The compliance control plane for software teams
payments-api · PR #482
Add ssn column to customers
- Data touched
- customers.ssn (PII)
- Controls
- SOC 2 CC6.1 · HIPAA §164.312
- Reviewer
- Security reviewer missing
- Encryption
- At rest: not yet verified
Illustrative example
The problem
Compliance today is expensive, reactive and disconnected from real risk
Software companies need SOC 2, ISO 27001 and often HIPAA, PCI DSS or GDPR to close deals. The way most teams get there is broken.
Compliance and engineering are disconnected
A developer ships a change that breaks a control, and nobody notices until an auditor or a customer questionnaire finds it months later.
Evidence is gathered by hand
Screenshots, Git archaeology and spreadsheets at audit time. Slow, error-prone and out of date as soon as it's done.
GRC tools treat compliance as a checklist
They map frameworks and store uploads, but don't understand the software: which service touches customer data, which change needs a security review, or whether live configuration matches written policy.
Code review checks quality, not regulatory impact
Review tools find bugs, but can't say “this change affects HIPAA safeguards and is missing an authorized reviewer.”
One journey, two halves
Get compliant fast, and stay compliant. Prove every control, on every change.
Get compliant
Connect your existing product. CyberGuard discovers your repos, services, data and cloud setup, maps them to your target framework, and produces a prioritized gap list with owners, suggested fixes and the evidence still needed. Then it drives that list to done.
Stay compliant
Once you reach the baseline, CyberGuard checks every pull request, release and cloud change, so new work can't quietly break a control. Evidence is generated automatically as a side effect of normal engineering work.
The brain
The compliance graph
A live map linking people and teams, apps and repos, services and APIs, databases and data types, cloud resources, vendors, AI models, regulations and controls, and risks, incidents and customer commitments. When something changes, CyberGuard knows everything it touches: a change to a table holding personal data may affect privacy notices, retention, encryption, access reviews and cross-border transfer rules, not just “line 42.”
migrations/0042_add_ssn.sql, line 42
ALTER TABLE customers ADD COLUMN ssn
One new column. Looks fine.
Privacy notice
Has to disclose the new data
Data retention
Needs a retention period
Encryption
Must be encrypted at rest
Access reviews
Who can read this column?
Cross-border transfers
Where is the data stored?
Controls
SOC 2 CC6.1, HIPAA §164.312
The hands
The execution loop
For every meaningful change, this runs automatically while developers work.
- 01
Detect
Spot the risky change the moment it's opened: a pull request, a release or a cloud change.
- 02
Explain
Name the exact regulation and control it affects, and why.
- 03
Coordinate
Route the fix to the right owner, with a suggested change and a due date.
- 04
Verify
Confirm the fix actually works, using fixed rules and real evidence.
- 05
Evidence
Record timestamped, source-linked proof for the audit.
- 01Detect
Spot the risky change the moment it's opened: a pull request, a release or a cloud change.
- 02Explain
- 03Coordinate
- 04Verify
- 05Evidence
payments-api · PR #482
Add ssn column to customers
- Data touched
- customers.ssn (PII)
- Controls
- SOC 2 CC6.1 · HIPAA §164.312
- Reviewer
- Security reviewer missing
- Encryption
- At rest: not yet verified
Illustrative example
Want this running on your own pull requests?
CyberGuard GRC is in early access. Join the list and we’ll reach out as spots open up.
Modules
Everything a compliance program needs, connected
Each module reads from and writes to the same compliance graph, so nothing lives in a silo.
- GRC foundation
- Organizations, roles, policies, controls, frameworks, risks, issues, tasks, exceptions, approvals, audit periods and an evidence repository.
- Unified risk graph
- Every system, person, vendor, data type and control linked in one model.
- Compliance-aware code review
- Each pull request is checked for affected data, auth changes, logging, encryption, secrets, risky dependencies and missing reviewers, with developer feedback, a pass / warn / block decision and an evidence record.
- Release compliance gates
- Before deploy, confirms approvals, tests, reviews, vulnerability thresholds and a rollback plan, then produces a signed Release Compliance Passport.
- Runtime and cloud assurance
- Monitors IAM, encryption, public exposure, network rules, logging, backups and config drift, and ties any violation back to the service, repo, owner and deployment.
- Evidence automation
- Turns PR reviews, CI results, scans, approvals, access reviews and incidents into timestamped, source-linked evidence.
- Risk and remediation
- Every finding gets a suggested fix (code, infrastructure-as-code or policy), a test that proves it, an owner, a risk-based due date and a Jira or Linear ticket.
- Policy library
- Policy templates for each framework, customized to your company, plus checks that reality matches the policy: if it says “MFA required,” CyberGuard confirms MFA is enforced.
- Privacy engineering
- Records of processing, data inventories, data-flow maps, retention, consent, data-subject requests, privacy impact assessments, subprocessors and transfer assessments, kept up to date automatically.
- AI governance
- An inventory of AI models with risk classification, provider review, prompt and data handling, bias testing, change approvals, and alerts when sensitive data is sent to external models.
- Third-party and supply-chain risk
- Continuous vendor posture, breach signals, SBOMs, licenses, subprocessors and expiring certifications, plus which data and customers each vendor change affects.
- Resilience and operational risk
- Business impact analysis, recovery time and recovery point targets, disaster-recovery tests, backup verification and single points of failure. Show you can actually recover.
- Auditor workspace
- Auditors request evidence, ask questions in plain language, trace any item to its source, comment, accept or reject, and export a final package.
- Customer trust portal
- Publish continuously verified security status to customers, turning compliance into a sales tool.
- AI agents
- Evidence, compliance analyst, risk, remediation, audit, vendor-risk, incident and policy agents take governed actions, each logging its reason, the evidence used, a confidence level and who approved it.
Frameworks
Implement a control once. It counts everywhere.
Every framework runs on one shared control model, so the same evidence covers them all.
Say goodbye to
What CyberGuard retires
Screenshot-and-spreadsheet audits
Evidence collects itself.
Audit-season fire drills
You're audit-ready every day, not once a year.
Legacy, standalone GRC tools
One platform that understands your software, not another checklist.
Stale evidence
Out-of-date proof and control drift are flagged automatically.
Surprises months later
A change that breaks a control is caught in the pull request, not in the audit.
Doing the same work for each framework
Implement a control once and it counts for SOC 2, ISO, PCI, HIPAA and GDPR at the same time.
Policies that are just PDFs
Written policy is checked against what's actually running.
Endless security questionnaires
Answered with citations to real, verified controls.
A large compliance team just to close enterprise deals
Prove security without building a big GRC function.
Keep the tools you already rely on
CyberGuard works with the security scanners, logging and monitoring (SIEM), ticketing, identity and cloud tools you already run. It doesn't replace them: it uses their signals as evidence.
Who it helps
A win for everyone involved in compliance
Compliance and security leads
Always audit-ready, evidence that holds up, far fewer manual hours and no surprises.
Engineering leads
Compliance that doesn't slow shipping, few false alarms, and feedback inside the pull request instead of in a meeting.
Founders and CTOs
Close enterprise deals faster and prove security without building a big GRC team.
Auditors
A clean, traceable evidence package that makes audits faster and cheaper.
Sales and go-to-market
A trust portal and fast questionnaire answers that unblock deals.
Ideal fit
Built for SaaS and software companies that sell to businesses, need SOC 2 or ISO 27001, have a small or no security team, deploy often, use GitHub or GitLab with AWS, and handle sensitive data or build AI products.
Why CyberGuard
Traceability from change to consequence
Other GRC tools compete on integration counts and framework lists. CyberGuard connects every pull request to the data, controls, risks, approvals and evidence it touches.
Traceability from change to consequence
Pull request → data → control → risk → approval → evidence → audit record, connected end to end.
Release Compliance Passport
Signed proof that every release passed its required controls.
Checks reality, not just paperwork
Verifies that controls actually work in production.
Change impact analysis
Shows what a new regulation, vendor or code change affects before it lands.
Fixes, not just reports
Creates the work, follows up and verifies the fix.
Evidence over the whole audit period
An evidence trail covering the full 3–12 month SOC 2 Type II window, not a one-off snapshot.
Works with AI coding tools
Cursor, Claude Code and Copilot can enforce CyberGuard's controls as developers write code. CyberGuard remains the system of record.
Release Compliance Passport
Signedpayments-api v2.14.0
- Approvals2 of 2
- TestsPassed
- Security reviewCompleted
- Vulnerability threshold0 critical · 0 high
- Rollback planAttached
Illustrative example
On the roadmap
- A “compliance diff” between any two points in time
- Automatic security questionnaire answers
- Policy-as-code
- A control marketplace
- False-positive rates published as a metric
Built on trust
AI that explains. Rules that decide. People who approve.
The AI explains; fixed rules decide
Pass or fail always comes from repeatable rules plus real evidence, never an AI guessing.
Every finding is explainable
The exact regulation, control, code path, config, commit and evidence behind it.
People stay in charge
Blocking a release, accepting a risk or applying a fix always needs human approval.
Read-only, least-privilege connections
Minimal data captured, and no source code kept beyond analysis.
Data residency and private hosting
Options for regulated buyers who need their data to stay put.
Works with your stack
Connect the tools you already run
Read-only connections turn signals from your existing tools into source-linked evidence.
Code and CI
GitHub, GitLab
Cloud
AWS
Ticketing
Jira, Linear
AI coding tools
Cursor, Claude Code, Copilot
Security scanners
Your existing scanners
Logging and SIEM
Your monitoring stack
Identity
Your identity provider
FAQ
Questions, answered
Which frameworks does CyberGuard GRC support?
SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR, NIST and ISO 42001 for AI, all on one shared control model, so a control you implement once counts toward each of them.
Does CyberGuard replace my security scanners or SIEM?
No. CyberGuard works with the scanners, logging and monitoring, ticketing, identity and cloud tools you already use, and turns their signals into audit evidence.
Does AI decide whether a control passes?
No. Pass or fail always comes from repeatable rules plus real evidence. The AI explains findings and suggests fixes, and people approve any block, risk acceptance or fix.
Do you keep our source code?
Connections are read-only and least-privilege. CyberGuard captures minimal data and doesn't keep source code beyond analysis. Data residency and private hosting are options for regulated buyers.
Who is CyberGuard GRC for?
Software and SaaS companies selling to businesses that need SOC 2 or ISO 27001, deploy often, and have a small or no dedicated security team.
How do I get access?
CyberGuard GRC is in early access. Join the list and we'll reach out as spots open up.
Get audit-ready, and stay that way
Join early access and we'll reach out as spots open up.
Get early access