Evidence-led compliance assurance.
42 frameworks verified from the active engine catalogue. IRAP-depth for Australia. AI governance worldwide.

🔒 Evidence, or it doesn’t count

A control with no evidence renders “manual assessment required”. A signal that stops reporting renders lost visibility. Evidence past its freshness window renders stale. The engine has no path from nothing to compliant — so the collapse that happens when an assessor asks for the artefact simply cannot start here.

🇦🇺 Australian depth, not a localisation layer

The full ISM at IRAP depth, current with ASD’s quarterly releases. Essential Eight assessed per strategy across ML1–ML3. APRA CPS 230, CPS 234 and CPS 220 together, because that is how you are supervised. These are the spine of the engine, not entries on a list.

🔄 42 frameworks, assessed once

SOC 1, SOC 2, SOC 3, ISO 27001, ISO 42001, PCI DSS, NIST 800-53, NIST CSF 2.0, CIS v8, FedRAMP, the EU AI Act and more — on one evidence spine. Collect an artefact once and it is credited everywhere it applies, through a crosswalk validated so a mapping can never score a control that does not exist.

🧭 Provable by people who don’t trust you

Every artefact is timestamped and SHA-256-lineaged; every issued report carries an integrity anchor a regulator, auditor or client can verify independently — no account, no call to us. Assurance you cannot check is just a claim.

🏛 Sovereign by design

An Australian company (ACN 688 655 334) on Australian-sovereign infrastructure, with the AI inside that boundary rather than a third-party API. When procurement asks who owns and controls the stack holding your posture, that is a one-sentence answer.

📜 Published prices, open engine

Our pricing is on the website so you can budget before you speak to anyone, and the demo is the real engine — not a scripted tour. Open it and try to make it show you a pass it cannot prove.

🌎 Everywhere else

Not a bank, not an agency, not a hospital? The engine is framework-driven, not industry-templated. If your obligations map to the frameworks live on the catalogue, the same machinery serves you — and if they don't, we say so and it goes on the roadmap, not on your report.

🤝 Founding partners — first 5 AU practices

Locked founder pricing, a direct line to the founder, and real roadmap input. We build the case studies together — that's the deal.

Ask about founding partnership →

🔐 Trust you can verify instead

Every report carries a validation run id and a SHA-256 integrity anchor chained into a tamper-evident ledger — auditors, regulators and your clients can verify a CyberSentien report is genuine and unmodified. No logo proves that.

🧾 No false green — anywhere

Coverage is measured against full catalogues; controls without evidence say “manual assessment required”, never a fabricated pass. The same rule governs this website: every framework, control and obligation count here was read from the engine when the site was built.

What is CyberSentien?

CyberSentien is an Australian-owned compliance assurance platform that assesses an organisation once against its real evidence and reports across many frameworks — Essential Eight, ISM (IRAP-aligned depth), APRA CPS 230 and CPS 234, and AI governance — and maps that same evidence to ISO 27001, SOC 2 and ISO 42001 readiness. It produces deterministic verdicts with per-control evidence chains and tamper-evident report lineage.

Is CyberSentien the same as CyberSentience or CyberSentriq?

No. CyberSentien (CyberSentien Pty Ltd, ACN 688 655 334, New South Wales) is a separate Australian compliance-assurance software company. It is not affiliated with CyberSentience, a New Zealand threat-intelligence firm, or with CyberSentriq. The correct spelling is “CyberSentien” and the website is cybersentien.com.

What compliance frameworks does CyberSentien assess?

Essential Eight (with ML1–ML3 maturity), the ISM at IRAP-aligned depth, and APRA CPS 230 and CPS 234, plus AI-governance frameworks including the NSW AI Assessment Framework, QLD FAIRA, NIST AI RMF and the EU AI Act. For ISO/IEC 27001, SOC 2 and ISO 42001 it maps your evidence to a readiness/crosswalk view — not an independent certification: CyberSentien gets you audit-ready, and an accredited certifier issues the certificate.

Where is CyberSentien data hosted?

For licensed engagements: on Australian-sovereign infrastructure, with no third-party AI API. The public evaluation demo is the one exception, and the engine says so itself: demo answers are generated OUTSIDE Australia on third-party GPU infrastructure (the specific country varies with provider capacity), and every one of them carries an on-screen disclosure saying so. No customer evidence is processed there — licensed engagements run exclusively on Australian-sovereign compute. Evidence stays inside the boundary. Retention follows the engagement policy; tenant owners can obtain an integrity-manifested export before deletion, and legal holds fail closed — the reason sovereignty is the platform's first design principle.

How much does CyberSentien cost?

Four platform tiers, plus per-school and per-service sector lanes. Billed annually or monthly in AUD (annual is the cheaper way to buy): Core from $6,000, Professional from $18,000, Enterprise from $48,000 and Sovereign from $85,000. All subscriptions are prepaid — cancel any time and you keep access to the end of the period you have paid for. Pricing scales with framework breadth and deployment model; the gated demo is free and requires no documents of your own.

How is CyberSentien different from other GRC tools?

It never shows a false green. Controls without evidence read “manual assessment required” rather than a fabricated pass, coverage is measured against full catalogues, and every report carries a validation run id and a SHA-256 integrity anchor an auditor or regulator can verify independently.