CyberSentienOne engine.
Every vertical it honestly serves.
One engine. Load a framework catalogue and it assesses — the same spine powers every vertical, in every jurisdiction we ship packs for. The numbers below are read from the engine's own catalogue at build time — and where a vertical isn't genuinely covered yet, its page says so.
Pick your vertical
🏦 Banks & APRA-regulated
CPS 230 operational resilience and CPS 234 information security posture from live evidence — board and regulator packs, material-supplier registers, no false green. The engine is the evidence layer; it does not replace an APRA-appointed tripartite reviewer.
Tier-A breadth🏥 Insurers & APRA-regulated
General, life and private health insurers assess CPS 230 operational resilience and CPS 234 information security from one evidence base — claims, policy administration and payments as critical operations, with regulator-ready packs. Never a false green.
Tier-A breadth💰 Superannuation & RSE licensees
RSE licensees meet CPS 230 and CPS 234 from one evidence base, with the register and fourth-party transparency that heavy outsourcing — administration, custody, investment — demands: evidenced contract clauses, board packs, no false green.
IRAP-grade on Essential Eight🏢 Small & medium business
Get cyber-compliant on real evidence, not a checklist: Essential Eight maturity and an evidence pack that satisfies a customer, a tender or a cyber insurer — in the cheapest lane on the sheet. Readiness, never a fake pass.
Consultant-grade depth🏛 Government & Defence
ISM/IRAP assessment at the depth an IRAP assessor documents — the full ISM catalogue with SAR generation, Essential Eight across ML1–ML3, evidence mapped control by control. Australia's real moat.
Depth badged per lane💼 GRC consultants & practices
Every framework live on the engine, one book of work: per-engagement scoping, evidence freshness measured — not asserted — and reports carrying an Evidence Freshness Statement. IRAP-grade on ISM/E8, Tier-A breadth elsewhere.
Tier-A breadth🧠 AI vendors & providers — GAiaaS
Multi-jurisdiction AI governance from one evidence base — EU AI Act, ISO/IEC 42001, NIST AI RMF, plus every national instrument live on the catalogue, enumerated on the solutions page rather than promised. The one axis where our reach is already genuinely global.
Served via security lens🏥 Healthcare
OAIC breach duties and buyer security clauses served through ISO 27001, SOC 2, Essential Eight and third-party risk. Honest position: no dedicated health-sector catalogue on the engine today — we say that plainly rather than badge it green.
Served via existing lanes⚡ Critical infrastructure — SOCI
SOCI risk-management-program obligations served through Essential Eight maturity, ISM depth and third-party risk registers. Honest position: no dedicated SOCI catalogue yet — where an obligation is not covered, the posture says so.
Tier-A breadth🔗 Third-party & supplier risk
A standalone third-party risk register: criticality tiering, honest 0–100 exposure scoring (an unassessed supplier is never green), service concentration and fourth-party contagion, due-diligence questionnaires and a board / auditor portfolio report.
Tier-A breadth🎓 Schools & education
A curated, source-cited obligation set for Australian schools — student privacy, cyber controls, notifiable breaches, child safety and EdTech vendor risk — with every obligation stating the sector and jurisdiction it actually binds.
Tier-A breadthEarly childhood education & care
A curated, source-cited obligation set for Australian early childhood services — the Education and Care Services National Law, notification clocks, records and retention, the February 2026 device and image provisions, privacy and child safety — with every obligation stating not just who it binds but which states it is actually in force in.
Tier-A breadth⚖ APRA CPS 230 & CPS 234
A standalone CPS 230 / CPS 234 console: the entity self-assesses the curated obligation set with evidence, and — for the obligations that flow down to material providers — sees which providers already evidence them (prove-once). Never a false green.
🌎 Everywhere else
Not a bank, not an agency, not a hospital? The engine is framework-driven, not industry-templated. If your obligations map to the frameworks live on the catalogue, the same machinery serves you — and if they don't, we say so and it goes on the roadmap, not on your report.
Jurisdictions we ship AI-governance packs for today
Plus the international instruments:
Not on this list?
The engine is framework-driven, not industry-templated — if your obligations map to the frameworks live on the catalogue, the same machinery serves you. And if they don't, we say so and it goes on the roadmap, not on your report.