Working with CyberWave
No programme. Four relationships that already happen.
CyberWave does not run a partner programme — no tiers, no badges, no portal, no published commission — and this page is not going to imply one. What is real is the work already shared with the advisers our customers have: brokers preparing a renewal, auditors running an engagement, MSPs operating half the controls, and consultants who are the security function. Here is what each looks like inside a workspace, and what is not on offer.
Self-service signup opens shortly — we will set you up in the meantime
| Control | Owner | Status | Evidence | Last tested |
|---|---|---|---|---|
| A.5.1Policies for information security | Priya Raman | Passed | Accepted | 28 Jul 2026 |
| A.5.18Access rights | Priya Raman | Passed | Accepted | 26 Jun 2026 |
| A.8.5Secure authentication | Priya Raman | Passed | Accepted | 14 Aug 2026 |
| A.8.13Information backup | Jordan Blake | Passed | Accepted | 18 Jun 2026 |
| A.8.2Privileged access rights | Priya Raman | Failed | Needs Review | 20 Aug 2026 |
| A.8.7Protection against malware | Jordan Blake | Tested | Accepted | 28 Aug 2026 |
| CC9.2Vendor and business partner risk management | Elena Kowalski | Failed | Accepted | 12 Aug 2026 |
| PR.AA-01Identities and credentials are managed | Unassigned | Not Tested | Missing | — |
- A.5.1Policies for information security
- Owner
- Priya Raman
- Status
- Passed
- Evidence
- Accepted
- Last tested
- 28 Jul 2026
- A.5.18Access rights
- Owner
- Priya Raman
- Status
- Passed
- Evidence
- Accepted
- Last tested
- 26 Jun 2026
- A.8.5Secure authentication
- Owner
- Priya Raman
- Status
- Passed
- Evidence
- Accepted
- Last tested
- 14 Aug 2026
- + 5 more in the workspace
What an auditor or a broker is looking at: requests, owners, evidence and dates in the same place the client maintains them.
Four relationships
What working together actually looks like.
Nobody in this list needs CyberWave to explain their own job to them. What each one needs is for the client’s evidence to exist, be current, and be somewhere both parties can see it — which is the part that keeps failing.
Brokers and insurance advisers
The renewal stops being a fire drill
The renewal date has been in the diary for a year, and the questionnaire still gets answered from memory in the last week. You spend your time chasing attachments that somebody has to find, and answers nobody can evidence.
What CyberWave brings
- A cyber-insurance readiness workspace holding the questions underwriters ask, with the evidence behind each answer.
- Gaps listed with owners and dates before the submission goes in, rather than discovered by an underwriter afterwards.
- Broker and underwriter evidence packages in Full Platform, assembled from the workspace instead of from a phone call.
CyberWave is not an insurer and not a broker. Placing the business, interpreting coverage and advising on limits stay with you.
Auditors and assessors
Evidence requests stop arriving as a zip file
You send a request list. Back comes a folder called final_v3 in which nothing has a date, two documents contradict each other, and the person who wrote the third has left. Half the engagement is spent establishing what is even current.
What CyberWave brings
- An audit engagement workspace in Full Platform that holds requests, control testing and the evidence trail in one place.
- Controls with a named owner, a status and a plain description of how they work in that organisation.
- Evidence with a status and an expiry date, and an assessment history that makes this year comparable with last.
CyberWave does not certify anything and does not issue audit opinions. The opinion is yours, and Sentinel does not put a thumb on it.
MSPs and MSSPs
You get credit for the controls you already operate
You run patching, backups, endpoint and identity for the client. Then you are asked to prove all of it again — per client, per questionnaire, in whatever format arrived that week — from tickets and consoles that were never built to be evidence.
What CyberWave brings
- A control register that can name you as the owner of the controls you genuinely operate, rather than leaving them unowned.
- Evidence attached once and reused across frameworks, questionnaires and the insurance renewal.
- A visible line between what you operate and what the client is responsible for, which is usually the argument nobody has written down.
Sentinel records that a control is in place; it does not operate it. CyberWave does not monitor environments and does not respond to incidents — that work stays with you.
Consultants and fractional security leaders
Your work outlives the engagement
You are the security function two days a month, and your main deliverable is a document that starts decaying the moment you leave the room. Next quarter opens with an hour of reconstructing what was true last quarter.
What CyberWave brings
- A register, a risk log, an action backlog and reporting that persist between your visits and are maintained by the people who own the controls.
- Executive and board reporting generated from those records, so the quarterly pack is edited rather than rebuilt.
- AI assistance for drafting policies, questionnaire answers and assessment write-ups, scoped to that client’s own workspace and reviewable before you rely on it.
CyberWave also sells advisory of its own — Managed vCISO Lite and Managed vCISO. Where you are already the adviser, we are not looking to replace you, and the software does not require our advisory attached to it.
An adviser is judged on whether the client’s evidence holds up. That is a shared interest already — it does not need a programme wrapped around it to become one.
Why this page has no tier diagram
In practice
How a first engagement together tends to go.
Six steps in order, because the questions genuinely depend on each other: who holds the subscription decides how seats work, and there is no useful conversation about doing this repeatedly until it has worked once.
- 01
Bring one client, not a pipeline
Tell us about a single engagement with a date attached: a renewal in eleven weeks, an audit with an evidence request list, a customer security review holding up a contract. That is a far more useful conversation than a strategy call about volume neither of us can forecast.
- 02
Settle who holds the subscription
Usually the client subscribes directly and you work inside their workspace. If you would rather hold it on their behalf, that is a conversation rather than a checkbox. Either way the client’s organisation is the tenant and the data in it is theirs.
- 03
Take a seat, and an owner’s name
An external adviser holds a user seat like anyone else, and can be named as the owner of the controls they actually operate. Nothing about ownership is watered down for outsiders — that is the point of naming people rather than teams.
- 04
Do the work where it will still be in a year
Findings land as tracked actions with owners and dates instead of as a report appendix. Evidence you collect is attached to the controls it supports, with a status and an expiry, so next year’s engagement starts from what you did this year.
- 05
Hand it back cleanly
When the engagement ends, the client removes your seat. The register, the evidence, the risk decisions and the history stay with them. Nothing about this arrangement is designed to make leaving awkward for you or for them.
- 06
Then decide whether it is worth repeating
If it worked once, we can talk about what doing it regularly should look like — and if that eventually needs terms written down, they will be written down rather than implied.
Everything needed to run one framework, one evidence library and one insurance renewal is in Essentials. The audit engagement workspace, board reporting and the broker and underwriter packages sit in Full Platform, which is where most advisory work ends up. See what is in which plan
Straight answers
What CyberWave does not offer advisers.
A partner page that lists only upside is a page you have to read twice. Here is the list a competitor would hope we left out, and each item is a straight “no” rather than a hint.
A programme with tiers or badges
No gold, silver or certified levels, no logo to put in your email signature, and no accreditation to sit an exam for. There is nothing to join, so there is nothing to be admitted to.
A published referral commission
CyberWave does not publish a referral fee or a reseller margin, and inventing one on a call would be worse than not having one. If you send somebody to us, tell us what you would want in return and you will get an honest answer, including “not today”.
A partner portal or deal registration
No portal, no lead registration, no protected territories. Prices are published on this website and a client can read them without going through anyone.
A white-label or co-branded product
Sentinel is Sentinel inside a client workspace. There is no version that carries your name instead of ours, and no co-branded reporting.
If any of that changes it will appear on this page with terms attached, rather than as an announcement with nothing behind it. What is on offer right now is the workspace itself, prices anybody can read without a call, and a conversation with someone who can give you a real answer.
Due diligence
Where a client’s data sits, and what CyberWave will not do.
Two things an adviser is asked by their own client before they recommend anything. Both belong on the page rather than in a follow-up email.
Technology CyberWave uses
- Workspace data
- Stored in Supabase in Canada, region ca-central-1.
- Application compute
- Runs on Vercel in the United States.
- AI calls
- Go to Anthropic in the United States, scoped to the customer’s own tenant.
These are suppliers, and they are named here for the one reason an adviser cares about: a client will ask where their data is processed. Using a vendor is not a partnership, and CyberWave does not present these companies as partners of ours. The full list, and what each one does, is on the subprocessor page.
Questions your client’s procurement review needs in writing: support@cyberwave.ca
Questions
What advisers ask before they introduce a client.
Six questions that decide whether this is worth a conversation, answered without the words a partner page normally uses.
Do you pay referral fees?
There is no published referral commission and no reseller margin. If you introduce someone, tell us — at minimum so they reach a person who can answer rather than a general inbox — and tell us what you would want in return. The answer may be that we are not in a position to do that today, and you will get that answer rather than an encouraging silence.
Can we resell Sentinel, or bill our client for it?
There is no reseller agreement today. The usual arrangement is that the client subscribes directly at the published price and you work in their workspace on a seat. If holding the subscription on a client’s behalf is important to how you bill, raise it and we will tell you plainly whether we can accommodate it.
Does CyberWave compete with us?
In one place, yes, and it is better that you hear it here. CyberWave sells Managed vCISO Lite and Managed vCISO, which is advisory work some consultants also do. What that means in practice: the software stands on its own, we are not looking to displace an adviser a client already trusts, and if you would rather our advisory never came up with your clients, say so at the start. That is a reasonable thing to ask and a bad thing to discover late.
Does an adviser seat cost the client extra?
Essentials includes 2 users and Full Platform includes 5. An external adviser occupies one of those like any other member. Beyond the included seats, an additional user is $19 a month, and there are packs if a whole team needs access. Control owners need their own login — a shared account is how ownership stops meaning anything in an audit.
What happens to the workspace if the client stops working with us?
It stays with them. The client’s organisation is the tenant, the data is theirs, and removing your seat is their action to take. The register, the evidence, the risk decisions and the audit trail of who changed what all remain. An arrangement that made your departure costly for the client would not be worth having on either side.
Can we use Sentinel for our own programme as well as our clients’?
Yes — you would be a customer, at the same published prices, with your own workspace kept separate from every client’s. Advisers who answer security questionnaires themselves tend to find this the easiest way to understand the product, because they are the person the tool is written for.
Start with one client and a real date.
A renewal in the diary, an audit with an evidence list, or a questionnaire holding up your client’s contract. Bring that, and we can both tell within a call whether working this way is worth repeating.
Self-service signup opens shortly — we will set you up in the meantime
- Published pricing — no quote-on-request tier
- No credit card required for the trial
- No automatic charge when a trial ends
- Tenant-isolated architecture, data stored in Canada
- Clear data-processing terms
- No compliance guarantee — human judgement still required