The integrated platform for the CISO of a regulated company: your endpoints, your exposure, your incidents, your compliance across 17 frameworks and your third parties, in a single loop. Every claim comes with its evidence and its limits.
FileSample company
Sample dataEndpoints with signed evidence and CVEs on your assets
Scope · Periodic, not real time
FAIR/ALE exposure and virtual CISO roadmap
Simulated uncertainty band (uncalibrated)
Roadmap: 12 actions, 3 high priority
Scope · Simulated band, uncalibrated
Incident classified against three frameworks at once
NIS2 early warning: 18 h left
Scope · Downloadable drafts; you file them
Trust Center attestation and board pack
Scope · Proves integrity and origin, not truth
Back to SENSE with the next evidence
Security, compliance and third parties tend to live in spreadsheets and separate tools that drift out of date between audits. NIS2, DORA and Spain's ENS expect current evidence across the whole organisation and its supply chain.
SENSE → PREDICT → ACT → ATTEST is the product's architecture and the index of this file. In the margin of every claim you'll find where to check it and how far it goes.
Source of proof
Scope: what the claim does not cover
SENSE
collect evidence
An agent for Windows, macOS and Linux runs 172 checks and sends observations digitally signed; the console rejects any that fail verification.1
Scope. The telemetry is signed, not the installer. 143 of the checks are open L1 baselines that don't feed the compliance score yet.
See evidence and scopePREDICT
quantify and simulate
FAIR/ALE exposure in euros per vendor and across the portfolio: a parametric point estimate with its simulated uncertainty band (uncalibrated), reproducible.2
Scope. It uses the model's sector parameters, not your organisation's loss data.
See evidence and scopeACT
propose under human approval
HodeiAI proposes. Running anything takes explicit approval from a user with a write role: single use, valid for 15 minutes and bound to the hash of the exact proposal.3
Scope. Today the only executable action is creating an entry in the risk register.
See evidence and scopeATTEST
prove it to third parties
Every published Trust Center issues attestations signed with ML-DSA-65 (FIPS 204), with the signature kept separate from the attested document. They attest each framework's maturity band and the weakest one: never scores, euros or vendor detail.4
Scope. It's a self-assessment signed by HodeiShield: it proves integrity, origin and time, not that what's attested is true. It doesn't replace an audit.
See evidence and scopeSENSE feeds PREDICT; PREDICT ranks what ACT proposes; ATTEST proves the outcome to third parties.
The same cycle orders the solutions. Each appears here in the phase it leads; most also take part in others.
SENSE
collect evidence
Agent with 172 signed checks.
CVEs on your assets, actively exploited (KEV) first.
Vendor SBOMs matched against CVEs.
Scans, questionnaires and dependencies.
PREDICT
quantify and simulate
Posture per framework and a rules-ordered roadmap.
17 frameworks, expiring evidence and crosswalk.
ACT
propose under human approval
Proposes; a person approves.
DORA, NIS2 and GDPR classification, deadlines and drafts.
AI systems register.
ATTEST
prove it to third parties
Signed attestation, verifiable offline.
Board dashboard and 18 report templates.
No solution is an isolated module: each hands its work to the next phase.See the full map of the eleven solutions
HodeiShield maps your evidence to the canonical controls of 17 frameworks. Coverage is expressed over those controls, never as a blanket pass, and the crosswalk reuses evidence across frameworks.
The evidence engine assigns an owner, a validity date and a status, and ranks what's missing. Audit readiness depends on your evidence, not on the tool.
ENS: HodeiShield's 74 controls based on ENS Annex II (Royal Decree 311/2022), by basic, medium and high level
Two public doors. None of them asks for an account or a form to get in.
verify-attestation.sh checks the ML-DSA-65 signature, the expiry, and that the overall band really is the weakest one attested. All it needs is bash 4, OpenSSL 3.5 and python3 (or Docker or Podman): nothing from HodeiShield.
curl -s https://app.hodeishield.com/api/public/attest/keys -o keys.json./verify-attestation.sh --attestation attestation.json --jwks keys.json --expect-slug SLUG --expect-issuer https://app.hodeishield.comhodeishield is the official CLI: read-only over the public /v1 API, version 0.3.1 (still 0.x), signed with Sigstore and shipped with SLSA provenance.
cargo install --locked --git https://github.com/Hodeitek/hodeishield-cli --tag v0.3.1 hodeishield-cliWhat security leaders ask us before they book a demo, answered with what the product does today.
No. The composite 0 to 100 score, combining external scan, questionnaire and known CVEs, is the input. The value is the full, traceable loop: signed evidence, exposure in euros, actions a person approves and attestations anyone can verify.
In the EU: application, database and storage managed by OVH in Gravelines, France. Cloudflare, a US company, acts as DNS, CDN and TLS in the request path.
You don't have to trust us: it verifies offline with an open-source verifier (Apache-2.0) and the public key. The signature is ML-DSA-65 (FIPS 204). It proves integrity, origin and time; it doesn't prove that what's attested is true, and it doesn't replace an audit.
No. Third-party risk management is one of the eleven solutions. The same loop measures the posture of your own endpoints with an agent, matches CVEs against your assets, logs and classifies incidents against DORA, NIS2 and GDPR, measures 17 frameworks and prepares the board dashboard and reports.
No. The agent reports per cycle, vendor scans are periodic based on criticality and CVE sync runs daily. Evidence that stops arriving expires and stops counting.
No. HodeiAI proposes and a person with a write role approves every execution, with a single-use approval valid for 15 minutes and bound to the proposal's hash. Today the only executable action is creating a risk register entry. Autonomous execution is blocked and the kill switch fails closed.
We are testing HodeiShield with MSSP partners and organisations before widening access. Limited places, applications until 31 December 2026, and no SLA.
In the demo we run the loop with your mix of frameworks, your endpoints and your third parties, through to the attestation.
Rather start on your own? The docs and the verifier are public.