What we shipped

Short classes on cyber risk for directors, executives and the technical leaders who brief them. Every lesson uses your own expected losses, recovery tests, suppliers and plan, and every class is built around your next board meeting.

A scan result used to count toward any clause that shared a framework control with it. Now it counts only where it tests exactly what the clause commits to. Your coverage will likely go down. That’s the point: what’s left is what actually checks each clause.

Enforcement reads every requirement in your approved policies and makes each one run — a scanner checks it against the values your own clause states, or a named person does it on schedule with the evidence gathered for them. A fix closes only when an independent rescan proves it held.

Every scan result now says what your policy expects, what we saw and the gap. Every fix closes only when an independent rescan confirms it held. If it didn't, it rolls back and tells you why.

Integrations are now Connections, and they do more than collect evidence. The connection that scans Jira or Linear also files fixes in the backlog. Coupa and Zip keep vendor reviews in sync with procurement. Approved fixes get applied for you, then a rescan confirms they held.

Support Hub, care corner, and Guardian — ask for help, finish setup, and get unstuck in-product, with dark and light screenshots.

Four views (Scope, Coverage, Continuity, Today) that answer the questions you actually ask on an audit, in the order you ask them. One framework per assessment, every requirement graded against its own text, the whole observation window on one screen.

New suppliers enroll in your review queue on their own, and the GO / CONDITIONAL / NO GO decision is written back onto the supplier record where procurement already works.

The integrity layer under the platform is now licensable on its own: every consequential action becomes a record a third party can re-derive without trusting us, our model provider, or our cloud.

Discovery reads your vendors’ published disclosures and extracts their AI posture with a citation on every claim. Nothing becomes the record until your team confirms it.

A 20-minute pre-investment red-flag scan, term-sheet covenants auto-drafted from the findings, and a one-page LP-letter cyber section that gets easier every quarter.

Compliance agents working end-to-end, with cryptographically signed actions, reasoning traces you can read, and freshness-verified evidence.

Scenarios auto-generated from live platform signals rather than a pre-built library, in three layers: board appetite, risk, deficiency.

For regional security VARs, GRC implementers, and small MSPs. Sliding-scale recurring margin up to 30% on Enterprise; operator-track white-label lands Q4 2026.

Refraction, Keystone, and Continuous Indicators under one roof, so a tripped indicator raises the scenario and the vendor alert together.

Per-engagement diligence returning a single Cyber Cost of Deal figure across five defensible pillars, priced against the acquirer’s valuation model.

Ask your compliance program anything from Claude, GPT, or your own agent, and get evidence-backed answers with the citations attached.

Someone Else’s Debt: how to translate cyber risk into a dollar figure a deal team can act on — the methodology behind our diligence surface.

Loss exceedance curves from live percentiles, per-finding exposure and remediation cost, and findings that flow into the operating program instead of a shelved report.

10,000 runs per scenario with FAIR-shaped decomposition. Every dollar figure downstream is live simulation, not a lookup table.

Verifiable deletion certificates, a viewer that keeps raw document bytes out of the reader’s browser, and watermarking that identifies a leaked page’s reader.

Canonical IDs and alias resolution in a shared module, so every service reads frameworks from the same place.

Credential stuffing is the top attack vector against SaaS, so we removed the class: magic link plus mandatory TOTP, across every external portal too.

Per-resource authorization instead of role checks, and metered consumption between the platform and billing. Every tier-gated feature since inherits both.

Versioned, cross-linked articles that sit inside the surfaces they explain, starting with business controls, overrides, testing, and questionnaires.

Pipeline, bottleneck, and assignment views across services; the standards tab rewritten as a queue driven by deadlines, gaps, and evidence freshness.

Scoped external-reader access with view analytics and time-bound links — for every founder assembling a Drive folder the night before a term-sheet call.

Engagement-scoped, tenant-isolated rooms with ephemeral storage and deletion certificates as first-class artifacts.

Three mandatory steps for business context, progressive disclosure for depth, and a persistent checklist for first-value actions.