Product
Threat modeling
and compliance.
One platform.
Built for operational technology and the IT that connects to it, with the Australian frameworks you answer to.
Why it matters
Projects introduce risk long before anyone assesses it.
01
Change outpaces assessment
Delivery ships faster than security can review, so assessment is the step that gets skipped.
02
OT consequences are physical
A weak boundary can mean loss of control, safety impact or an outage of an essential service.
03
Regulators expect evidence
SOCI, AESCSF and the Essential Eight expect you to know your risks and how they are treated.
Threat modeling
What your team gets.
- 01
Risk found at design time
Threats generated from your real zones, boundaries and data flows.
- 02
Built for OT
Purdue levels, IEC 62443 security levels and a curated OT/IT threat library.
- 03
Consistent scoring
Likelihood, impact and rationale, calculated the same way on every project.
- 04
Your controls, confirmed
Residual risk only drops when a person confirms a control you actually run.
- 05
One model, every audience
Engineers, risk owners and executives read the same numbers.
- 06
Fits your workflow
SSO sign-in, Confluence export and LeanIX risk factsheets.
Compliance · built for Australian regulation
More than threat modeling. A full compliance suite.
The evidence a regulator asks for comes from the assessments your teams already do.
Energy
AESCSF
- Practice-level assessment, MIL-1 to MIL-3
- Scoring against your target SP-1 to SP-3
- Projected date to reach your target profile
- Peer benchmarking and executive report
Critical infrastructure
SOCI Act
- Risk management program controls
- Recurring obligations with owners and due dates
- Incident register with live reporting clocks
- Systems of National Significance
Cyber baseline
Essential Eight
- Achieved maturity per strategy, ML0 to ML3
- Target maturity per strategy
- Requirement-level gaps
Hardening
ASD Fortify
- Assessment against ASD hardening guidance
- Tracked in the same gap analysis
Governance, risk and compliance, connected.
- Gap analysis across every framework
- Risk register against your stated appetite
- Obligations and incident deadlines
- Audit workspace for evidence and findings
- Exportable compliance reports
CISO View
Five minutes. The whole picture.
Where do we stand?
Posture across AESCSF, SOCI, Essential Eight and risk.
What needs me this week?
A ranked queue of items that are late, breached or blocking.
When will we be compliant?
SOCI today and the projected date for your AESCSF target.
What do I tell the board?
A one-page briefing, built from the same data.
Flexibility & control
You set the rules. The AI works inside them.
Flexible
- OT, IT and AI systems on one platform
- Your company profile, risk appetite and critical assets
- Only the frameworks that apply to you
- Your own trust-zone model
In your control
- AI proposes, people confirm
- Your control library is the source of truth
- Bring your own AI provider key
- Data stored in Australia, isolated per organisation
Coverage
OT first. IT included.
Operational technology
- Purdue levels and IEC 62443 security levels
- SCADA, DCS, PLC, historian and engineering workstations
- Vendor and remote access into the plant
- Safety, availability and process-integrity impact
Information technology
- Enterprise, cloud and SaaS integrations
- Identity, access and third-party connections
- AI-enabled systems and model providers
- IT/OT boundary flows and lateral movement