One platform, two halves that mirror each other page for page: an on-prem agent that reads and scores your environment, and a cloud portal where customers, resellers and auditors see the same posture.
The ACSC maturity model. Continuous scoring across all eight mitigation strategies, mapped to your target maturity level, with the lowest control setting the score.
Information Security Management System. The 93 Annex A controls, inherited from the scan where the agent can verify them and attested where it cannot.
AI Management System. Annex A controls plus AI6 governance, covering how your organisation builds, buys and uses AI.
Microsoft Entra and Google admin posture: privileged accounts, MFA and two-step coverage, recovery options and stale admins.
Device coverage in three buckets: the direct WinRM agent, Microsoft Intune MDM, and Chrome / Google MDM.
Workspace hardening checks measured against Google security best practice, alongside the Microsoft side.
AI exposure, governance and coverage scores, plus Shadow AI discovery of the AI tools already in use.
Unsanctioned apps and services discovered across your Microsoft and Google environment.
Exportable framework reports for leadership and auditors, built from your live posture. The cloud portal adds a Write-with-AI panel.
Guidance inside the product and from us. The cloud Support page also has an AI assistant for quick questions.
An on-prem PowerShell collector runs on your own network and reads your Microsoft and Google environment. Nothing leaves without your say.
It probes AD, Entra, endpoints, Intune and Workspace, then scores each framework locally against the control set.
Results push to the cloud portal. Customers, resellers and auditors open the same boards, with the evidence behind each result.
Controls the agent cannot observe are yours to sign off, with evidence stored against each one.
Every gap carries remediation guidance, and your weighted conformance score moves as you fix them.
Every control has a status and a source. The status is where the control stands. The source is how it is evidenced: signal means it was inherited from an agent-verified control, and self-attest means you confirm it with evidence.
Conformance is the weighted share met across the framework's controls. Manual controls the scan cannot see sit in ATTEST until you sign them off, with the proof kept in your self-attestation register for the next auditor who asks.
Already a customer? Open the portal. Want pricing scoped to your environment? Tell us what you run.