Prove
Proof that your security improved — not a claim that it did.
Every report comes out of work that actually happened in the platform. Nothing is typed into a report template at the end of the quarter, which is precisely why it stands up when somebody asks how you know.
- Controlled PDF exports from completed work only
- Verifiable certificates anybody can check online
- Versioned assessments, so movement is measurable
- Every export logged with user, organisation, resource and time
Northside Legal · frozen snapshot
- Essential Eight maturityLevel 1 → 2
- Recommendations approved9 of 14
- Deferred with a review date3
- Risks formally accepted2
- Training completion92%
- Simulation click rate11% → 4%
Generated from records, not retyped. The underlying evidence is one click away from every line.
Who asks
Four people who will want to see this.
They ask different questions and need different artefacts. None of them wants a login.
Your insurer
A cyber-insurance readiness view built from the questions Australian insurers ask, with the evidence behind each answer attached rather than recalled at renewal.
Your board or owner
A management report that says what was done, what is waiting, what was deferred and what risk was formally accepted — in the language the board already uses.
A major client or tender
A framework readiness report showing scope, method, results and gaps against a named standard, with the disclaimers that honestly belong on a self-assessment.
An auditor or assessor
MSP ProRead-only, time-boxed external access scoped to an engagement, with a downloadable evidence pack.
What comes out
The artefacts.
Verifiable certificates
Training completion certificates carrying a code anybody can check online, so a claim of “we trained everyone” is checkable rather than asserted.
Evidence records
A dated ledger covering training, decisions, risk acceptances, assessments and campaign acknowledgements — the trail behind every claim on a report.
Management and QBR reports
A frozen snapshot of a period: completed, approved, outstanding, deferred, declined, training completion, readiness and next actions.
Framework readiness reports
Per-framework readiness with the maturity model, scope decisions, gap list and the correct disclaimers for a self-assessment.
Progress over time
Assessments are versioned and simulations are trended, so improvement is a comparison between two dated artefacts rather than a claim.
Secure share links
Send one report to somebody without an account. Links carry an expiry and a view cap, and every view is logged.
Human-risk insight
Where the risk sits, without turning it into a scoreboard.
Training, simulation and assessment results combine into a view of where people are exposed and why. The framing throughout is that a pattern is a signal about process, education or a missing technical control — not a verdict on an employee.
- Repeated risky decisions, and which technique keeps working.
- Susceptibility to specific phishing techniques rather than a single blunt number.
- Weak understanding concentrated in particular control areas.
- Differences between roles, teams and departments.
- Training marked complete without demonstrated understanding.
- Measurable improvement after a targeted intervention.
The model is behaviour-only and its inputs are a closed list: age, gender, tenure, seniority and performance data cannot enter it, and business impact is capped so the model can never label someone risky for holding the authority their job requires.
Honest status of this feature
In developmentPer-person and per-campaign simulation reporting, training completion reporting and framework readiness reporting are live today.
The combined human-risk index described on the left — impact-weighted, tail-aware and surfacing systemic control gaps — is implemented and tested, but currently runs only on a platform-governance screen against demonstration cases. It is not yet wired to tenant data, and we are not going to describe it as though it were.
Ask us in the demo and we will show you the model and the fairness constraints running live, so you can judge it before it ships.
What we will not claim
Reports are evidence of your work, not our endorsement.
A readiness report is not a certification.
It records what you assessed, what you found and what you can evidence. It is not an accreditation and should never be presented as one.
The readiness score is an internal indicator.
It exists to prioritise work and show movement. It is not an audit, an accreditation or a compliance rating, and we say so everywhere it appears — including inside the PDF.
Demo exports are watermarked.
Demo organisations get watermarked PDFs automatically, enforced at the serving layer rather than at each call site, so a trial cannot quietly produce a document that looks official.
See the report you would hand to your insurer.
Generated from a real assessment, real training records and a real simulation — with the evidence behind every line.