Every module, and the agent underneath it.

The AI Risk Composer turns a sentence into a structured risk — category, owner, inherent scores with rationale, candidate controls and a treatment strategy — presented beside the field for you to apply, edit or reject.

The LLM proposes likelihood and impact grounded in your own control coverage and justifies each. The arithmetic stays deterministic — the model influences inputs, never the number.

The Risk Agent flags every appetite breach, quantifies the gap, and ranks the fastest routes back inside tolerance by effort against exposure reduction.

Drafts the full treatment plan — strategy, sequenced actions, owners, target dates — and creates them as real task records routed to the right owners and queues.

Proposes the indicator and a defensible threshold for a given risk, runs a scheduled sweep collecting values from connectors, and writes the interpretation of every breach.

Ask the portfolio a question in plain language — "which critical risks have no tested control?" — and get an answer computed from live data with the contributing records cited.

Drafts a complete control from a risk or straight from selected clauses — objective, activity, frequency, owner and a written test procedure, pre-cited to the standard.

Auto-attests controls from connector data with the source artefact attached — then stops at the sign-off gate . The LLM tells the approver whether the evidence actually supports the claim.

Assurance banding and compliance percentages are computed and reproducible — never model-derived. The AI writes the commentary, not the number.

Gap-checks the policy set against a framework, drafts the next revision of anything overdue, and flags every policy with no enforcing control. It never publishes on its own authority.

Scopes the population from a plain-language description, runs the chase cycle autonomously, and writes a plain-language summary of the policy so acknowledgement is informed rather than reflexive.

Suggests clause citations with a confidence rating and rationale, drafts exclusion justifications that survive external audit, and warns where a proposed exclusion will be challenged.

Cross-maps your existing library to a newly adopted standard — already covered, partially covered, genuinely new — turning adoption from a project into a review.

Polls sources, triages what arrives, and produces an impact assessment naming your affected records by code — then drafts the amended clause, the revised control and the implementing tasks.

Drafts the case and the approver's brief stating plainly what risk is being accepted and for how long. Detects exception sprawl — repeated renewals pointing at one unfixed root cause.

Generates course content and assessment questions from a policy, control or incident — so training derives from your actual obligations and actual failures.

Risk-scores the universe from register data — exposure, control weakness, incident history, time since last audit — and proposes the annual plan.

Drafts the audit plan — scope, objectives, controls selected on risk and the test approach per control — then writes the report narrative from the findings.

Generates and issues the whole request list, chases it automatically, and pre-assesses what comes back — flagging insufficient submissions before an auditor spends time on them.

The Remediation Agent triages by severity and exposure, drafts remediation plans as real tasks, proposes root cause, and clusters findings into systemic themes.

Assembles the bundle from a natural-language request, writes the cover narrative including what is missing, and pre-reviews it as an auditor would before you send it.

Determines which controls are automatable from currently connected tooling, attests those from live data, routes the rest for manual evidence, and reports the split.

Triages within seconds — category, severity, affected systems, notifiability. Identifies which controls failed, drafts the regulatory notification for legal review, and writes the post-incident review.

Runs the clock and escalates as the deadline approaches. It drafts the notification; it never sends an external communication on its own authority.

Extracts structured findings from unstructured artefacts — configuration exports, scan reports, PDFs — and records them against the right control.

Targets training from risk and incident data — recommending who needs what based on incidents they were involved in and controls they operate.

Drafts a plan for a service from its dependency graph, criticality and supplier relationships — a starting document rather than a blank template.

Proposes impact ratings and recovery objectives from dependency and criticality data, with the reasoning recorded for challenge.

Generates the test scenario and script appropriate to the plan's criticality, then analyses the result and drafts the plan revision it implies.

Detects plan staleness against reality — a plan naming systems, people or suppliers that no longer exist in the register — and raises the work to fix it.

Generates the supplier risk narrative for the relationship owner: what this supplier exposes you to, and what you rely on them for.

The derivation is computed and explainable. The LLM may propose the criticality and data-sensitivity inputs; it never computes the tier.

Generates a questionnaire from an objective, pre-answers it from what the platform already knows with each source shown, and evaluates free text against the intent of the question.

Assesses an uploaded SOC 2 Type II or certification report against your control requirements, extracting the exceptions and mapping them to your affected controls.

Runs the cycle end to end: identifies what's due, issues the right questionnaire, chases the response and escalates the non-responsive.

Monitors external sources for adverse events affecting critical suppliers and raises them against the supplier record.

Every agent run is bound to a security principal, so an agent can never read or act on data the invoking user could not.

Work an agent raises routes to the correct group queue rather than guessing an individual.

An hourly job opens and closes delegation windows, so cover is never dependent on somebody remembering to switch it on.

Prompt and instruction overrides per agent, versioned and audit-logged, so the fleet speaks in your organisation's language and to your own standards.

Composes contextual notifications stating what the recipient must do and why — and suppresses notification fatigue by batching the low-value ones.

The scheduler is also the cadence engine for the fleet, running each agent on its configured schedule and recording every run against it.