Turn invisible cyber risk
into decisions you can make.

Yes. Across every product plan, AI drives assessment, analysis, and report generation on its own, with results delivered without added staff effort. If you need a security consultant's sign-off or ongoing support as an external CISO, you can add it as an add-on (Expert Review = Act and above, Dedicated CISO Support = Govern and above). It also works for teams where IT handles security as a side responsibility.

Yes. Assessment results are auto-bundled into a PDF for leadership. On Assess this covers the score summary and risk list; the economic analysis chapter and the improvement roadmap chapter are available on Act and above. You can report the state of risk and the basis for investment with quantitative data.

Choose based on the features and scale you need. Assess lets you reassess anytime and delivers watermark-free PDF reports. Act adds economic analysis, initiative management, and incident response. Govern is built for group governance, with up to 15 parent-child tenants, SSO, and audit log export. Enterprise is designed individually for cross-group and regulatory needs. If you need human sign-off on the first-pass evaluation, quarterly reviews, or ongoing support from a dedicated security consultant as an external CISO, you can add these as add-ons (Expert Review / Dedicated CISO Support).

Each plan has a monthly cap on AI usage. As a rough guide, using one standard assessment at CIS Controls IG1 as the unit, the Assess plan corresponds to roughly 4-6 assessments per month, Act to roughly 15-25, and Govern and Enterprise to roughly 40-60. Usage is counted per calendar month (Japan time) and resets on the first day of each month; unused allowance does not carry over. These are estimates only: frameworks with more questions, CIS Controls IG2 / IG3 assessments, and AI features such as ROI estimation, report generation, roadmap generation, and the CISO Advisor draw from the same allowance, so actual counts vary with usage. We show an in-app notice once you reach 80% of the cap, and also notify you by email once you reach 100%. After reaching the cap, contact us about moving to a higher plan or arranging additional capacity.

We provide trials individually to customers who contact us and submit our trial application form — no card is required and nothing is charged automatically. The plan, the period (30 days as a rule as of this writing), the number of users, the number of assessments and the AI usage are set out in the trial application form. If you do not move to a paid contract after the trial ends, you can no longer sign in from the day after the trial ends, and we delete your data within 30 days of the end date (if you consented to the creation of statistical information, we retain your assessment results in a form that cannot identify you). If you move to a paid contract, we carry over the assessment results and reports you choose. See the Specified Commercial Transactions Act notice below for details.

By default, AI runs from the first-pass assessment to the final results without an expert check. If you want expert verification, the Expert Review add-on (Act plan and above) adds a sign-off step in which our security consultant approves the content before finalization; the score, risk analysis, and report are finalized after that approval.

Yes. Based on your approved assessment results, AI automatically extracts the questions from a received Excel checklist and drafts answers with compliance status, confidence, and evidence. A person finalizes the answers (with the Expert Review add-on). Check-sheet response support is available on the Act plan and above.

Yes. Bulk-upload policies and procedure manuals (PDF, Word, Excel, PowerPoint) into the Evidence Library, and AI matches them against assessment questions and surfaces them as per-question reference information during AI hearings. Answers and scores are never auto-filled — people answer. The Evidence Library is available on the Act plan and above at no extra cost.

It means one first-pass sign-off per assessment, before finalization — not a per-month or per-contract count. The Expert Review add-on also includes review of generated deliverables (return-on-investment estimates, initiatives, report), a quarterly review, and expert verification needed for third-party rating programs. If you run multiple assessments in the same tenant, each one gets a review before finalization.

Risk is quantified along the attack chain via our own method ACRA (MITRE ATT&CK-aligned). Expected loss is computed as a probability distribution using the international standard FAIR (Factor Analysis of Information Risk) plus Monte Carlo simulation — telling you 'the 95% prediction range for annual loss' and 'the P95/P99 benchmark (roughly 1-in-20 and 1-in-100-year events)', a more confident basis for investment than a single point estimate. For investment, the Gordon-Loeb model from information security economics gives a recommended ceiling relative to the expected annual loss — a ceiling to reason against, not a guarantee that spending up to it is sufficient. This economic analysis is available on Act and above (not on Assess).

Yes. The six frameworks — CIS Controls v8.1.2 / NIST Cybersecurity Framework (CSF) 2.0 / ISO 27001:2022 / Supply-chain Security Evaluation Scheme (SCS) / OWASP Top 10 for LLM / AI Governance Maturity Assessment — totaling 628 assessment items can be run in parallel within the same tenant. You can also choose a different IG / ★ level for each assessment.

Yes. We cover OWASP Top 10 for LLM Applications 2025 (with MITRE ATLAS attack-tactic tags), so AI-specific risks like prompt injection, sensitive-data leakage, data/model poisoning, and excessive agency are visualized in the same framework as your existing cyber risk analysis (ACRA) and ROI. ROI analysis is available on Act and above. Designed for organizations using, building, or providing internal chatbots, RAG, or AI agents.

Yes — via the AI Governance Maturity Assessment (10 management domains, 68 questions), which we built ourselves by referencing NIST AI RMF 1.0 and ISO/IEC 42001:2023. Where OWASP Top 10 for LLM addresses the technical risks of individual AI systems, this framework visualizes the organizational/policy layer — how the organization governs and manages AI — on a 0–5 maturity scale. Available on all plans. It is not the official standard published by NIST or ISO/IEC, and does not guarantee certification.

When each roadmap phase is assumed complete, our proprietary model — applying ideas from security game theory (Stackelberg Security Games; Tambe et al., 2011) — previews how an attacker's likely focus would shift across areas, with AI-generated commentary. It is not a forecast of actual attack probabilities. Available on the Govern and Enterprise plans. See 'Attacker-Perspective Simulation: methodology' in Help for the full rationale and references (with DOIs).

Yes. The Act plan has no parent-child tenant mechanic and is limited to a single tenant. The Govern plan supports up to 15 group companies as standard, and larger group structures are handled by the Enterprise plan under an individual contract. Admins and viewers of the parent tenant can browse and aggregate scores, risks, and contract status across tenants, with data fully isolated between them.

In the AWS Tokyo region. Data is fully isolated across tenants, and all major operations from sign-in through assessment and report generation are recorded to the audit log (retained for 1 year). Viewing the audit log and tamper detection are available on every plan; exporting to CSV / JSON requires Act and above.

No. AI (large language models) is used for the AI hearing, risk analysis, and report generation, but data sent through this service is never used to train the AI. Data is stored in the AWS Tokyo region and fully isolated across tenants. See our Privacy Policy for details.

We implement MFA, a strong password policy, browser-side security controls, per-feature rate limiting, audit log retention with tamper detection for all major operations (CSV / JSON export requires Act and above), and error monitoring. Data is fully isolated across tenants and cannot be cross-referenced by design.

Yes. In CISOaaS you can select the SCS Evaluation Scheme's ★3 and ★4 criteria as an assessment framework and use them to visualize your current state and plan improvements against those criteria. The SCS Evaluation Scheme is a voluntary program; participation and applying for evaluation are decisions you make yourself. CISOaaS supports preparation against the criteria and does not guarantee that a ★ rating will be granted.

Every plan is governed by an individual contract with us, entered into after you get in touch; it sets the contract term, minimum period, and cancellation conditions. Please contact us for details.