A compliance verdict you can defend.

Grow your capability without growing your overhead.

Take on more clients and more frameworks without adding headcount. One engine runs every engagement, from the evidence to the report, the executive brief and the board pack.

GRC consultants & practices

Explore →

Leading cyber security and compliance, without the big price tag.

The same evidence-led assessment large institutions use, priced for organisations without a compliance team.

Small & medium business · Schools & education · Early childhood education & care · Mortgage & credit brokers

Explore →

Defensible accuracy, with less consultant overhead.

Build evidence-backed compliance in-house. Nothing is marked met without proof, so your reviewers and consultants spend their hours on judgement, not on collecting paperwork.

Banks & APRA-regulated · Insurers & APRA-regulated · Superannuation & RSE licensees · APRA CPS 230 & CPS 234 · Government & Defence · Critical infrastructure — SOCI · Rail & OT · Healthcare · AI vendors & providers — GAiaaS · Third-party & supplier risk

Explore →

1. The authority's words, or ours, labelled

Controls use the authority's published text where its licence allows, attributed. Elsewhere they are CyberSentien's own plain-language wording, aligned to the standard and labelled as ours.

2. Records, not promises

A policy that says a control exists is not evidence it operates. Logs, exports, registers and reviews are.

3. Tested on held-out sets

Each framework is tested against pairs of evidence and controls that an assessor ruled on in advance and that were never used to train or tune the engine. The results are measured, never adjusted.

4. A credit only after zero errors

AI-assisted credits switch on for a framework only after a test with zero wrong credits. Until then that framework shows assessor review. The results are on the Correctness Board, dated.

1. Try it

Free. Open any console on sample documents now, or bring your own evidence in a personal demo workspace.

2. Pilot

One full assessment on your evidence, credited in full against a subscription taken within 90 days.

3. Subscribe

Published prices for every product. Your organisation then works in its own workspace, separate from the demo.

What is CyberSentien?

CyberSentien is an Australian-owned cyber security and compliance platform. It assesses an organisation once against its real evidence and reports across many frameworks — Essential Eight, the ISM, APRA CPS 230 and CPS 234, privacy, AI governance, rail and OT, and credit broking — and maps the same evidence to ISO 27001, SOC 2 and ISO 42001 readiness. It serves consultants and practices; small businesses, schools, early childhood services and brokers; and banks, APRA-regulated entities, government and rail operators. Every result cites the evidence behind it.

Is CyberSentien the same as CyberSentience or CyberSentriq?

No. CyberSentien (CyberSentien Pty Ltd, ACN 688 655 334, New South Wales) is a separate Australian compliance-assurance software company. It is not affiliated with CyberSentience, a New Zealand threat-intelligence firm, or with CyberSentriq. The correct spelling is “CyberSentien” and the website is cybersentien.com.

What compliance frameworks does CyberSentien assess?

Essential Eight (with ML1–ML3 maturity), the ISM at IRAP-aligned depth, and APRA CPS 230 and CPS 234, the Privacy Act, SOCI, IEC 62443 and CLC/TS 50701 for rail and OT, the NCCP Act for mortgage and credit brokers, and AI-governance frameworks including the NSW AI Assessment Framework, QLD FAIRA, NIST AI RMF and the EU AI Act. For ISO/IEC 27001, SOC 2 and ISO 42001 it maps your evidence to a readiness/crosswalk view — not an independent certification: CyberSentien gets you audit-ready, and an accredited certifier issues the certificate.

Where is CyberSentien data hosted?

In Australia. A licensed deployment generates its answers on its own infrastructure — hosted in Australia, inside the deployment boundary, with no third-party AI service in the loop. The platform records where each answer was processed and states it on request (the location that actually served it, not the one we would like to claim). Licensed engagements run exclusively on Australian-hosted compute. Evidence stays inside the boundary. Retention follows the engagement policy; tenant owners can obtain an integrity-manifested export before deletion, and legal holds fail closed — the reason sovereignty is the platform's first design principle.

How much does CyberSentien cost?

Three platform tiers, plus per-school and per-service sector lanes. Billed annually or monthly in AUD (annual is the cheaper way to buy): Core from $11,343, Professional from $23,872 and Enterprise from $64,467. All subscriptions are prepaid — cancel any time and you keep access to the end of the period you have paid for. Pricing scales with framework breadth and deployment model, and every product's prices are published on the pricing page. The demo is free and needs no documents of your own.

How correct is it?

Each framework is tested on a sealed set of evidence-and-control pairs held out of all training, and AI credits switch on for a framework only after a sealed run with zero wrong credits. Until then the framework shows candidate evidence for assessor review. The measured results, with the run behind each one, are on the Correctness Board.

How is CyberSentien different from other GRC tools?

It never shows a false green. Controls without evidence read “manual assessment required” rather than a fabricated pass, coverage is measured against full catalogues, and every report carries an integrity code that an auditor or regulator can verify independently, without an account.