What to do first, using rules you can explain to the committee.

One screen with posture per framework, a remediation roadmap ordered by rules, the notification deadlines of your incidents and an optional AI advisor. It orders and tracks; your team decides.

For: CISOs and security leads with a small team, who must prioritise gaps across several frameworks and explain why one goes before another.

Request a demo Read the virtual CISO documentation

Roadmap and briefings are deterministic: AI does not write them
Obligations: incident notification deadlines only

Virtual CISOEntity A

Sample data

Posture per enabled framework

ENS71 %
NIS258 %
DORA46 %

Remediation roadmap

Ordered by rules

1
Document the exit plan for ICT providers
DORAMedium effort
In progress
2
Approve the incident management policy
NIS2Low effort
Open
3
Renew the backup evidence
ENSLow effort
Done

Obligations: incident notification deadlines

INC-0042 · NIS2, early warning · 14:30
Pending3 h 10 min
INC-0042 · GDPR, authority · tomorrow, 11:00
Met

Quarterly briefingA snapshot of posture. The only free text is written by a person.

Sample data: the organisation, the enabled frameworks and the figures are fictional. The roadmap is ordered by rules, not by AI.

From gaps to what to do first

The path from a compliance gap to an action with an owner and a status, and what each step does not do.

Measure the posture of the frameworks you enabled
It starts from your enabled frameworks: an overall and a per-framework score, computed from your gaps and your evidence. It needs at least one framework enabled.
Scope. It is coverage measured against the canonical controls, not a clean bill of health.
Order the roadmap with rules
Each open gap becomes an action, ordered by the framework's criticality, the gap's status and the estimated effort given the evidence that is missing.
Scope. These are rules, not AI recommendations. An action has no record of its own until someone acts on it.
Track the status of each action
Each action can be open, in progress, done or dismissed, and it keeps its status.
Scope. Changing the status takes a write role.
Watch the notification deadlines
The notification deadlines of your open incidents appear as obligations, with a countdown, marked pending, overdue or met.
Scope. Incident notification deadlines only; it is not a calendar of all your regulatory obligations.
Generate the quarterly briefing
It takes a snapshot of posture, top exposures and the management-body liability alert for DORA and NIS2. If you want to add context, a person writes that text.
Scope. AI does not write it. There is no PDF export of the briefing.

Who writes what

So that you can defend every figure to the committee, we keep what the product computes apart from what a person adds.

The product computes it, with rules

Overall and per-framework posture.
The order of the roadmap.
The deadline countdown and its status.
The posture snapshot in the briefing.

A person decides or writes it

The status of each action.
The free text of the briefing, if any.
What to tackle first, with the roadmap as a guide.
What goes to management, and how.

The HodeiAI advisor, apart from the briefing

The advisor is an optional panel inside the virtual CISO. It takes no part in the roadmap or the briefing.

See HodeiAI in detail

Model: Mistral AI.
Scope: It answers about your own tenant, with read-only tools: posture, coverage, gaps, evidence and supply chain.
Authority: It only reads and answers. It does not run actions or change the roadmap status.
Separation: It does not write the briefing and does not order the actions: rules do that.

What it does not do

So you know where the virtual CISO ends.

It does not replace a CISO: it orders and tracks; deciding and answering remain your team's job.
It does not track all your regulatory obligations: only the notification deadlines of your open incidents.
It does not show a countdown to the application dates of DORA or NIS2.
It does not write the briefing with AI, export it to PDF or email it on its own.
It does not generate the roadmap with AI: they are rules over your gaps.
It does not run actions: the advisor only reads and answers.

How it connects to the other solutions

The virtual CISO reads from some modules and hands work to others.

Virtual CISO documentation

Virtual CISO: straight questions

The ones asked by people who answer for security priorities.

Does AI generate the roadmap?

No. It is computed with rules from the gaps of your enabled frameworks and ordered by the framework's criticality, the gap's status and the estimated effort. You can always see why one action goes before another.

Which obligations does it track?

The notification deadlines of your open incidents, with a countdown and a pending, overdue or met status. It is not a tracker of all your regulatory obligations.

Who writes the briefing?

Nobody writes it: it is a deterministic snapshot of posture, top exposures and the liability alert for DORA and NIS2. The only free text is written by a person.

Can I export the briefing to PDF?

No. To take the numbers to management, the report center generates an executive pack in PDF.

What does the AI advisor do?

It answers questions about your tenant with read-only tools, using Mistral AI. It does not run actions or change the roadmap. It is optional and separate from the briefing.

Does it replace a CISO or a response team?

No. The virtual CISO orders your posture and roadmap with rules and keeps a record of each action's status; it does not replace a person, and decisions and communications remain your team's. ACT does not patch, isolate endpoints or revoke access, and you file the authority notification drafts yourself.

See your roadmap with your frameworks

Request a demo and we walk through posture, roadmap and deadlines with the frameworks that matter to you.

Deterministic roadmap and briefings: no AI writes them.

Request a demo Read the documentation