Turn invisible risk into
decisions you can act on.

Yes. Across every product plan, AI drives assessment, analysis, and report generation on its own, with results delivered without added staff effort. If you need a security consultant's sign-off or ongoing support as an external CISO, you can add it as an add-on (Expert Review = Act and above, Dedicated CISO Support = Govern and above). It also works for teams where IT handles security as a side responsibility.

Yes. Assessment results are auto-bundled into a PDF for leadership. On Assess this covers the score summary and risk list; the economic analysis chapter and the improvement roadmap chapter are available on Act and above. You can report the state of risk and the basis for investment with quantitative data.

Choose based on the features and scale you need. Assess lets you reassess anytime and delivers watermark-free PDF reports. Act adds economic analysis, initiative management, and incident response. Govern is built for group governance, with up to 15 parent-child tenants, SSO, and audit log export. Enterprise is designed individually for cross-group and regulatory needs. If you need human sign-off on the first-pass evaluation, quarterly reviews, or ongoing support from a dedicated security consultant as an external CISO, you can add these as add-ons (Expert Review / Dedicated CISO Support).

Each plan has a monthly cap on AI usage. As a rough guide, using one standard assessment at CIS Controls IG1 as the unit, the Assess plan corresponds to roughly 4-6 assessments per month, Act to roughly 15-25, and Govern and Enterprise to roughly 40-60. Usage is counted per calendar month (Japan time) and resets on the first day of each month; unused allowance does not carry over. These are estimates only: frameworks with more questions, CIS Controls IG2 / IG3 assessments, and AI features such as ROI estimation, report generation, roadmap generation, and the CISO Advisor draw from the same allowance, so actual counts vary with usage. We show an in-app notice once you reach 80% of the cap, and also notify you by email once you reach 100%. After reaching the cap, contact us about moving to a higher plan or arranging additional capacity.

We issue trials individually to customers who contact us — no card is required and nothing is charged automatically. You can try the same features as your prospective plan for a set period (14 days as of this writing). During the trial, usage is limited to 1 assessment (cumulative) and up to 3 users, with a cap on AI usage; PDF reports include an evaluation watermark. If you do not move to a paid contract when the trial ends, you have read-only access for 14 days starting the day after the end date, after which sign-in is no longer possible. If you do move to a paid contract, assessment results and reports carry over. See the Specified Commercial Transactions Act notice below for details.

By default, AI runs from the first-pass assessment to the final results without an expert check. If you want expert verification, the Expert Review add-on (Act plan and above) adds a sign-off step in which our security consultant approves the content before finalization; the score, risk analysis, and report are finalized after that approval.

Yes. Based on your approved assessment results, AI automatically extracts the questions from a received Excel checklist and drafts answers with compliance status, confidence, and evidence. A person finalizes the answers (with the Expert Review add-on). Check-sheet response support is available on the Act plan and above.

Yes. Bulk-upload policies and procedure manuals (PDF, Word, Excel, PowerPoint) into the Evidence Library, and AI matches them against assessment questions and surfaces them as per-question reference information during AI hearings. Answers and scores are never auto-filled — people answer. The Evidence Library is available on the Act plan and above at no extra cost.

It means one first-pass sign-off per assessment, before finalization — not a per-month or per-contract count. The Expert Review add-on also includes review of generated deliverables (return-on-investment estimates, initiatives, report), a quarterly review, and expert verification needed for third-party rating programs. If you run multiple assessments in the same tenant, each one gets a review before finalization.

Risk is quantified along the attack chain via our own method ACRA (MITRE ATT&CK-aligned). Expected loss is computed as a probability distribution using the international standard FAIR (Factor Analysis of Information Risk) plus Monte Carlo simulation — telling you 'the 95% prediction range for annual loss' and 'the P95/P99 benchmark (roughly 1-in-20 and 1-in-100-year events)', a more confident basis for investment than a single point estimate. For investment, the Gordon-Loeb model from information security economics gives a recommended ceiling relative to the expected annual loss — a ceiling to reason against, not a guarantee that spending up to it is sufficient. This economic analysis is available on Act and above (not on Assess).