The problem is not compliance. It is poorly informed decisions.
R$ 50M
Maximum LGPD fineor 2% of revenue, per violation
60%+
Incidents via third partiessuppliers are the main vector today
6-8
Separate toolsGRC, scanner, pentest, TPRM, ITSM
170+
Days to detect a breachaverage time in Brazil
Result
Risk managed in silos: assessments in one tool, vulnerabilities in another, suppliers by email and spreadsheet. Nobody sees the full picture, and the board decides in the dark.
Brazilian regulation
Speaks the language of the Central Bank.
Structure controls, evidence and action plans against each regulatory requirement, with the framework builder and cross-mapping between standards.
CMN Res. 4,893/2021
Cybersecurity policy
Policy, incident response plan and cloud contracting, with the stricter requirements of CMN Res. 5,274/2025.
BCB Res. 538/2025
Central Bank authorized institutions
Cybersecurity and cloud service requirements for institutions authorized by the Central Bank of Brazil.
CMN Res. 4,557/2017
Integrated risk management
Cyber risk inside the risk management framework, with appetite, limits and board reporting.
LGPD · Law 13,709
Privacy and incidents
Privacy controls, ISO 27701 and incident notification to the ANPD in the same workflow.
Implementing ISO 27001 control A.5.15 already produces evidence for NIST CSF, LGPD and ISO 27701. Compliance work is done once and reused across every standard.
Platform
17 modules. Six pillars. One single core.
Rotate the core and open each pillar. GRC, security operations and third-party risk in the same product, covering the whole cycle.
Pillar 3 of 6
Treat
Risk Management
Action Plans
FAIR
drag to rotate · click a pillar
Instruments
The product, working. Not slides.
FAIR · Monte Carlo
Risk in currency, not on a 1-to-5 scale.
10,000 simulated scenarios become a loss curve: how much the company could lose and how likely it is.
-median loss / year
-P90 · 1 year in 10
-P99 · tail
illustrative simulation, generated in your browser
TPRM
Every supplier has its own address.
https://transportadora-alfa.avaliacao.cyberisk...
sentansweredevidencereassessment
Full isolation for the assessed party, low friction to respond, action plans in their own space. The same workflow assesses a target company in M&A due diligence.
Physical isolation
One database per client.
client A
client B
you
client C
No shared database. Your environment shares no table with anyone.
Cross-framework
One control, three frameworks covered.
PR.AA-01NIST CSF
Art. 46LGPD
7.2.4ISO 27701
Copilot CRISK
Seven use cases. No loose chatbot.
Write the access control policy for ISO 27001.
CRISK · 60 sPolicy created with 9 sections: scope, roles, provisioning, periodic review, least privilege... mapped to A.5.15, A.5.18 and A.8.2. Ready for review.
Every request crosses the layers before reaching your isolated database. Auditors get read-only access with an expiry date; the audit trail is immutable.
Yearly billing saves 2 months (-16.7%). ISO and LGPD catalog included. TPRM and CRISK AI credit from Professional up. On Professional, FAIR, API Access, Pentest Playbook, Change Management and Incident Management are add-ons. Contracted capacity, no "unlimited"; add-ons and consulting billed separately.
How we start
From first contact to a live environment.
Typical cycle of 30 to 90 days, depending on company size.
01
Qualification
30 min
We learn your context, regulator and priorities.
02
Demo
60-90 min
Focused on critical modules, with a case from your industry.
03
Proof of value
14-21 days
Trial environment with your data, under NDA.
04
Proposal
7 days
Return calculated against your current scenario.
05
Contract and onboarding
37 days
Provisioning of your isolated database and technical onboarding.
Frequently asked questions
What CISOs ask first.
Is my data separated from other clients?
Yes. Every client has its own physical database. There is no shared database separated only by access rules.
Does the platform cover BACEN and CMN resolutions?
You structure the requirements of CMN Res. 4,893 (with the 5,274/2025 updates), BCB Res. 538/2025 and CMN Res. 4,557 as frameworks, with controls, evidence and action plans, and reuse the cross-mapping with ISO 27001, NIST CSF and LGPD.
Does it work for M&A due diligence?
Yes. The target company answers the assessment through its own isolated address, as in TPRM, and the risk found is quantified in currency with FAIR, ready for the negotiation.
How long does it take to start?
The proof of value runs in 14 to 21 days with your data, under NDA. From contract to live environment, about 37 days.
Which frameworks come built in?
Nine: NIST CSF 2.0, ISO 27001:2022, ISO 27701:2019 and :2025, ISO 22301:2019, ISO 42001:2023, LGPD and the Supplier Baseline and Cloud Provider catalogs. With the builder, you create your own.
How does billing work?
Four plans in reais, with contracted capacity. Yearly billing saves two months. Add-ons and consulting are billed separately.
Next step
See your risk as it really is.
A 60 to 90 minute demo with a case from your industry. Then a proof of value with your data, under NDA, in 14 to 21 days.