Secfix

The Skeptic

The risk methodology is genuinely documented — ISO 27005 lifecycle from identification to monitoring, pre-built scenarios with automatic owners and quarterly reviews, and a change trail — and asset discovery with bulk classification and scope tracking is real, with custom hardware entering by bulk Excel. But I found no public information on incident handling of any kind, statutory reporting clocks, protection-need inheritance across asset relations, or configurable risk matrices. That puts asset and risk management depth solidly above a flat register and below a full risk backbone. 2 3

Report an error

The Skeptic

This is the vendor's strongest ground: Statement of Applicability generated as controls are assessed with exclusion justifications, every control linked to its proving evidence, full version history with AI change summaries, and non-conformities logged, owned and tracked to closure after an internal audit run first. What I could not verify from the captured pages is measure delegation with escalation and versioned catalog updates as regimes evolve. The control side is operable, not a consultant's checklist. 4 8

Report an error

The Skeptic

Ten regimes are named consistently across every page I can see, including NIS2, TISAX and DORA with dedicated pages, and one-scenario-many-frameworks mapping is claimed on the risk page and shown as overlap pre-mapping on the DORA page. I found no public information on a documented update cadence when standards move, per-industry profiles, or BSI IT-Grundschutz, and depth beyond the logos is uneven. Broad coverage with genuine cross-mapping, just short of the living-product top. 2 6 7 9

Report an error

The Skeptic

Version history for evidence and controls, a full change trail on risks, structured view-only auditor access, continuous collection with due-soon and overdue flags, and audit lifecycle support through surveillance and recertification — the mechanics are evidenced, not just promised. The headline numbers, a claimed 100% audit success rate across 1000+ audits, are marketing figures I can only take at face value; I found no public information on audit-scoped evidence packs on demand, management reports at a click, or reconstructing the state on a given date. That lands just under the full revision-safe benchmark. 4 8

Report an error

The Skeptic

The API is real and unusually well-documented — public OpenAPI 3 contract, OAuth2 client credentials, RFC 7807 errors, additive-only versioning — but the documented surface covers inventory assets and computers only, while risks, controls and evidence appear nowhere in the endpoints. Cloud and endpoint connectors are named (AWS, Azure, GCP, Intune, Jamf), ticketing, HRIS and SSO exist as pre-built categories, and 250+ automated checks run continuously. I found no public information on webhooks, SCIM, or a named ticketing connector, so this stops short of infrastructure-grade. 3 8 10

Report an error

The Skeptic

The sovereignty record is empty: I found no public information on hosting location, data centers, a DPA, or a subprocessor list for the system that would hold the risk register. The only European signal anywhere is the GmbH in the vendor name. A buyer cannot verify under whose law their entire security posture would sit from these captures. 1

Report an error

The Skeptic

The only pricing-adjacent public fact is a free, non-binding demo; I found no public information on edition prices, module pricing, user or entity tiers, billing periods, or how the bundled dedicated compliance experts are separated from software cost. This is the no-public-prices case the market knows well — described, not condemned — but it is unmistakably that case. 6 7

Report an error