A compliance verdict you can defend.

For GRC practices

Run Essential Eight, ISM/IRAP, CPS 230/234 and ISO 27001 engagements on one engine. A consultant-grade report, an executive brief and a board pack from one run, each with a run id and a SHA-256 integrity anchor. A multi-client book. Founder pilot: locked pricing for the first five Australian practices.

Start a free demo week → GRC practice console

For rail and OT operators

Import your OT monitoring exports and get IEC 62443-3-3 evidence per zone, a CLC/TS 50701 traceability matrix and decks for the safety board. Each check says met, not met or not measured, and why. CSV import today; no API connector yet.

See the Rail & OT page → Rail & OT →

1. The authority's words, or ours, labelled

Controls use the authority's published text where its licence allows, attributed. Elsewhere they are CyberSentien's own plain-language wording, aligned to the standard and labelled as ours.

2. Records, not promises

A policy that says a control exists is not evidence it operates. Logs, exports, registers and reviews are.

3. Tested on sealed sets

Each framework is tested against evidence-and-control pairs ruled by the owner, or by an AI assessor whose rulings the owner adopted, and held out of all training. The engine's verdicts on them are measured, never tuned.

4. A credit only after zero errors

AI-assisted credits switch on for a framework only after a sealed run with zero wrong credits. Until then that framework shows assessor review. The results are on the Correctness Board, dated, with the run that produced them.

1. Demo week

Free. Synthetic documents now, or your own evidence in a gated workspace. Rail: one real export.

2. Pilot

One full assessment on your evidence, credited in full against a subscription taken within 90 days.

3. Subscribe

Published annual tiers; Rail & OT is scoped.

What is CyberSentien?

CyberSentien is an Australian-owned compliance assurance platform that assesses an organisation once against its real evidence and reports across many frameworks — Essential Eight, ISM (IRAP-aligned depth), APRA CPS 230 and CPS 234, and AI governance — and maps that same evidence to ISO 27001, SOC 2 and ISO 42001 readiness. It produces deterministic verdicts with per-control evidence chains and tamper-evident report lineage.

Is CyberSentien the same as CyberSentience or CyberSentriq?

No. CyberSentien (CyberSentien Pty Ltd, ACN 688 655 334, New South Wales) is a separate Australian compliance-assurance software company. It is not affiliated with CyberSentience, a New Zealand threat-intelligence firm, or with CyberSentriq. The correct spelling is “CyberSentien” and the website is cybersentien.com.

What compliance frameworks does CyberSentien assess?

Essential Eight (with ML1–ML3 maturity), the ISM at IRAP-aligned depth, and APRA CPS 230 and CPS 234, plus AI-governance frameworks including the NSW AI Assessment Framework, QLD FAIRA, NIST AI RMF and the EU AI Act. For ISO/IEC 27001, SOC 2 and ISO 42001 it maps your evidence to a readiness/crosswalk view — not an independent certification: CyberSentien gets you audit-ready, and an accredited certifier issues the certificate.

Where is CyberSentien data hosted?

For licensed engagements: on Australian-sovereign infrastructure, with no third-party AI API. A licensed deployment generates its answers on its own box — Australian-hosted, inside the deployment boundary, with no third-party AI API in the loop. The engine states its own processing location on request, and you can check it: /api/ai-statement reports the lane that actually served your answer (rather than the one we would like to claim). Licensed engagements run exclusively on Australian-sovereign compute. Evidence stays inside the boundary. Retention follows the engagement policy; tenant owners can obtain an integrity-manifested export before deletion, and legal holds fail closed — the reason sovereignty is the platform's first design principle.

How much does CyberSentien cost?

Three platform tiers, plus per-school and per-service sector lanes. Billed annually or monthly in AUD (annual is the cheaper way to buy): Core from $11,343, Professional from $23,872 and Enterprise from $64,467. All subscriptions are prepaid — cancel any time and you keep access to the end of the period you have paid for. Pricing scales with framework breadth and deployment model; the gated demo is free and requires no documents of your own.

How correct is it?

Each framework is tested on a sealed set of evidence-and-control pairs held out of all training, and AI credits switch on for a framework only after a sealed run with zero wrong credits. Until then the framework shows candidate evidence for assessor review. The measured results, with the run behind each one, are on the Correctness Board.

How is CyberSentien different from other GRC tools?

It never shows a false green. Controls without evidence read “manual assessment required” rather than a fabricated pass, coverage is measured against full catalogues, and every report carries a validation run id and a SHA-256 integrity anchor an auditor or regulator can verify independently.