Technology risk, run by agents — governed by your people.
Vigil8 is the technology risk and compliance platform where AI agents don’t just summarise — they assess risk, draft controls, collect evidence and drive remediation inside the register, under the same lifecycle, permission and maker–checker rules your team works to.
- Every agent action logged and attributable
- Reversible in one click
- Stops at a human gate
- ISO/IEC 27001:2022
- ISO/IEC 20000-1:2018
- ISO 31000:2018
- ISO/IEC 42001:2023
- SOC 2 · NIST CSF · DORA
- UAE Information Assurance Regulation
- DESC ISR v2
- UAE PDPL (45/2021)
- DIFC Data Protection Law No. 5
- ADGM Data Protection Regs 2021
- NCEMA 7000 business continuity
Figures are indicative of typical programmes and are agreed as targets during implementation planning, then reported against at every governance review.
One platform across every technology risk discipline
Risk, compliance, audit, cyber, resilience and third party on a single relational system of record — not six products behind one login. Every discipline has an agent that owns its operational work.
Risk Management
Enterprise and technology risk on a 5×5 inherent-versus-residual model, with appetite, tolerance and treatment that derives its status from the work actually done.
- Risk register & taxonomies
- Inherent / residual assessment history
- Appetite, tolerance & breach detection
- Treatment plans, one approval gate
- Key Risk Indicators & thresholds
Regulatory Compliance
Multi-standard compliance with a common control framework — test once, report against every standard, and keep a Statement of Applicability that cannot disagree with the register.
- Control library & common controls
- Policies, versions & acknowledgement
- Statement of Applicability (derived)
- Regulatory change & horizon scanning
- Exceptions & accepted exposure
Internal Audit
Risk-based audit from universe to closure, with evidence requests issued and chased automatically and findings landing in the same register as every other issue.
- Audit universe & annual plan
- Engagements, fieldwork & reporting
- Evidence requests (PBC) tracked to receipt
- Findings & management actions
- Tamper-evident evidence bundles
Cyber GRC
Security control assurance driven by live telemetry. Agents attest controls straight from Entra ID, AWS, CrowdStrike and Wiz — and flag exactly what still needs a human.
- Continuous control monitoring
- Auto-attestation from connected tooling
- Incident response & notification clocks
- Vulnerability & posture evidence
- Security awareness & training
BCM & Resilience
Continuity and disaster recovery tied to the services, suppliers and systems they protect — with test cycles that raise real work when a plan fails or goes stale.
- Continuity & DR plans with RTO / RPO
- Business impact analysis
- Scheduled plan testing & results
- Dependency & coverage gap reporting
- Operational resilience reporting
Third-Party Risk
Supplier tiers derived from criticality and data sensitivity — never chosen — so assessment depth and cadence follow the exposure rather than whoever fills the form.
- Supplier register & derived tiering
- Questionnaire designer & portal
- Certification & SOC 2 expiry tracking
- Automated reassessment cycles
- Concentration & fourth-party view
Four things that make this different
A register that scores risk properly. A command centre that explains its own numbers. A fleet of agents that does the work. And a builder that lets you wire agents to your actual tooling, control by control.
Risk that shows its working
Anyone can store a risk score. Vigil8 records how it was reached — a dated, attributable assessment with a rationale grounded in your actual control coverage, so the register survives the question "why is that a 9?"
- 5×5 inherent and residual — scored separately, with full assessment history rather than a single overwritten number
- Appetite and tolerance — held per category and entity, with breaches surfaced automatically
- The AI proposes the inputs, never the number — scoring arithmetic stays deterministic and reproducible
- Treatment has one gate — on the plan — delivery status derives from the underlying tasks
A dashboard your auditor can’t pull apart
Most GRC dashboards report a compliance percentage nobody can reconstruct. Ours breaks the number down by how strong the evidence behind it actually is — and lets you click through to the records that produced it.
- Compliance by assurance level — automated and re-performed testing counted separately from self-attestation
- Unapproved work doesn’t count — a submitted attestation stays out of the figure until a checker signs it
- Accepted exposure is visible, never hidden — every gap carried under an exception, with its expiry
- Snapshot reports that don’t silently re-compute — plus board packs with AI-written commentary
Six agents, each owning a domain
Not a prompt library. Each agent is a named, persistent actor with a run cadence, a bound tool set, bound connectors, an explicit autonomy level and a human owner — administered from one console and pausable in one click.
- Three autonomy levels — suggest only, acts with review, autonomous — changed by your administrator, not by us
- Prohibited actions — an agent can never publish a policy, approve its own work, grant an exception or close an incident
- Blast-radius limits — per agent per run, with one-click reversal of anything autonomous
- Measured, not marketed — the console reports how much agent output your people accept, edit, reject or reverse
Scores new risks against your appetite and drafts the treatment plan.
Writes controls mapped to the standard clause, with a test procedure.
Pulls evidence from your estate over MCP and files it against the control.
Builds the fieldwork programme and drafts findings from the workpapers.
Reads regulatory change and proposes which controls need to move.
Follows up owners on overdue actions and escalates on your rules.
Wire agents to your tools, control by control
A workflow step doesn’t just name a tool — it names how the agent reaches it. Bind each control to the connector, transport and endpoint that evidences it. MCP where a server exists, REST where it doesn’t, and manual named honestly where nothing can.
- The AI proposes every binding — naming the specific artefact it would return — and a human confirms each one
- Unconfirmed bindings block the run — agents never probe your estate to discover what they can reach
- Manual is a first-class transport — so the automation gap is visible in reporting rather than quietly hidden
- Observable step by step — any failed step is retryable on its own
From a sentence to signed-off evidence — without leaving the platform
Describe an exposure in plain language. Five steps later you have a scored risk, a drafted control cited to a standard, live evidence from your own tooling, and an attestation waiting for a human signature. Agents do the work; people keep the authority.
Compose the risk
A sentence becomes a structured risk — category, owner, inherent likelihood and impact, each with a rationale drawn from your own control coverage.
AgentDraft the control
Objective, control activity, type, frequency, owner and a written test procedure — pre-cited to the ISO clauses it satisfies.
AgentBind the evidence source
The platform names which connected system can prove the control, over which transport, and exactly what artefact it will return.
PersonCollect and verify
The agent calls the bound tool, attaches the artefact with full provenance, and flags anything that doesn’t actually prove the control.
AgentAttest — and stop
The attestation enters awaiting sign-off. It does not count toward compliance until an independent checker agrees.
PersonAdopt a standard in a review, not a project
Hold every standard concurrently with its full clause structure. Controls cite clauses many-to-many, so one control tested once reports against ISO 27001, ISO 20000-1 and your customer’s security schedule at the same time.
- AI cross-maps your existing libraryto a newly adopted standard — already covered, partially covered, genuinely new
- Clause citations suggested with confidence ratingsand a one-line rationale, for you to confirm
- The Statement of Applicability is derived, never storedfail a control test and the SoA changes without anyone editing it
- Accepted gaps appear on the SoAso the document an auditor holds never overstates your position
Configured for the obligations you actually carry
The frameworks, taxonomies, questionnaires and notification clocks that apply to your sector, set up at implementation — not a generic library you spend six months pruning.
What changes in the first year
The three numbers customers hold us to. We’ll agree the baseline with you at implementation and report against it — not claim it and move on.
less manual GRC effort
Evidence collection, chasing, attestation and reporting shift to the fleet. Your people move to judgement work — reviewing, deciding and signing. Measured against the pre-implementation baseline at month 12.
faster audit evidence turnaround
A request that took days of manual assembly becomes a self-service, tamper-evident bundle with chain of custody and its own stated gaps.
more controls under high assurance
Controls proven by automated testing rather than self-attestation. The compliance number stops being a number and starts being evidence.
Your agents reach your estate — over MCP first
Twenty-two connectors across identity, cloud, security tooling, ticketing and workforce. Each declares which controls it can evidence, so the value of connecting a system is visible before you connect it.
- MCP as the preferred transporttyped, discoverable tool calls over a Model Context Protocol server — selected by default wherever one exists, with REST as the fallback
- Bring your own MCP serverVigil8 also publishes its own, so your other AI tooling can query GRC data under the same permissions
- Every call loggedtarget, arguments, response summary, latency and outcome — recorded per call, exportable as audit evidence
The platform is an AI system too — so we built it to be governed
Vigil8 will sit inside your ISO/IEC 42001 management system. These aren’t features we added for a questionnaire; they’re the reason the fleet can be trusted with authority at all.
Trusted where the consequences are real
Customer types rather than logos, so nothing is asserted that isn’t true. Swap these for cleared customer logos once you have written permission.
4,000 staff · DORA & ISO 27001
Operational resilience programme
Placeholder — add your citation, or delete this tile. Never substitute an award the company has not received.
Placeholder — add your citation, or delete this tile.
We stopped buying "AI-powered" GRC and started asking one question: can it take an action, and can you show me the log? Vigil8 was the only platform where the answer to both was yes on the day of the demo.
Written for people evaluating this properly
No gated fluff. These are the documents we’d want an evaluator to hold — including the ones that make our own claims testable.
The 440-requirement RFP pack
A complete technology risk GRC requirement set with an AI and agentic block under every functional area, a weighted scoring model, and the rules that separate a working agent fleet from a chat box.
Request a copyEleven scenarios to run on any vendor
The scripted demonstration we ask to be held to — including the one where the model endpoint is disabled live, and the one where the panel strips a control’s evidence and regenerates the bundle.
Request a copyWhere determinism ends and inference begins
A feature-by-feature map of what is computed and what is generated — and the deterministic fallback sitting behind every AI capability. The question most vendors can’t answer.
Request a copySee the chain run live — on your standards, in 45 minutes
We’ll take an exposure you describe on the call and take it through to signed-off evidence. Then we’ll pull the model endpoint out and show you the platform still works.
- No slide-ware
- Your scenario
- Agent trace shown throughout