Get in contact

Continuous compliance · AI for GRC

From alert to enforced policy.

iCISO checks every internal security alert and CTI feed against your policies, proposes the fix, and keeps your systems in line. A person stays in control.

Get in contact See how it works

The problem

Policies and systems drift apart.

Your policies say how security should work. Your systems change every day. Without a link between them, gaps stay hidden.

Systems change.

The policy does not follow.

Policies change.

The systems do not follow.

Audits take weeks.

Evidence is rebuilt by hand.

How it works

From alert to enforced policy, in five steps.

  1. 1Detect
  2. 2Analyse
  3. 3Propose
  4. 4Approve
  5. 5Enforce

01 · Detect

A security alert or threat intel comes in.

Every alert from your monitoring and every relevant threat-intel report starts a case.

HighEntra ID: sign-in used legacy authentication
Account
scanner.office@example.com
Service
Exchange Online
Protocol
SMTP AUTH
Result
Success, no MFA

02 · Analyse

Your policies are checked.

iCISO reads the evidence and your published policies, and asks one question: does any requirement already stop this?

MFA enforcementRequire MFA at every sign‑inIn the policy

MFA methodsDon't allow SMS or email codesIn the policy

Not coveredBlock sign‑ins that use legacy protocolsMissing

No rule in your policy stops this sign‑in.

03 · Propose

It proposes the policy change.

A new sentence, or a stronger version of an existing one. Nothing is published yet.

Authentication policy · proposed additionPolicy gap

MFA MUST be enforced at the point of initial authentication and MUST NOT be bypassed for any user category or access scenario.

The identity provider for cloud accounts MUST disable every legacy authentication protocol that cannot enforce multi-factor authentication for all cloud account sign-ins, denying any sign-in attempt that uses such a protocol.

Why: no requirement in the ISMS already stops this sign-in.

In sync with CISO Assistant

04 · Approve

Your CISO decides.

Accept or deny, signed with the authenticator your team already uses. Nothing changes without it.

Block legacy authenticationAuthentication policy · new line
DenyAccept
Sign the decision Approve the request in your authenticator app Approved in your authenticator
Enter 47
CIAccepted by your CISOSigned

05 · Enforce

Policy and systems, back in sync.

The policy is published. iCISO checks your systems, closes the gap, and keeps checking.

Authentication policy publishedversion 19

Systems checkedGap found

Legacy protocols disabledsetting applied

VerifiedIn force

Trust

AI proposes. Your team decides.

Human approval

Nothing is published or changed without a yes.

Fully traceable

Every change links back to the alert that caused it.

Your data stays yours

Policies and configuration stay under your control.

The plan

The system around iCISO.

Telemetry & Detection

SIEM

MDR | EDR | XDR

iCISO

Multi-agent AI system that orchestrates security & compliance operations

Threat Intelligence

CTI Feeds

GRC

Dynamic Policy Updates
  • Automated policies
  • Reduced audit costs
Real-Time Risk Alignment
  • Gaps in the ISMS
  • Prevent costly incidents
Continuous Compliance
  • Policy-as-code
  • Live remediation
  • Regulation requirements

Outcome Up-to-date ISMS, audit ready

SecOps

Security Tools
  • Adaptation & configuration of security tools
  • Playbooks & automation
  • Tooling optimization
Infrastructure
  • Infrastructure-as-code
  • Hardening of critical systems
  • Implementation of ISMS controls

Outcome Safe implementations

  • AI-Powered Multi-agent intelligence at the core
  • Adaptive & Continuous Learns, adapts and improves over time
  • Governance, Auditability & FinOps Controlled agents, traceable actions & cost monitoring
  • Authenticated Only authorized users can access the system
  • EU-Compliance Ready Supports NIS2, DORA, CRA & frameworks like CyFun, ISO 27001, …

What iCISO brings

Continuous compliance, built in.

Govern

Policies that follow your risk.

  • AI-driven continuous governance
  • Risk and control intelligence
  • Multi-cloud governance

Prove

Evidence that builds itself.

  • Automated evidence collection
  • AI-assisted audits
  • Blockchain traceability

Automate

Controls written as code.

  • Automated controls
  • Policy as Code
  • Infrastructure as Code

Monitor

Systems and costs, watched continuously.

  • Continuous monitoring
  • FinOps, keep AI costs down

The result

  • Lower compliance costs
  • Stronger risk management
  • Continuous compliance, fully auditable
  • Less time preparing for audits

Contact

Contact our team.

Questions about iCISO, or about how it would sit with your alerts and policies? Write to us. Someone on the team answers.

Get in contact

Team

About

iCISO is a spin-off of the Cybersecurity & AI business line of Capyx. It is built for organizations that need their security policy to hold in practice, not only on paper.

The team brings together offensive and defensive security, governance, risk and compliance, and European regulation such as the Cyber Resilience Act and the NIS2 Directive. Two principles guide the work: AI for Cybersecurity (#AI4CS), using AI to strengthen defenses and security operations, and Cybersecurity for AI (#CS4AI), securing AI systems so they can be adopted responsibly.

iCISO is led by Kurt Callewaert, Business Line Director Cybersecurity & AI at Capyx. Before joining Capyx he spent twenty years at Howest University of Applied Sciences, where he set up its cybersecurity program and led applied research. In 2023 he was named Belgium’s Cyber Security Educator and Researcher of the Year at the Belgian Cyber Security Awards.

The mission: help organizations manage cyber risk, adopt AI securely and build lasting digital resilience.

Partners

The company behind iCISO.

PhD research partner.

UGent and imec research lab.

Innovation partnership.

Authentication, part of itsme.

Governance for AI agents.

Open-source GRC, by Intuitem.