Revenue before deployment, for both of us
An assessment is a bounded, paid, low-risk first engagement that does not require deploying the platform into production first. You find out what is actually in your estate. We find out whether the governance model fits your organisation. Both are better learned before a procurement cycle than during one.
We also do not rebuild the open-source scanner ecosystem. Best-of-breed scanners are wired in as governed skills executed across the fleet behind the existing authorization gates. The value is the layer around them, fleet orchestration, governance, enrichment, cross-domain correlation and the signed deliverable.
One workbench, eight lenses
The same workspace and the same assistant, applied through eight assessment lenses, all shipped and backed by a tested engine. Seven have a dedicated view; AI governance surfaces its findings through the general findings summary.
| Lens | Status | Assesses | Reach | Signature deliverable |
|---|---|---|---|---|
| Data | Shipped | Governance, quality, lineage, personal data, semantic models and migration. | Cells reaching cloud data platforms; edge agents reaching on-premises and network-attached storage. | A governance scorecard, a remediation plan, a migration plan, and runnable estate infrastructure-as-code. |
| Security | Shipped | Cloud security posture, misconfiguration and control mapping, and cloud entitlement risk. | Cells reaching cloud control-plane APIs, plus detection ingest. | A maturity and risk assessment, a signed remediation roadmap, and detections-as-code with hardening templates. |
| Cloud | Shipped | Cloud posture, six-R migration readiness and cost optimisation across AWS, Azure and GCP. | Cells reaching cloud control-plane APIs. | A posture report, a migration assessment across the standard strategies, and remediation templates. |
| Virtualization | Shipped | The virtual estate, vSphere hardening, sprawl, datastore and network, and migration readiness. | Edge agents reaching on-premises virtualization managers. | A virtualization assessment, a cloud-migration plan and migration templates. |
| Data Security | Shipped | Data-platform security posture, effective-access RBAC, separation of duties, least privilege and column-level security over the extracted access graph (Snowflake, then Unity Catalog, BigQuery and Fabric). | Cells reaching data-platform access graphs. | An effective-access report, least-privilege findings and prioritised remediation. |
| Storage | Shipped | File and object storage hygiene, redundant, obsolete and trivial data, oversized and mis-tiered objects, orphaned ownership and unclassified-sensitive data across any object store or file share. | Cells and edge agents reaching object stores and file shares. | A hygiene report with reclamation and cost-savings estimates. |
| Storage Exposure | Shipped | File and object permission exposure, world-readable and public shares, over-broad control authority, grants to departed principals, and cross-group blast radius into sensitive objects over the ACL access graph. | Cells and edge agents reaching object-store and file-share ACLs. | An exposure report with prioritised remediation. |
| AI Governance | Shipped | AI-system governance, accountable owner, documentation, provenance signing, active monitoring and access policy across the AI systems a platform runs, mapped to NIST AI RMF and ISO 42001. | Source-agnostic, an internal or any external platform's AI inventory. | A governance findings summary against NIST AI RMF and ISO 42001, surfaced through the general findings summary (no dedicated dashboard view yet). |
Six reasons this is defensible, strongest first
One correlating brain, in more places
The assessment runs across air-gapped sites, on-premises storage and multiple clouds simultaneously, aggregated centrally. A distributed, low-and-slow, cross-environment pattern is faint at any single vantage point and visible when seen from many at once. No cloud-bound or single-vantage tool can match a platform that is physically in more places.
The finding is the product
One engagement produces a sentence no point tool can span. To illustrate the shape, a hypothetical, not a customer result: an unencrypted file share holds tens of thousands of national-identity numbers, and is reachable from the perimeter network, and sits on an unpatched hypervisor, and replicates to an over-permissive cloud bucket. Four domains, one finding, one owner.
Sovereign cognition
Entity resolution, sensitivity inference and knowledge-graph enrichment run on local models, so the assessment can enter export-controlled and air-gapped estates that the large firms cannot reach at all.
Signed, tamper-evident deliverables
Cryptographic provenance per finding, which makes the output defensible rather than merely persuasive. Open-source scanners emit a text dump; a consultancy emits a PDF. Neither survives being challenged.
Governed and authorised
Rules of engagement, approval quorum and a decision gate, so an assessment is safe to run in a production or classified estate. We model attacks; active discovery and exploitation are simulation rather than live testing, which is precisely what makes running it defensible.
Living, not a dead deck
Re-runnable, drift-tracked and continuous, and the deliverable is infrastructure-as-code you can apply, rendered from inventory with no cloud credentials involved.