Compliance that runs itself, from evidence you already have.
Compliance Autopilot connects to the systems you already run, collects one set of live evidence, and scores it against Cyber Essentials, ISO 27001, NIST CSF 2.0 and CIS v8. Then it writes the reports your clients, insurers and auditors keep asking for. It is in development now.
- Microsoft 3652m ago
- Defender for Endpoint18m ago
- Intune1 hr ago
- External scanToday
- Cyber EssentialsCE2 controls to fix86%
- CIS v8 IG1CISPatching overdue77%
- NIST CSF 2.0NISTProtect is weakest71%
- ISO 27001:2022ISOAnnex A mapped58%
register interest, pricing announced at launch
At a glance
Connects to what you already run
Microsoft 365, Defender and Intune, read-only, plus an external scan of your public services.One evidence set, four frameworks
Fix a control once and every framework that depends on it updates.Reports that write themselves
Weekly threat and monthly posture reports, in plain English, to the people who need them.One evidence set. Four frameworks. Reports on schedule.
Instead of a spreadsheet you update once a year, a live picture of your posture that updates itself and tells you what to fix.
The aim is a platform that a business owner or an IT provider can set up in an afternoon and then leave running. The scoring, the registers and the reports take care of themselves; your job is to fix what it finds.
Compliance Autopilot is one of two platforms we are building. SecureCore is the on-premises appliance that watches your network; Autopilot is the compliance layer that proves it. Until they launch, the sprint and the vCISO retainer do the same job by hand.
With Compliance Autopilot, you can:
- Collect live evidence from Microsoft 365, Defender and Intune, read-only
- See your external footprint the way an attacker does
- Score Cyber Essentials, ISO 27001, NIST CSF 2.0 and CIS v8 from one evidence set
- Fix what matters, in order, and watch every score update
- Send weekly threat and monthly posture reports on their own
- Run every client from one portfolio view, under your own brand
What happens, step by step.
- Microsoft 3652m ago
- Defender for Endpoint18m ago
- Intune1 hr ago
- External scanToday
- Cyber EssentialsCE2 controls to fix86%
- CIS v8 IG1CISPatching overdue77%
- NIST CSF 2.0NISTProtect is weakest71%
- ISO 27001:2022ISOAnnex A mapped58%
Connect once, then let it run.
Your Microsoft 365 tenant plugs straight in
Connect once, read-only. Users, devices, MFA, policies and patch levels follow, with no agents to install.External scanner
Sees your public footprint as an attacker does: email records, TLS, open ports and headers.Tells you which vulnerabilities are actually yours
Matches published vulnerabilities to what you actually run, not a feed to read.Scored against four frameworks
Cyber Essentials, ISO 27001, NIST CSF and CIS, from one evidence set.Registers and policy templates
Asset, risk and supplier registers, and policy templates, drafted from the evidence.Automated reports
Weekly threat and monthly posture reports, in plain English, sent for you.Portfolio view for IT providers and MSPs
Every client on one screen, ranked by risk, with white-label reports.Data held in the UK
Stored in London under UK GDPR. Connectors only read; they never change anything.Small businesses that need to prove it, and the providers who look after them.
Regulated and supply-chain SMEs
Firms asked for Cyber Essentials, ISO evidence or insurer answers every year.IT providers and MSPs
One view of every client you look after, ranked by risk.Businesses keeping certification
See drift before renewal, so next year is a formality.In development, and honest about it.
What is true today
Compliance Autopilot is being built in Cardiff and tested against real Microsoft 365 estates. It is not on sale, there is no published price and no launch date. We would rather ship something that works than promise a month.
In development: register interest, pricing announced at launch.
What registering gets you
A note when there is something to see, first access to early testing if you want it, and a say in what gets built. If you need compliance help now, our Cyber Essentials sprint and vCISO service are available today. No price, no launch date, no spam: a short note when it is real.
“Every engagement ends with something you can act on, in plain English, at the price we agreed before we started.”
Related services.
Virtual CISO (vCISO)
An experienced security lead on a light-touch retainer: a few hours a month to own your strategy, keep compliance on track, and answer when clients and insurers ask hard questions.Priced per engagementManaged detection and response
A specialist security operations partner watches your endpoints and Microsoft 365 around the clock, contains threats, and escalates to us. We set it up, read the reports with you and own the relationship.Priced per engagement · with a partnerManaged email and firewall security
The controls that stop most attacks before anyone sees them: email filtering, SPF, DKIM and DMARC enforcement, and a managed firewall with rules that are reviewed rather than forgotten.Priced per engagement · with a partnerBackup and recovery
Managed backup of servers, laptops and Microsoft 365 with regular restore tests, so a bad day is a bad day rather than the end of the business.Priced per engagement · with a partnerSecureCore
One on-premises appliance that watches your network, responds intelligently to threats in real time, and keeps your security data in your building. Ships preconfigured, then a short guided setup.In development
Tell us what you need. A person replies, usually the same day.
Or email [email protected].