AI-driven security. Standards-based assurance.
An air-gapped AI layer that triages alerts into a ranked, explainable queue — and the management systems, audits and certification readiness for ISO/IEC 27001, 27701, 42001 and 20000-1.
From thousands of alerts to a ranked list of actions.
Alerts from equipment, software and security platforms are collected, understood and ranked, so people spend their time on what matters.
- Collects from everywhere. Syslog, SNMP traps, webhooks and files from physical, logical and security layers.
- Eight action buckets. Respond now, contain and investigate, dispatch repair, fix remotely, approve auto-fix, compliance review, plan and monitor, suppress and close.
- Knowledge base first, model second. Vendor signatures and runbooks decide most alerts. A local AI model handles unfamiliar messages and can move priority by one level at most.
- Explainable scores. Every score shows its factors: signature priority, asset criticality, blast radius, security and personal-data flags, and recurrence.
- Never silenced. Ransomware, log clearing, privilege changes, personal-data exposure and life-safety alerts are never suppressed or lowered.
Action queue ranked by score
| # | Pri | Incident | Score | SLA left |
|---|---|---|---|---|
| 1 | P1 | Repeated failed logins, then a success: possible compromise | 107 | — |
| 2 | P1 | Backup volumes show an encryption pattern | 101 | — |
| 3 | P2 | Storage array has lost redundancy | 78 | — |
| 4 | P2 | Certificate expiring on a core gateway | 71 | — |
| 5 | P3 | Personal data found in an application log | 58 | — |
| 6 | P3 | Disk latency trending upward | 46 | — |
| 7 | P4 | Routine health-check messages · 412 grouped | 22 | routine |
Local AI model
Auto-fix approvals
Audit ledger
AI you can put inside the perimeter.
Built for environments where data must not leave, and where every automated decision must be explained.
Local models only
Open-weight models run on your own hardware, under an origin policy you control. If no model is reachable, labelled rules take over and flag the result for review.
Separation of duties
Auto-fix runs only for unlocked incidents with a scripted runbook, and the requester and approver must be different people.
Tamper-evident record
Decisions, overrides and actions go into a hash-chained ledger. Personal data is tokenised and secrets removed before alerts reach the lake.
Humans stay in the loop
Acknowledge, assign, override with a reason, and give feedback. Feedback is exported to evaluate and tune the system.
Compliance clocks
DPDP and CERT-In cases are opened from the same alerts, with their clocks, a personal-data scan of logs and a control register.
Runs on the governed lake
Raw, normalised and incident-level data sit in bronze, silver and gold layers, with lineage, retention and integrity checks.
Build the system. Evidence it. Get certified.
We design, implement and audit management systems to four standards that matter for data, AI and service delivery. Certificates are issued by accredited certification bodies; we get you ready for them.
Information security
ISMS. Risk assessment, statement of applicability, controls, internal audit and management review.
Privacy
PIMS. Roles as processor or controller, records of processing, rights handling and impact assessments, aligned to the DPDP Act.
AI management
AIMS. AI policy, system inventory, risk and impact assessment, data provenance, human oversight and monitoring.
Service management
SMS. Service catalogue, incident, change and release management, service levels and continual improvement.
One register for controls, evidence and audits.
A single integrated management system, so evidence is gathered once and reused across every standard.
- Integrated, not duplicated. One set of policies, risks and controls mapped across all four standards.
- Evidence from the platform. Logs, quality scores, consent records and access trails feed controls directly.
- Internal audit built in. Findings, corrective actions and management reviews tracked to closure.
- Certification readiness. A gap view for each standard before the external audit.
Control register one register, four standards
| Control | Status |
|---|---|
| Privileged access control | Effective |
| Records of processing activities | Effective |
| AI system inventory & risk assessment | Evidence due |
| Change & release management | Effective |
| Supplier & processor oversight | Evidence due |
| AI impact assessment | Gap |
Independent assurance across security, privacy and AI.
Information security & IT controls
Controls testing against ISO/IEC 27001 and audit-manual expectations, with an evidence pack and a prioritised remediation plan.
Privacy audit
Data inventory, processing records, consent, rights handling and processor oversight, assessed against the DPDP Act and ISO/IEC 27701.
AI audit
Inventory of AI systems, data provenance and lineage, risk and impact assessment, human oversight, logging and monitoring, assessed against ISO/IEC 42001.
From gap assessment to certificate.
A staged path that keeps effort proportionate and evidence audit-ready at every step.
Gap assessment
Scope, current practice and risks compared with each standard.
Design & document
Policies, roles, risk treatment and a statement of applicability.
Implement & evidence
Controls operated, records kept and evidence collected from your systems.
Audit & certify
Internal audit, management review and support through the external certification audit.
Start with a security and assurance gap review.
We will map where you stand against ISO/IEC 27001, 27701, 42001 and 20000-1, and show where AI can reduce the load.