfacing indicators of exposure, scored and prioritised.
- PDF scan reports Branded, shareable PDF reports for web and cloud scans — every finding mapped to the compliance controls it affects.
- Six Gulf PDPLs, cross-mapped One privacy control traced across Saudi Arabia, the UAE, Qatar, Bahrain, Oman and Kuwait.
- Web application scanning is live Scan your web apps for common security issues (OWASP ZAP) and see the findings mapped straight to your compliance controls.
- Compliance Universe with ATT&CK coverage See which attacker techniques your controls defend against, framework by framework, across the whole catalogue.
- Network graph, four ways Explore your estate by Assets, People, Network topology or Map — and export any view.
- Software inventory + SBOM export Per-app CVE matching with a live software inventory and a CycloneDX SBOM export.
Enhanced Improved
- Cleaner findings, explained on demand Re-running a scan now updates existing findings instead of adding copies, and fixed issues close themselves after a complete scan. Ask for a plain-English explanation of any finding when you need it.
- Vulnerability prioritisation, sharper Now scores with EPSS exploit-probability and CISA KEV known-exploited status, explained in plain English.
- Network topology view Fixed and expanded with typed "connects to" links and criticality-weighted risk rings.
- Evidence reuse across frameworks Answer a control once and every framework that shares it gets credit — equivalents surfaced for your review, never silently marked as met.
Nothing in this surface yet.
See it in your own posture
Start a 14-day free trial — no card required.