02
Compliance Automation
Map 42 frameworks, controls, policies, assessments and evidence into one continuous compliance layer.
General availability is planned for 2027 | 42 frameworks · continuous attestation
AI‑Driven Compliance Automation, Risk Intelligence & Security Operations.
Valystrum helps security, compliance and leadership teams move from quarterly evidence collection to continuous assurance. Connect your cloud, assets, controls, risks, vendors, findings and frameworks. Then see what is compliant, exposed, overdue and audit-ready in one place.
Continuous coverage across the frameworks that matter
NIST CSF 2.0
ISO/IEC 27001
ISO/IEC 27701
CIS Controls v8
SOC 2 (Type II)
PCI DSS 4.0
HIPAA
NIS2
FedRAMP
MITRE ATT&CK
ACSC Essential Eight
APRA CPS 234
CJIS Security Policy
CMMC Level 1
CMMC Level 2
CMMC Level 3
CRI Profile
Cyberbeveiligingswet (CBW)
DREAD Threat Model
EU AI Act
EU DORA (Digital Operational Resilience Act)
EU GDPR
FBI CJIS Security Policy
HITRUST CSF
ISO14001
ISO22301
ISO27799
ISO30415
ISO35001
ISO45001
ISO50001
ISO55001
ISO9001
ISO/IEC 27017
ISO/IEC 27018
ISO/IEC 42001
NEN 7510
NEN 7512
NEN 7513
EU NIS2-QM10
EU NIS2-QM20
EU NIS2-QM30
The Platform
Eight capabilities. One command surface.
Valystrum unifies risk, compliance, governance, and operational telemetry into a single decision-grade view, instrumented for the people accountable for it.
01
Risk Management
Prioritize risks using likelihood, impact, asset context, findings, remediation state and business exposure.
03
External Attack Surface Management
Discover external assets, exposed services, takeover risks, technology fingerprints and externally visible CVEs.
04
Continuous Monitoring
Replace static evidence snapshots with collectors, live findings, stale-evidence detection and manual attestations.
05
Threat Intelligence and Vulnerabilities
ATT&CK-aligned signal, fused with asset criticality and live exploit telemetry.
06
Control Library
Manage control ownership, implementation status, evidence coverage and framework readiness from a single register.
07
Cloud Posture
Monitor AWS, Azure, GCP, GitHub, Microsoft 365, Cloudflare and Vercel posture with evidence-ready findings.
08
Trust Center
Share governed proof with auditors, customers and partners without rebuilding the same evidence pack repeatedly.
The command surface
Signal density, without the noise.
Live posture across cloud, identity, and data — every panel attestable, every metric traceable to the policy that produced it.
app.valystrum.com / posturev 2030.04
Posture trend · 90 days
Open risks
12
3 critical
Controls passing
2,481 / 2,520
98.4%
Frameworks
11
continuous coverage
Cloud accounts
146
across 4 providers
Models governed
38
14 in production
Time to evidence
< 4h
full audit pack
Outcomes
Built for the metrics the board actually asks about.
Numbers from production deployments across regulated industries. The platform earns its place by lowering audit friction and shortening the gap between signal and action.
Faster audit cycles
0%
Continuous evidence vs. quarterly drills
Time to full evidence pack
<0h
Across every framework, continuously
Frameworks mapped
0+
NIST, ISO, CIS, SOC 2, PCI, DORA…
Mean reduction in MTTR
0x
From signal to remediation
Frameworks
Every framework. Continuously mapped. Always live.
One control, one piece of evidence — surfaced against every framework that asks for it. No re-mapping. No duplicate work. No quarterly reset.
100% mapped
ACSC Essential Eight
APAC · General
Australia's baseline mitigation strategies.
90% mapped
APRA CPS 234
APAC · Financial
Australian Prudential Regulation — Information Security.
86% mapped
CJIS Security Policy
US · Government
Criminal Justice Information Services.
90% mapped
CMMC 2.0
US · Defense
Cybersecurity Maturity Model Certification.
93% mapped
CRI Profile
Global · Financial
Cyber Risk Institute — financial-services aligned.
0% mapped
EU AI Act
Global · General
EU AI Act is a practical framework for organizations that need to govern AI systems with structure, evidence, and repeatability. Valystrum translates the framework into assessment controls, evidence workflows, gap analysis, remediation tracking, and continuous monitoring that scales with your organization.
95% mapped
EU DORA
EU · Financial
Digital Operational Resilience Act.
95% mapped
EU NIS2
EU · General
Network and Information Security Directive 2.
88% mapped
FedRAMP
US · Government
Federal Risk and Authorization Management Program.
0% mapped
General Data Protection Regulation (GDPR)
Global · General
100% mapped
HIPAA Security Rule
US · Healthcare
Administrative, Physical, and Technical safeguards.
92% mapped
HITRUST CSF
US · Healthcare
Healthcare's most rigorous framework, continuously.
How it works
Three motions. One outcome.
01
Connect
Read-only telemetry from cloud, identity, code, data, models, and SaaS in minutes, not quarters.
02
Codify
Policy, risk thresholds, and framework mappings as code, versioned, attestable.
03
Continuous
Live posture, evidence, and risk observable to engineering, legible to the board.
Insights
Field notes from the operators of consequential systems.
12 Apr 2026
The end of the quarterly audit
Why the cycle of point-in-time evidence collection is finally giving way to continuous attestation — and what that changes for the GRC function.
28 Mar 2026
Operational telemetry is the new control plane
Controls written in spreadsheets describe the org you wish you had. Telemetry describes the one you actually run.
4 Mar 2026
Policy as code, for the rest of the business
Engineering teams have lived in code-as-truth for a decade. It's time the rest of the governance stack joined them.
Talk to us
The signal you act on.
The evidence you ship.
Whether you're consolidating a fragmented GRC stack or standing one up for the first time — we'll show you what the next decade of governance looks like in your estate. Bring an inbound from a verified work address.