Roadmap
In development. Design partners wanted.
Nothing on this page is shipping today. It describes what we are building and the intent behind it. If the problem is one you have, we would like to build it with you rather than at you.
InlineScan is the first piece in limited release. You run a rated engine against a domain you control, and the agent narrates the results, maps them to the Essential Eight and the OWASP LLM Top 10, and drafts remediation. It is offered to design partners by invitation. Ask us for access.
Service ยท AI security
Digital CISO Agent
A continuously running security agent that watches platform health, surfaces live attacks and misconfigurations, tracks control drift, and drafts the reporting a fractional officer would otherwise assemble by hand. Delivered as a managed service with a named human accountable for it.
The problem
Point-in-time assurance does not match how fast posture moves.
A quarterly assessment tells you what was true on the day someone looked. Configuration drifts, staff change, tooling updates, and a control that was in place in March is quietly gone by June. APRA said as much in its April 2026 letter, setting the expectation of continuous monitoring across the AI lifecycle rather than point-in-time assessment.
Meanwhile the reporting itself is manual. A fractional officer spends a meaningful part of each month gathering evidence from consoles to produce a report that is out of date by the time the board reads it.
That gathering is mechanical, repetitive and well-suited to an agent. The judgement about what it means is not, and stays with a person.
Design intent
What we are building it to do.
Described as intent, not as capability. None of it is shipping, and we will say plainly when each part is.
Platform health
Continuous checks against the configuration baselines that matter: identity, endpoint, cloud posture, logging coverage. The work a fractional officer currently does by hand each month.
Live attack and misconfiguration surfacing
Bringing what your existing tooling already sees into one place, with the context needed to decide whether it matters, rather than adding another console.
Control drift tracking
Controls decay quietly. The intent is to detect when a control that was in place at the last assessment is no longer in place, and say so before the next audit does.
Reporting a board can read
The monthly governance report and quarterly board update a fractional officer assembles manually, drafted from evidence rather than from memory.
The intent is that the posture picture is built from evidence collected on a schedule, rather than assembled by hand in the week before a board meeting.
Principles
The constraints we are building inside.
We spend our working life telling clients what happens when an agent has too much access and too little oversight. It would be poor form to ship one that ignores our own advice.
A named human is accountable
The agent does not carry accountability. A person does, and that person is your fractional officer. Nothing in this changes who answers to the board.
It reports, it does not remediate
The design intent is read and report. Changes to your environment stay with humans holding change authority, which is also what the joint agency guidance asks for.
Its own containment comes first
A security agent reading your telemetry is a privileged principal reading attacker-influenced text. It gets the same containment we would build for any client agent, before it goes anywhere near a customer environment.
Existing clients first
Delivered to current fractional officer clients before it is offered as a standalone service, because they are the ones whose baseline we already understand.
Design partners
What we are asking for.
Your reporting problem, in detail
What your board actually asks for each month, what takes longest to assemble, and which questions you currently cannot answer without a week of notice.
Willingness to review output critically
Design partners tell us where the agent is wrong. That feedback is the point of the arrangement, and we would rather hear it early than ship something confident and incorrect.
No pricing conversation yet
There is no price on this page because there is no product to price. Design partner arrangements are agreed individually and documented like any other engagement.
Get started
Interested in shaping this?
Tell us what your monthly security reporting costs you in hours and where it falls short. If the fit is right, we will talk about a design partner arrangement.