The Security Audit
That Runs Itself
The fastest way for an SMB to find ghost accounts on day one — and run the ISO / SOC 2 program all the way to audit day.
Access reviews
are broken for
many companies
Access leaks through unfederated, local, and UI-only systems.
↑ 2 ghost accounts with Admin access — discovered in seconds
SMBs still run the program manually.
Even when SMBs have SSO, the compliance program — policies, risks, internal audits, evidence collection, auditor coordination — still runs on Notion pages, spreadsheets, and expensive consultants.
Existing tools each cover one slice.
None cover the whole.
Some tools see API-connected apps. Some run the paperwork. None reconcile UI reality, identity sources, and the compliance program in one evidence chain.
Enterprise IAM (CrowdStrike / SailPoint) sits a tier above this comparison: months to implement, six-figure budgets, and still not the compliance program-of-record for a 50-person team.
Audit from
a screenshot,
with AutoCISO
Vision and the browser agent capture user lists from any system — then reconcile against API, SCIM, CSV, and HRIS into one identity graph and one evidence chain.
k.chen@acme.com — terminated 2025-01-03, still has Admin access
Your AI tools have access.
Who owns it?
AI tools and apps get access through OAuth grants and service principals. Who in your company keeps the list?
Non-human identity = an app, service principal or grant that has access without being a person.
Planned pilot scope: one org, one cycle, one pack.
A review, not a dashboard
In pilot, we are building a review where decision, action and verification will be three separate records.
Planned
Our pilot design: nothing counts as verified unless a later collection is complete and comparable.
Evidence your auditor can check
We are building an evidence pack for the pilot: PDF, CSV, redacted source artifacts, a manifest with SHA-256 digests and a Not assessed section.
Illustrative layout of the planned pack
Scoped pilot,
honest limits
The pilot is planned for Microsoft 365 orgs: read-only, one cycle, known gaps to be published. By arrangement, pricing on request.
Planned pilot scope, illustrative
One platform. Three jobs.
Zero spreadsheets.
Not a utility. Not a checklist. The full virtual-CISO scope, organized around the work of running a real program.
Access Intelligence
See every account, owner, and ghost — including the ones APIs miss.
- Ghost Hunter
- License Waste
- Zombie Hunter
- Offboarding Hub
- Periodic Access Reviews
- Hybrid Identity Graph
Compliance Program
Run the actual work of compliance, not just the tooling.
- Scope Wizard
- AI Policy Generator
- Risk Register
- Internal Audit
- Management Review
- Evidence Vault
Audit & Certification
Walk into the audit with evidence already mapped to controls.
- Auditor Portal
- Readiness Score
- Continuous Evidence
- ISO 27001 / SOC 2 / HIPAA mapping
Same workspace. Same evidence chain. From day-one ghost to year-one auditor handoff.
From first audit to audit day, in one workspace.
We land at Day 1 with a free audit. We expand into the workflows that help the customer prepare for an ISO 27001 audit and keep the evidence chain alive.
Every milestone unlocks the next tier. ARPU expands inside the same account — the customer never re-platforms.
Security dashboard
that tells you
exactly what to fix
Real-time risk scoring, ghost account alerts, zombie seat detection, and compliance readiness — all in one view.
Built different by design
| AutoCISO | API GRC | SaaS Ops | vCISO + manual | |
|---|---|---|---|---|
| Coverage outside the IdP | ✓ | — | — | ~ |
| UI / API reconciliation | ✓ | ~ | ~ | — |
| Hybrid identity graph | ✓ | ~ | ~ | — |
| Legacy / on-prem apps | ✓ | — | — | ~ |
| Automated evidence | ✓ | Partial | — | — |
| ISO 27001 full workflow | ✓ | Partial | — | ~ |
| Full lifecycle (first audit → auditor handoff) | ✓ | Partial | — | ~ |
| SMB pricing | $99/mo | $$$ | $$$ | Hours |
Vision-native verification
Independent attestation of what the user interface actually shows. Verifies what API and IdP claim — even outside SSO, even on legacy and on-prem.
Agentic Evidence Agent
Playwright-driven browser automation logs into any system autonomously. Captures evidence on cadence, not on prep cycles.
evidence vault → auditor handoff
Hash-chained evidence, 7-year retention. The same evidence the customer collects on day one is what the auditor receives at handoff — pre-mapped to controls.
Hybrid evidence graph
Vision, API, SCIM, CSV, HRIS, and auditor artifacts resolve into one identity graph and one chain of evidence. Customers mature their stack without changing systems.
Simple pricing
- 15 connected apps
- 10 audits / month
- Ghost Hunter
- AI assistant (50 req)
- Access relationship graph
- 150 connected apps
- Browser extension
- Offboarding workflows
- Jira + Slack tasks
- CISO reports (10)
- Evidence Agent (auto)
- Zombie Hunter
- ISO 27001 full suite
- Toxic combo detection
- Unlimited audits
- Continuous monitoring
- Auditor portal
- evidence vault
- HIPAA BAA
- Board reporting
Land with
a free audit,
expand with compliance
Ghost account audit as the loss leader — everyone finds something on first run. Compliance need drives tier expansion.
vCISO Partner Portal —
channel economics for SMB
We do not only sell one SMB at a time. We sell partner leverage to the people already paid to run SMB compliance — lower CAC via trusted-advisor distribution, higher ARPU via portfolio billing.
Security governance
for companies without a CISO team
We're building the AI co-pilot that monitors access, raises alerts, and collects evidence continuously to help you prepare for an ISO 27001 audit.