Know which cybersecurity controls are operating—and prove it.
An AI-Assisted, human-reviewed assurance record, mapped to your frameworks.
AUTOFYEDGE improves evidence readiness — it does not guarantee certification, compliance, or audit outcomes.
Your controls exist. Proving they work doesn't.
Control evidence spread across ticketing, endpoint, identity, cloud and document systems
Policy statements that don't match technical implementation
Point-in-time assessments going stale within months
Exceptions and compensating controls that aren't tracked
Remediation items with no owner, no date, no proof of closure
Leadership lacking a defensible view of cyber maturity
Incident and ransomware-reporting readiness left undocumented
Penetration-test findings that never became sustained control improvements
Connect. Verify. Remediate. Prove.
Connect
Connect or ingest approved evidence from existing systems and repositories.
Verify
Validate whether controls are operating within the agreed assessment scope.
Remediate
Prioritise findings, assign owners, implement fixes and collect closure evidence.
Prove
Produce a traceable, human-reviewed control-evidence pack and assurance dashboard.
A fixed-scope sprint, then ongoing assurance
A four-to-six-week engagement, adjusted to scope - AI-assisted, human-reviewed. Not a once-a-year pen test and a PDF, but a standing program of continuous control monitoring, with authorised, time-bounded penetration testing scheduled into the cycle - keeping evidence current between audits.
Continuous control monitoring
AI-assisted monitoring flags exploitable gaps every day, not once a year - with authorised, time-bounded penetration testing scheduled into the program, not run continuously without your sign-off.
Essential Eight maturity uplift
Structured uplift from your current level to Level Two, with evidence captured automatically as you go.
Incident-reporting readiness and human-approved drafting
Workflows built to meet the Cyber Security Act 2024's mandatory reporting clock without a manual scramble.
Network & critical infrastructure risk mapping
Visual mapping of your network architecture against SOCI Act obligations, for organisations in scope.
Live posture dashboards
Live dashboards tracking patch status, access control, and vulnerability posture - not a point-in-time report.
Security awareness & AI governance
Human-layer controls and AI governance documentation aligned to ISO/IEC 27001.
How AI meets the Essential Eight - and the rest of your stack
The same four-stage EDGE method, applied specifically to where AI does the work: finding gaps, testing controls, and keeping evidence current.
Evidence Mapping
AI scans your environment - patch logs, access records, prior incidents - and automatically scores you against each Essential Eight mitigation strategy, pinpointing your real maturity level in hours, not weeks.
Design for Compliance
We design continuous control-monitoring workflows and an authorised penetration-testing schedule around the specific gaps AI identifies, targeting Level Two maturity and Cyber Security Act 2024 reporting obligations from day one.
Governed Automation
Every AI-assisted test and automated control ships with human-review checkpoints and an explainability log, so findings are defensible and auditable - not a black-box scan.
Execution & Assurance
Continuous AI-assisted monitoring tracks your posture day to day, with authorised penetration testing on a scheduled cadence, keeping your Essential Eight evidence and SOCI/ransomware-reporting readiness current as threats evolve.
Where AI plugs into your security stack
Five stages, one continuous loop - data in, evidence out.
Network & Endpoint Data
Patch logs, access records, traffic & device telemetry
AI Detection Engine
Scores maturity, flags anomalies against Essential Eight
Automated Pen Testing
Continuous validation of exploitable gaps, human-reviewed
Evidence & Reporting
Evidence-ready packs mapped to Essential Eight & the Cyber Security Act
Continuous Monitoring
Loops back into detection as your environment changes
Six frameworks, one evidence trail
This program is built around Essential Eight, but the same AI-mapped evidence extends to whichever of these five other frameworks actually apply to you - no separate engagement, no re-mapping from scratch.
Essential Eight
Patching, application control, backups, and access management, benchmarked to Maturity Level Two.
ISM
The Information Security Manual - the control catalogue behind Essential Eight and most government security baselines.
PSPF
The Protective Security Policy Framework - core security obligations for Australian Government entities and their suppliers.
CPS 234
Information security capability requirements for banks, insurers, and superannuation funds.
Privacy Act
Australian Privacy Principles and automated-decision-making transparency, ahead of the December 2026 mandate.
SOCI Act
Risk management program obligations for organisations in scope as critical infrastructure.
The active-testing suite, authorisation-gated
Nothing here runs without a signed Rules of Engagement and an explicit go-ahead. Once authorised, testing spans 15 domains, aligned to OWASP, MITRE ATT&CK/ATLAS, CIS, and MASVS - non-destructive by default.
External attack surface
Recon and internet-facing exposure mapping.
Web application
OWASP-aligned, Burp Suite & SQLmap.
API
REST & GraphQL, auth and rate-limit testing.
Network & Active Directory
Kerberoasting, lateral movement, BloodHound.
Vulnerability management
CVE/EPSS-prioritised scanning.
Cloud
AWS, Azure, GCP - ScoutSuite.
Container & Kubernetes
Image scanning and cluster hardening.
Wireless
Wi-Fi and RF security testing.
Mobile
iOS & Android, aligned to OWASP MASVS.
Secure code review
SAST and dependency auditing.
AI / LLM security
Prompt injection and model risk, aligned to MITRE ATLAS.
OT / ICS
Industrial control systems, safety-first by design.
Physical security
Facility and access-control testing.
Phishing & social engineering
Controlled simulations run via Gophish.
Red team
Full adversary emulation, mapped to MITRE ATT&CK.
Every domain is authorisation-gated and non-destructive by default - no domain runs without a signed Rules of Engagement, in-scope targets, and an agreed testing window. See how this fits the EDGE Framework →
AI-assisted. Human-reviewed. Always.
AI does not make your security or compliance decisions. It does the repetitive work so a qualified person can focus on judgement calls and authorised testing.
What AI does
- Classifies and compares control evidence against applicable frameworks
- Summarises scan results and identifies possible gaps
- Drafts remediation actions and monitors due dates
- Assists with reporting and evidence-pack assembly
What qualified people do
- Confirm scope and authorise every technical test
- Review evidence and validate material findings
- Approve recommendations and retain accountability
- Make every security judgement - AI never does
AUTOFYEDGE does not certify Essential Eight maturity, replace qualified security professionals, or guarantee an audit outcome. Technical testing runs only within an authorised, agreed scope.
A limited number of founding cyber engagements
We're taking on a limited number of organisations at a reduced rate in exchange for structured feedback and, with your permission, an honest reference once the sprint is complete. No fabricated case studies, no implied endorsement - just a genuinely earlier-stage rate while we build out the track record.