One governed system of record for your security program.
SimpleCISO is the GRC and program side of the Summit Cyber stack. It takes technical and organizational inputs and runs the full assessment-to-evidence lifecycle — with AI doing the repetitive work and qualified humans accountable for every material decision.
What's inside.
The load-bearing pieces are built on two decisions we made on day one: strict multi-tenant isolation and independent, per-organization identity.
▦ Organization overview
Material risks, tasks due and overdue, stale and expiring evidence, risks missing an owner, next review date, and open risk by severity — the whole posture on one screen.
◫ Provider portfolio
Managing many clients? See them ordered by attention needed, each computed in its own tenant context. No cross-client queries, ever.
◉ Assessment engine Milestone 1
Plain-language questions map to a canonical control model and produce a deterministic, explainable score — gated by a human reviewer before any status is set.
◈ Risk register Milestone 1
Gaps and imported findings become risk candidates with owners, severity, and 30/60/90 tasks. Risk acceptance is a signed, dated human decision.
▤ Evidence vault Milestone 1
Upload, review for adequacy, and track expiry. Evidence maps across frameworks, so you collect once and reuse everywhere.
◆ AI gateway Milestone 2
Provider-neutral (Claude, OpenAI, or self-hosted) behind an approval matrix. Drafts only; a human publishes. Every AI action is logged in an execution ledger.
Assess → prioritize → execute → prove.
One lifecycle, with a human gate on every step that carries liability.
Assess
Run a plain-language assessment against a framework. Deterministic scoring — no black-box number — with a reviewer gate before status is set.
Prioritize
Gaps and SimpleSec findings become risk candidates. A human owns, accepts, or defers each. Nothing auto-closes.
Execute
Owned tasks with due dates and AI-drafted remediation guidance. Follow-ups are tracked, not forgotten.
Prove
Evidence vault with adequacy review and point-in-time snapshots. Export board and audit reports on demand.
Technical findings become governed risk.
SimpleSec is the source of truth for offensive findings. When one flows into SimpleCISO it
carries a source_ref back to the
finding and creates a risk candidate —
never an auto-closed control. The link between the pentest result and the governance decision
stays intact, end to end.
Signed webhooks, idempotent
Findings sync reliably without duplicates.
Finding → candidate, never → closed
A human triages every imported risk.
Traceable provenance
Every risk points back to the evidence that raised it.
4 findings imported · 0 auto-closed · 4 awaiting human triage
Accountability, by construction.
These aren't settings you can switch off — they're how the product is built.
⛉ Human-gated decisions
Risk acceptance, evidence sufficiency, and publishing all require a named human. AI drafts; a person decides and signs.
⛬ Tenant isolation at the database
PostgreSQL row-level security enforces separation in the database, not just the API. Tenant tables fail closed when context is unset.
◷ Readiness, not certification
We say "readiness" and "evidence coverage" — never "compliant" or "certified." Terminology discipline as a liability firewall.
Assess once, satisfy many.
A canonical control model underneath every framework means evidence and assessment work is reused, not repeated.
NIST CSF 2.0 and CIS are freely redistributable and ship built in. ISO/IEC 27001:2022 and PCI DSS text is licensed (Summit holds the licenses); it's stored with license and provenance metadata, tenant access-controlled, and kept out of third-party AI prompts and exports beyond the license terms.
Want the full walkthrough?
We'll show you the lifecycle on your own frameworks and talk through where SimpleCISO fits alongside the testing you already run.