CyberWave

Solutions

Start from the thing that is due.

Nobody sets out to buy a governance programme. They set out to answer an insurer, satisfy a customer’s security review, or give a board an honest answer about where the organisation stands. Pick the one that is on your desk this month — the programme grows out of it.

Start your 14-day free trialSee how Sentinel works

No credit card required

Framework position

Control coverage
  • ISO/IEC 27001:202280% ready
    42 controls in the catalogue
  • SOC 2 (Trust Services Criteria)71% ready
    45 criteria in the catalogue
  • Cyber Insurance Readiness82% ready
    22 underwriter controls in the catalogue
  • NIST CSF 2.0Available
    59 subcategories in the catalogue
  • CIS Controls v8.1Available
    56 safeguards in the catalogue

All four routes end in the same workspace. That is the point: the evidence you collect for one deadline is the evidence the next one asks for. Figures are from Northstar Manufacturing Ltd., the fictional example workspace used across this site.

Which one is you

Find your week on this list.

If more than one row is true, start with the one that has a date attached. A deadline is a better organising principle than an ambition, and the work overlaps more than you would expect.

Common triggers, why each one is difficult, and the page that answers it
On your deskWhy it is hardWhere to go
The renewal is in six weeksA long underwriting questionnaire, and the answers live in four people’s heads. The date is fixed and it is not yours.Prepare for a renewal
A deal is waiting on a security reviewA prospect sent a questionnaire and asked for evidence. Whoever answers it is doing it from memory, at night.See the workflow
A customer named a frameworkISO 27001, SOC 2, NIST CSF 2.0 or CIS Controls v8.1 has become a contractual expectation rather than an ambition.Pick a framework
The board asked who owns securityThere is no internal security leader, decisions are accumulating, and “we are working on it” has stopped being an answer.See the advisory tiers
A leaver still had accessSomeone left and their accounts did not. Half the organisation holds standing administrative rights and nobody reviews them.See the review
Nobody can say where we standThere is a programme, there are spreadsheets, and there is no single honest answer to “are we ready”.See executive reporting
01

Cyber insurance readiness

The renewal is the deadline you did not choose.

Underwriters ask about multi-factor authentication, endpoint protection, backups, patching, incident response and third-party risk — and then they ask for proof. The answer that costs you is not “no”. It is partial, found in the week the form is due, with no evidence and nobody assigned.

Example position · 96 days to renewal
6
Evidenced
3
Partial
0
Not in place

Nine control questions, three partial answers, one gap — each with an owner and a date, months before the form is due. Included in every plan; a reviewed, broker-ready submission pack is $499.

Prepare for a renewal

CyberWave helps you prepare for underwriting and security questions, organise evidence, identify possible gaps and plan remediation. CyberWave is not an insurer or an insurance broker, does not bind coverage, does not interpret policy coverage as legal advice, and does not guarantee coverage, premium reduction, claim payment or insurer acceptance. You remain responsible for complete and truthful representations to your insurer or broker.

02

Governance and compliance

From requirements to accountable action.

One scope, requirements mapped to controls, controls with named owners, evidence with an expiry date, gaps as dated work — and a report you can hand to an auditor or a customer without assembling it the night before. Self-service from $99/month.

  1. 01

    Scope

    Which entities, which systems, which framework and which version of it — written down, because scope creep is what turns a six-month programme into an eighteen-month one.

  2. 02

    Requirements to controls

    The framework arrives as requirements mapped onto controls you already have, not as a fresh list to admire. A requirement with no control behind it is a finding on day one.

  3. 03

    Controls to owners

    A person’s name on every control. Not a team, not “IT”. An unowned control is reported as a gap instead of sitting in a blank cell somebody intends to fill in.

  4. 04

    Owners to evidence

    Proof attached once, with a status and an expiry date, so a lapsed item is flagged in the library instead of being discovered during fieldwork.

  5. 05

    Gaps to dated work

    Missing, expired and unowned items become assigned actions with due dates — the difference between a readiness percentage you argue about and a list somebody is working through.

  6. 06

    Register to report

    One readiness view for the executive, one package for the auditor, one answer for the customer’s questionnaire — generated from the register rather than rewritten the night before.

See the workflowBrowse the frameworks
03

Managed vCISO

Software when you can operate it. Expert guidance when you need it.

A named CyberWave advisor on a scheduled cadence: risk and roadmap review, executive reporting support, and a governance calendar that keeps moving in the months when nobody internally has time to move it. Both tiers are priced in public.

$999/mo
Managed vCISO Lite

Everything in Full Platform, a named advisor and a scheduled advisory cadence. $11,388.60 a year, billed once.

From $2,499/mo
Managed vCISO

Deeper advisory hours, governance calendar ownership support, board and stakeholder engagement — scoped in a statement of work.

0 seats
What the advisor costs you in users

On Managed vCISO Lite, the CyberWave advisor works in your workspace without consuming one of your 5 included users.

See what the cadence coversCompare plans

Advisory, and only advisory. No security operations centre, no monitoring, no emergency incident response — the exclusions are listed in full on the page rather than in a contract you read after signing.

04

IAM and PAM governance

Access is the control set everybody tests first.

It is the first thing an auditor samples, the first thing an underwriter asks about, and the set most organisations are quietly weakest on — because access is granted by whoever was available, in the system that needed it, on a day when something more urgent was happening.

An access review that changes nothing is a rehearsal.

A structured advisory engagement on the access controls an auditor tests first and an underwriter asks about first: joiner, mover and leaver, access reviews that leave evidence, the privileged account inventory, standing privilege, break-glass and service accounts.

  • Advisory, not a product — CyberWave does not sell an identity provider, a credential vault or a session recording tool
  • Findings become controls — with named owners, in your own register
  • The review becomes evidence — dated, with an expiry, linked to every control it supports
  • What is unresolved becomes work — in the same action list as assessment findings and risk treatments

See the review

Example Sentinel screen, reproduced with fictional data: Action centre. 13 open actions bucketed by horizon, 2 of them Critical Now, each with module, owner, priority, due date and status.

Four deadlines. One register underneath all of them.

An insurer, an auditor, a prospect’s security team and a board are asking about the same twenty things in four vocabularies, on four dates, in four formats. Most of the cost of this work is answering them separately.

What they share

The same twenty things, asked four ways.

Every route above runs on one control register, one evidence library, one risk register and one set of generated reports. That is not a tidiness argument — it is where the cost goes when it is not true.

Four programmes running beside each other
  • A questionnaire answered from memory, then answered again next quarter
  • An insurance spreadsheet, an audit spreadsheet, and a board deck that disagree
  • The same penetration test attached to three different emails
  • A control owned by “security”, which was one person, who left in March
  • Each report written by hand, from whatever was findable that week
  • Nobody notices evidence has expired until somebody external does
One register, four audiences
  • One control register — 26 controls in the example workspace, four frameworks mapped against them
  • One evidence library, where proof is attached once and carries a status and an expiry
  • One risk register, fed by assessments, access reviews and underwriter questions alike
  • Every control has a named owner, and the unowned ones are reported as gaps
  • Executive, board, broker and auditor outputs generated from the same register
  • Lapsed evidence is flagged in the library before an auditor or underwriter asks
See the platformSee evidence workflows

How it is bought

Software, advisory, or a scoped piece of work.

Worth being blunt about, because it decides who does the work. The platform is something your own team operates. The advisory tiers put a CyberWave person in the room on a schedule. An engagement is a piece of work with a beginning and an end. Neither replaces the others.

Full Platform
Who runs the programme
Your team
Scope
Multiple frameworks, audit workspace, board reporting
Price
$249/month · $2,689.20/year
Included users
5
Trial
14 days, no card
How it starts
Sign up and pick a framework
Essentials
Who runs the programme
Your team
Scope
One compliance framework
Price
$99/month · $1,069.20/year
Included users
2
Trial
14 days, no card
How it starts
Sign up and pick a framework
Managed vCISO Lite
Who runs the programme
Your team, with a named CyberWave advisor
Scope
Everything in Full Platform, plus scheduled advisory sessions
Price
$999/month · $11,388.60/year
Included users
5, and the advisor is not one of them
Trial
No trial — a cadence cannot be sampled in a fortnight
How it starts
A scoping conversation
Scoped engagement
Who runs the programme
CyberWave, for the duration of the engagement
Scope
One defined review — access governance, or a broker-ready insurance submission pack
Price
Submission pack $499. Advisory reviews scoped with you.
Included users
Uses your existing workspace
Trial
No trial — scoped first
How it starts
A scoping conversation

14-day free trial. No credit card required. No automatic charge. The trial covers Essentials and Full Platform. Deeper advisory work — Managed vCISO from $2,499/month — is scoped in a statement of work, because the hours vary more between organisations than anything else in this list.

Compare plansTalk about scope

Training sits beside all of this rather than inside it. If the gap you are closing is certification knowledge in your own team, the Academy is the honest answer, not a platform subscription.

See Academy programmes

Straight answers

The limits, before you ask for them.

These are the same limits we would state on a call, so there is no reason to make you book one to hear them. They apply to every page linked above.

  • No security operations centre, and no monitoring on your behalf
  • No managed detection and response, and no emergency incident response
  • No penetration testing, forensics or dark-web monitoring
  • No insurance brokerage, and no audit opinion or certificate

Questions

What buyers ask on the first call.

Answered here so the call can be about your programme instead.

Do we have to pick one solution?
No, and most organisations do not. They pick the one with a date on it. Insurance readiness and governance run on the same controls and the same evidence library, so starting with a renewal and adding a framework later costs you almost nothing in rework.
Is an advisory service required to use the platform?
No. Essentials and Full Platform are self-service plans your own team operates. The advisory tiers exist because some organisations have no internal security leadership, not because the product needs a consultant to work.
What if the framework we need is not one of the four you publish?

The four published framework pages — ISO/IEC 27001:2022, SOC 2, NIST CSF 2.0 and CIS Controls v8.1 — are the ones with a maintained readiness mapping. Other requirements, such as a customer’s own control set, a sector questionnaire or a regulator’s expectations, can be brought in as requirements and mapped to your controls. If the scope is unusual enough to change the commercial terms, that is what the Custom plan is for.

See the four framework pages

Where does our data actually live?
Customer data is stored in Supabase in Canada (ca-central-1). Application compute runs on Vercel in the United States, and AI requests are processed by Anthropic in the United States. That is the whole picture, and it is the answer we give in security reviews.
Can we start small and add the rest later?
Yes, and it is the sequence we would recommend. One framework or one renewal, evidence attached once, owners named. Adding a second framework later reuses the controls and evidence you already have rather than starting a second programme beside the first.
Who is this not for?
Organisations that need someone watching alerts overnight, or a team to run an incident at 2am. CyberWave does not provide security operations monitoring, managed detection and response, or emergency incident response. If that is the gap, fill it first — governance sits on top of operations, not instead of it.

Bring the deadline. We will work backwards from it.

Whichever route fits, the first conversation is the same: what is due, who is asking, and what evidence you already have.

Start your 14-day free trial

No credit card required

  • Published pricing on every standard plan
  • No credit card required for the trial
  • No automatic charge when a trial ends
  • Tenant-isolated architecture, data stored in Canada
  • Clear data-processing terms
  • No compliance guarantee — human judgement still required