Sentinel

One place for the controls, the evidence and the answers they’ll ask for.

Sentinel holds the requirements you have to meet, the controls that satisfy them, the evidence behind each control, and the reporting an insurer, an auditor or a board asks for — with a readiness score computed from what you actually hold.

Start your 14-day free trial See plans and pricing

No credit card required

Sentinel Score page showing 76 out of 100, rated Good and up 8 points, with nine weighted category scores and a score history chart.

Sentinel Score ring showing 76 out of 100, rated Good, in the Expected band.

Screens captured from a Sentinel workspace on 10 September 2026. Northstar Manufacturing Ltd. is a fictional example — a 180-person manufacturer in Ontario, Canada — not a customer, and its scores are computed by the product from its records rather than typed in for the picture.

Sentinel Top Underwriter Concerns listing five control gaps, three of them critical: privileged access, patch management and backup restoration testing. — Top Underwriter Concerns — the 5 high-priority control gaps the readiness engine reports, 96 days before the renewal.

Sentinel Decisions Required panel: a critical ransomware risk to approve or accept, two expiring contracts, the Statement of Applicability and the Q3 restore test. — Decisions Required on the Executive Dashboard — the items waiting on somebody in the room.

The proof moment

From “yes” to “here’s the evidence.”

A questionnaire asks whether you test your backups. A spreadsheet lets you tick the box. Sentinel makes the answer a chain — requirement, control, evidence, gap, action, report — and every link is a screen.

01Requirement
The standard, as records you put in scope
ISO/IEC 27001:2022 arrives as 42 controls with a status against each, not a PDF you annotate.
sentinel.cyberwave.caFrameworks · ISO/IEC 27001:2022Real Sentinel screen
02Control
One control, one owner, one status
A.8.2 Privileged access rights: what it means, why it matters, who owns it, when it is due.
sentinel.cyberwave.caFrameworks · A.8.2Real Sentinel screen
03Evidence
Proof with a date it stops being true
41 of 46 items accepted and verified; the Q3 backup restore test report is still missing, and the register says so.
sentinel.cyberwave.caAudit EvidenceReal Sentinel screen
04Gap
Missing is a state, not a blank cell
The privileged access review record the underwriter will ask for is marked missing, against its control.
sentinel.cyberwave.caCyber Insurance · ReadinessReal Sentinel screen
05Action
A name and a date, bucketed by horizon
Critical Now: run the Q3 restore test by 30 September; deploy privileged access management by 15 October.
sentinel.cyberwave.caMission ControlReal Sentinel screen
06Reporting
What is due, reported with a date
The Statement of Applicability to finalise, the refreshed EDR report to upload, the Q3 restore test due 30 September.
sentinel.cyberwave.caExecutive DashboardReal Sentinel screen

The link is the product. Everything else is storage.

Follow the backup question through and the same thing happens: the requirement names the control, the control names an owner, the last restore test is attached with a date, the next one is an action due on 30 September, and the executive dashboard reports whether it ran. When the underwriter, the auditor and the board ask the same question in three different forms, the answer is one chain read from three different ends.

The Sentinel Score

A readiness score you can defend in a room.

Nine weighted categories, and the weights are published. Policies and Evidence Ready carry 18% each because they are what an auditor and an underwriter ask to see; Risk Management carries 14%. Every point is openable to the record that produced it.

The example workspace sits in the product’s own “Expected” band, not near the top — with one critical risk open, a privileged-access control failing its test and a restore test not yet run this quarter. A near-perfect score would be easier to draw and would tell you nothing.

0–49: Below Expected
50–69: Developing
70–84: Expected
85–94: Above Expected
95–100: Leading

The product’s five bands · readiness, not certification

Score composition

9 weighted categories

Policies18%87
Evidence Ready18%79
Risk Mgmt14%73
Compliance10%67
Vendor Risk10%74
Contracts9%69
Training7%81
Control Testing7%67
Audit Engagements7%70

Sentinel Category Scores listing nine weighted categories, from Policies at 87 down to Compliance and Control Testing at 67. — Category Scores on the Sentinel Score page: the weight beside every category, and a “Why?” that opens the records behind it.

Cyber insurance

Your renewal should not be the first time you find the gaps.

Underwriters ask the same control questions every year. Sentinel holds them as 22 underwriter controls with the evidence behind each answer, and reports the concerns months before the form is due.

Insurance readiness: 82%; computed from control status
Underwriter concerns: 5; critical and high gaps
Missing critical evidence: 4; required items with no file
Renewal: 96 days; 15 December 2026

Sentinel Cyber Insurance readiness page showing 82% readiness, 5 underwriter concerns, 4 missing critical evidence items and 96 days to renewal.

Sentinel insurance cards showing 82% insurance readiness and 5 underwriter concerns.

6 of the 9 scoping answers are Yes and 3 are Partial — restore testing, patch SLA, vendor due diligence. The broker package is In Progress because those 5 concerns are still open, and every one of them is somebody’s job with a date. A Partial is not a judgement call made at the desk on the day the form arrives; it is a control with a gap the register already knew about, and the evidence that would close it is named beside it. Prepare for a renewal

CyberWave helps you prepare for underwriting and security questions, organise evidence, identify possible gaps and plan remediation. CyberWave is not an insurer or an insurance broker, does not bind coverage, does not interpret policy coverage as legal advice, and does not guarantee coverage, premium reduction, claim payment or insurer acceptance. You remain responsible for complete and truthful representations to your insurer or broker.

Controls and frameworks

One register, every framework in scope.

A control exists once and answers every requirement that names it. The example workspace tracks ISO/IEC 27001:2022, SOC 2 (Trust Services Criteria), Cyber Insurance Readiness against 26 controls, with NIST CSF 2.0 and CIS Controls v8.1 in the catalogue to activate.

Sentinel Active Framework Readiness strip: Cyber Insurance and ISO 27001 rated Excellent and On Track, SOC 2 rated Good and In Progress. — Active framework readiness: ISO/IEC 27001:2022 80 · SOC 2 (Trust Services Criteria) 71 · Cyber Insurance Readiness 82 — coverage against the product’s readiness profile, never certification.

Sentinel ISO/IEC 27001:2022 framework card scoring 80 out of 100, rated Excellent. — Active framework readiness: ISO/IEC 27001:2022 80 · SOC 2 (Trust Services Criteria) 71 · Cyber Insurance Readiness 82 — coverage against the product’s readiness profile, never certification.

Activating a framework does not start a project. ISO 27001, SOC 2 and the underwriter’s control set are catalogues: put one in scope and its requirements arrive as records with a status, and the controls you already own answer every requirement that names them. The privileged-access control implemented for ISO A.8.2 is the same control the insurance questionnaire asks about, and the evidence behind it is counted once, not uploaded twice.

Status is a short list

26 controls, 85% test coverage, 18 passed, 2 deficient, 1 open finding. Each row carries its framework, its owner, its operating effectiveness and the date it was last tested — so an audit engagement reads a history rather than an assertion.

Governance and compliance

Sentinel control library table where A.8.2 Privileged access rights is Deficient and Failed while most controls pass.

Evidence

Every item carries a status and a date it stops being true.

41 of 46 evidence items in the example workspace are accepted and verified. The one that expired and the one that is missing are reported as gaps, not averaged into a comfortable percentage.

Evidence status

46 items

Accepted41
Needs Review2
Pending1
Expired1
Missing1

Attach a file once and it carries its own validity: the Q2 restore test is accepted, the 2025 penetration test expired on 20 July, and the Q3 restore test is due on 30 September. A control shows everything that evidences it; an item shows every control it supports. The hub groups the library into domains — identity and access, backup and recovery, vendor management, and the rest — each showing what it holds against what its controls expect, so the thin domain is visible before an auditor points at it. How evidence works

Risk and action

A gap nobody owns is a note. A gap with a name and a date is work.

12 risks in the example register: 7 open, 1 critical, 2 high, 5 mitigated or formally accepted. Rating is likelihood × severity on the row; treatment, owner and target date sit beside it.

Actions land in the product’s own horizons — Critical Now, Next 30 Days, Next Quarter, Quick Wins, Strategic Projects — 2 critical now, 3 inside thirty days, 0 overdue. The register and the to-do list are the same list.

Risk management

Sentinel risk heat map with the one open critical risk plotted at likelihood 4, severity 5. — Risk Register: the critical ransomware risk at likelihood 4, severity 5, and the two high risks behind it.

Executive reporting

Where are we, what changed, and what needs a decision.

The executive dashboard is the register read for a different room: the decisions waiting on somebody who does not use the product, and what falls due before the next meeting.

Sentinel Due This Month list with five dated tasks and actions, from updating the Statement of Applicability to the Q3 backup restore test.

sentinel.cyberwave.caBoard summarySentinel interface, reproduced

Northstar Manufacturing Ltd. · September 2026

Readiness moved from 68 to 76 since July. One critical risk is open, and the cyber insurance renewal is 96 days out.

Needs a decision

Critical risk — ransomware via phishing on plant-floor workstations: approve the treatment or formally accept it with conditions.
Two contracts expire inside 90 days: the shipping and EDI portal (20 October) and OT line-controller support (28 November).
Finalise the Statement of Applicability before the Stage 1 readiness review on 20 October.

The snapshot is dated and the previous ones are kept, so a board sees the trend rather than a number chosen for the meeting. The decisions column is the part that matters — a critical risk to approve or formally accept, two contracts expiring, a renewal with a date — because it is the only column a board can act on.

Executive reporting

Generated from the register, then edited. Not assembled the night before.

Why Sentinel

Three honest alternatives, and where each one stops.

Most growing businesses are choosing between a spreadsheet, a platform built for a company ten times their size, and a tool that solves exactly one framework.

Criterion	Spreadsheets	Heavy GRC	Point tools	Sentinel
Evidence connections	A folder somewhere else; nothing links a file to a control.	Full lifecycle, once an implementation team has configured it.	Scoped to the one framework the tool does.	Every item attached to its control with a status and an expiry, reused across frameworks and renewals.
Ownership	A column, filled in once.	Role-based, after a workflow project.	Usually one administrator.	A named owner on every control, risk and action; unowned reports as a gap.
Readiness	A percentage somebody calculated.	Dashboards, usually needing a specialist to read.	One framework’s progress bar.	Nine weighted categories, published weights, computed from the records and openable back to the underlying controls and evidence.
Cyber insurance	Last year’s answers, from memory.	Not the use case.	Not the use case.	22 underwriter controls, concerns and missing evidence, and a renewal workspace.
Executive reporting	Written by hand each time.	Powerful, and a project to set up.	A certificate-shaped output.	What moved and what needs a decision, generated from the register.
Implementation complexity	None, until it decays.	Months, and a consultant.	Fast, then you need another one.	Same week. One framework in scope on Essentials; published pricing from $99/month.

Sentinel

Evidence connections: Every item attached to its control with a status and an expiry, reused across frameworks and renewals.
Ownership: A named owner on every control, risk and action; unowned reports as a gap.
Readiness: Nine weighted categories, published weights, computed from the records and openable back to the underlying controls and evidence.
Cyber insurance: 22 underwriter controls, concerns and missing evidence, and a renewal workspace.
Executive reporting: What moved and what needs a decision, generated from the register.
Implementation complexity: Same week. One framework in scope on Essentials; published pricing from $99/month.

Spreadsheets

Evidence connections: A folder somewhere else; nothing links a file to a control.
Ownership: A column, filled in once.
Readiness: A percentage somebody calculated.
Cyber insurance: Last year’s answers, from memory.
Executive reporting: Written by hand each time.
Implementation complexity: None, until it decays.

AI assistance

Assistive, reviewable, scoped to your own tenant.

It drafts policy text, questionnaire answers and summaries from your company profile and register, and points at what is thin. It never changes a control status, approves evidence, submits anything, or produces the score. Requests go to Anthropic in the United States, scoped to your workspace. How the AI is scoped

Security

Your evidence, in Canada, in your own tenant.

Production data is stored in ca-central-1. Tenant isolation is enforced by database row-level security and server-side authorisation on every request. CyberWave does not run a security operations centre, does not provide managed detection and response, and does not perform penetration testing. Read the security page

Price

Start small. Build readiness as you grow.

Everything needed to run one framework, one evidence library and one insurance renewal is in the entry plan. The advisory tiers add a named CyberWave advisor on top of the same software.

$99/mo

Essentials

2 included users, one framework in scope. $1,069.20/year if you pay annually.

$249/mo

Full Platform

5 included users, multiple frameworks, the audit workspace and board reporting.

14 days

Free trial

14-day free trial. No credit card required. No automatic charge.

Start free trial Compare plans and advisory

An additional user is $19/month beyond the included seats. No credit card required

Questions

What people ask before a walkthrough.

The five that come up on nearly every call, answered here so the call can start somewhere more useful.

Are these screenshots real?

Yes. They are captures of a Sentinel workspace — Northstar Manufacturing Ltd., a fictional company we seeded with policies, evidence, risks, vendors, controls and an insurance renewal. The scores on every screen were computed by the product from those records; nobody typed a number in to make a picture look better. It is an example, not a customer.

Do we need a security programme already in place to use this?

No. The usual first move is to put one framework in scope, or to open the renewal you already have coming up, and build outwards from the controls that touches. A register with twelve owned controls in it is more useful than a spreadsheet with two hundred unowned ones.

Does Sentinel collect evidence from our systems automatically?

No. Evidence gets into the library because a person puts it there — there is no live connection pulling it in from your other systems. Be sceptical of anything in this category that implies a connector removes the judgement step: somebody still decides whether an export demonstrates the control, and somebody is accountable for that decision.

Does Sentinel replace our auditor, our broker or our lawyer?

No. It organises the work those people ask you for and gives you somewhere defensible to keep it. Certification, audit opinions, coverage decisions and legal advice stay with the parties qualified to provide them.

Who needs a login, and what does another user cost?

Essentials includes 2 users and Full Platform includes 5. Beyond that an additional user is $19/month. Control owners need their own login — shared accounts are how ownership stops meaning anything.

Don’t wait for the next questionnaire to discover the gaps.

Bring the framework, the renewal or the customer review that is already on your desk. Put that in first and the register grows around it.

Start your 14-day free trial