Decide before the fact.
Cyber GRC for the security team that has to run it: third-party, contract, privacy and AI risk decided before the commitment, not written up after it.
Purpose-built AI does the first pass. A person decides on the record. One register holds the outcome.
A request comes in nine AI assessments do the first pass a person decides in one queue one register keeps the outcome, with the decision attached
Not a register of what went wrong.
A record of what you decided.
Every one of these happens before anything is signed, built or switched on.
1 · The front door.
A business user asks for a vendor, a system or an AI use case. Qualification rules classify it — category, data classification, inherent risk — and open the assessments it needs, with the request’s details already filled in. This is the moment the risk conversation starts, and nothing has been signed.
2 · The AI drafts. Your rules decide what it can conclude.
An assessment with three mandatory requirements unmet. The analysis still runs, but it cannot be completed, and the engagement recommendation is moved from acceptable to not recommended — with the rule that moved it named on the tile.
3 · A decision, with its reason.
A risk closed, accepted, deferred or excepted carries who decided, when and why. The platform refuses the change without a reason, and the lifecycle shows every stage it has been through.
4 · What is still waiting on a person.
Not a wall of open items. Six queues, each with a count and the next action: residual above appetite, treatments past due, risks with no owner, risks with no plan. Zero is shown as all clear, not hidden.
You already know the alternatives.
The heavy suite covers everything, at a price and an implementation timeline one team cannot carry, and risk still lands in the register after the fact.
The compliance-automation tool is good at certification checklists and connector evidence, and thin on risk, third parties, contracts, privacy and AI systems.
The regional risk platform has a credible register and workflow, but its assessments are forms a person fills in, and AI is a bolt-on.
The point tool sees one thing: vendors, or privacy, or AI.
ControlDesk is cyber GRC for the mid-market team that has to run it: the integrated model, running in weeks, owned by one security team. Nine assessment lenses feed one register, and the decision is made up front. And unlike the AI-first newcomers, its AI cannot conclude past your rules, and what it produces is a decision on the record, not another finding.
What it is built to change
A vendor decision in days with the assessment attached to it, not chased afterwards.
A board pack out of the register you already work in with risk in money, not a separate spreadsheet.
An answer to “why was this accepted?” that lives in the ledger, not in somebody’s inbox.
Four people, one register
The requester asks for what the business needs and sees where it is, without chasing anyone.
The security team assesses it, decides it on the record, and works one register instead of five.
The vendor answers in their own portal, free, with multi-factor authentication, seeing only what was sent to them.
The board reads the decisions inventory and risk in money, out of the register the team already works in.
Platform
Lenses, nervous system, sink.
Work enters through the front door. Nine lenses assess it. A nervous system routes what needs a decision to the person who makes it. Everything lands in one register with its decision attached.
Nine lenses.
Third-party risk, agreement and contract review, privacy impact, AI impact and conformity, security maturity, solution triage, architecture review, compliance gap analysis and regulatory change. Each has its own purpose-built AI service. Business impact analysis sits outside the nine: it is done by people, not AI.
One nervous system.
Rules that recalculate scores, open reviews and route approvals; an approval inbox for anything that needs a person; handoffs by email and in-app when work reaches someone; a personal queue of what is waiting on you.
One sink.
The risk register with risk in money for the board, the control library, obligations, findings, evidence, incidents, assets, data governance, audits, policies and the decision ledger. Every lens writes here. Nothing lives in a silo.
Assessments (nine lenses)
Work enters through the front door and the qualification rules decide which assessments it needs. Each lens has its own purpose-built AI service and writes to the same register.
Start before the register.
A business user asks for a new vendor, system, solution or AI use case in a short guided form, opens an initiative, or asks the security team for advice. Qualification rules decide what that request needs, a third-party assessment, a privacy impact assessment, an AI impact assessment, an architecture review, and open them with the request’s details already filled in. The requester sees where their request is. The risk team sees what is coming.
Third-party risk assessment
Questionnaires from your templates, sent to the vendor's own portal. AI scores the responses, reads the uploaded evidence, identifies gaps and recommends remediation. Inherent and residual risk, maturity scoring and mandatory risk requirements that cannot be waived by a friendly approver. Identified risks land in the register with the vendor attached.
Agreement and contract review
Upload an agreement and AI reviews it clause by clause against your clause library, grades each risk A to F, drafts the review summary and extracts obligations and key dates. Obligations are promoted into the compliance register and tracked to their deadlines. Negotiation rounds, approvals and one-click contract creation from an approved template.
Privacy impact assessment
Multi-jurisdiction privacy assessments with data-flow mapping, cross-border transfer analysis and principle-by-principle scoring. Triggers decide when a PIA is required. Findings become owned risks and privacy obligations.
AI impact and conformity
Governance for the AI you build and the AI you buy, on the same register as everything else, not a bolt-on. An AI system registry with risk classification, and impact assessments the deployer and the vendor each complete. Conformity assessment workflows, use-case intake for business users, acceptable-use policies for generative AI and auto-generated technical documentation. Covers general-purpose model obligations and detects substantial modifications that require re-assessment.
Security maturity assessment
Framework-based maturity assessments per system or across the organisation, with AI-scored responses, gap findings and reassessment cycles. Run it against a national baseline such as Essential Eight or against a framework of your own.
Solution triage and architecture review
AI triage of a proposed solution across security, privacy, data and architecture dimensions, and architecture reviews against your principles library and playbooks. Both produce findings and a recorded decision before the solution is bought or built.
Compliance gap analysis
Controls mapped across frameworks so one control satisfies every framework it belongs to. Compliance posture per framework, snapshotted daily, with alerts when posture drops. Deadlines, obligations and reviews in one calendar.
Business impact analysis
Business processes with criticality, dependencies, recovery objectives and review cycles, linked to the risks and controls that protect them. The one assessment that runs without AI, because it should.
Regulatory change
Monitors the regulators and standards bodies you select, identifies changes that touch your obligations, assesses the impact on the obligations and controls it touches, and recommends what to do.
Workflow and automation (the nervous system)
Rules recalculate scores, open reviews and route approvals. Anything that needs a person lands in an approval inbox and in that person’s own queue, so nothing waits on someone noticing an email.
Rules and automation
Event-driven rules recalculate vendor scores, control health and compliance posture, open reviews when something changes, and hand anything that needs judgement to a person. Every automated run is explained.
Approval inbox
Runs that need approval wait in one inbox with a deep link and a due date. Approvers are told once, with the count of what is waiting, not once per item.
Handoffs, not reminders
When work reaches you, you hear about it: a review to start, a plan to approve, a finding assigned to you. By email and in-app, driven by the event, never by a timer.
Your turn
A personal queue of everything waiting on you across every module, and role-based dashboards for executives, risk, compliance, audit and vendor management.
Ask ControlDesk
A conversational assistant over your own data. Ask which obligations are overdue, what a vendor's open risks are, or what a policy says. Answers cite their sources and respect your permissions.
Reassessment
A worse external rating, a critical asset change, expired evidence or a schedule reaching its date reopens the relevant risks and drafts the next assessment.
System of record (the sink)
The risk register, control library, framework mapping, compliance posture, audit, policies and evidence a cyber GRC buyer expects, in one system. Every lens writes here, and a control mapped once counts everywhere it belongs.
Exposure that moves.
One risk with five controls linked to it. The implemented control is counted, and the chip carries inherent 16 High down to residual 8 Medium. Test a control, and every risk it touches moves with it.
Risk register
Every risk with a reference code, an owner from the moment it exists, inherent and residual scores that reproduce from their inputs, a treatment plan and a decision record.
Risk in money
Cyber risk quantified for the board: annualised loss expectancy per risk and across the portfolio, treatment cost against benefit, accept-or-treat tables and dollar-weighted heat maps. The number a board asks for, from the same register the team works in.
Decision ledger
Closing, accepting, deferring or excepting a risk, a finding, an incident, a plan action or an assessment writes a decision record with who, when and why. The platform refuses the change without a reason. A decisions inventory shows how many decisions were made this quarter, by whom — person, AI, rule or system — and on what. Auditors read the ledger, not the comments field.
Controls
A control library with continuous monitoring, health scoring, automated and manual tests, and effectiveness reviews that flow back to residual risk. Controls map across frameworks once and count everywhere.
Findings and deficiencies
One place for findings from every lens, audit and compliance activity, with a remediation lifecycle from assignment through verification to closure, each closure recorded.
Obligations and compliance
An obligations register fed by contracts, regulations and frameworks, with deadlines, evidence and status, and a posture history per framework.
Evidence
A single evidence catalogue linked to controls, risks, assets, incidents, obligations and audit requests, with expiry tracking and version history. Attach existing evidence or upload new from wherever you are.
Vendors
The full lifecycle from onboarding through qualification, assessment, contracts and performance. A composite score that reflects the vendor's assessments, open risks, contracts, incidents, controls and external security ratings, and moves when any of them do.
Incidents, assets and audit
Incident capture, triage, investigation and root cause with affected parties. An asset inventory with criticality, control mapping and risk linkage. Internal audit from the audit universe through planning, engagements, working papers and findings.
Data governance
Classify data elements, set encryption, retention and destruction standards, and map each element to the risks and controls that protect it, so a privacy assessment and a control test are talking about the same data.
Initiatives and objectives
Every change the business is running, with its type, owner, cost, the processes it touches and the strategic objective it serves; the assessments and risks it generated attached to it. The board sees change with risk on it, not a register of risks with no story.
Policies and attestations
One store for policies, standards and procedures with publish, retire and supersede history and acknowledgements. Scheduled attestation campaigns to control, policy and asset owners.
No connectors between modules, no exports from one register into another, no reconciliation spreadsheet.
AI you can govern
AI that proposes. People who decide.
Two different things share this page, and most platforms only do the first. ControlDesk uses AI to draft the assessment, and governs the AI systems your business puts into production — on one register, not a bolt-on beside it.
AI we use
Every AI result is a proposal until a person accepts it.
- Each assessment type has its own AI service with its own prompts and knowledge base. Nothing is a single general chatbot.
- Every result carries which model produced it, which prompt version, what inputs it saw and how confident it was.
- A person accepts, changes or rejects it before it becomes the record. Your rules can block a conclusion the AI wants to reach.
- Runs are metered against your own credit balance and refunded automatically when a run fails.
AI you govern
Governance for the AI your business deploys, on the same register as vendor and privacy risk.
- An AI system registry with risk classification, deployment stage and named human oversight.
- AI impact and conformity assessments, for the systems you build and the ones you buy.
- General-purpose model obligations, and detection of the substantial modifications that force a reassessment.
- Acceptable-use policies for generative AI, and the technical documentation a regulator asks for.
- Fundamental-rights impact assessments (Article 27), human oversight and kill-switch runbooks (Article 14), and override events recording every time a person stepped in.
- Post-market monitoring plans, transparency records, dataset lineage, and serious-incident reporting for general-purpose models.
- Mapped to the EU AI Act, ISO 42001 and the NIST AI RMF, in the same framework catalogue as everything else.
Integrations
Connect what you already run.
ControlDesk pulls findings, assets, identities and ratings from the tools you already own, and pushes decisions, tickets and alerts back out. No connector is required to start; every connector makes the register truer.
Cloud security posture
AWS Security Hub, Microsoft Defender for Cloud, Azure Defender, Google Cloud Security Command Center, Wiz
Findings become risks and control failures against the assets they belong to.
Identity
Microsoft Entra ID, Okta, Google Workspace
Users and groups for access reviews and single sign-on.
Endpoint
CrowdStrike Falcon, SentinelOne
Endpoint findings and control health.
Vulnerability management
Qualys, Tenable, Nessus, Rapid7
Vulnerabilities as findings with asset linkage and remediation tracking.
External ratings and attack surface
BitSight, RiskRecon, SecurityScorecard, Shodan, Censys
Vendor and own-estate ratings feed the composite score and trigger reassessment when a rating worsens. Threat intelligence and attack-surface findings land on the asset or vendor they belong to.
Code and pipelines
GitHub Security, GitLab Security
Code-scanning findings against the systems they belong to.
SIEM
Splunk
Alerts as incidents and control signals.
Ticketing and workflow
Jira, ServiceNow
Remediation tickets created from findings and plans; ServiceNow CMDB assets synchronised into the inventory.
Chat and on-call
Slack, Microsoft Teams, PagerDuty, OpsGenie
Handoffs, approvals and escalations where your team already is.
Single sign-on
SAML and OIDC through your identity provider, per tenant, with multi-factor authentication enforced for every account whether or not it arrives through SSO.
REST API
Risks, findings, assessments, vendors, controls and reports over an authenticated API with per-key scopes and rotation. Full reference on request during evaluation.
Webhooks in both directions
Inbound webhooks accept findings and events from tools without a connector. Outbound webhooks announce more than fifty event types, from a risk created to an approval granted, with signed payloads and delivery history.
Something missing?
Connectors are built on one framework, so a new source is measured in days. Tell us what you run.
Hosted in your region. Isolated by design.
ControlDesk runs on AWS in the region you require, with tenant isolation enforced at the database, multi-factor authentication for every user and single sign-on through your identity provider. Your data and backups stay in the region you choose; AI model calls go to OpenAI and Anthropic in the United States under API terms that exclude training on your data, and the result is stored back in your region.
Pricing
Pay for the assessments you use. Never for the register.
Every plan includes the whole sink, the risk register, controls, obligations, findings, evidence, incidents, assets, policies and the decision ledger, plus regional hosting, MFA and SSO. You choose the assessment lenses and the user band. AI usage is metered so you see exactly what it costs.
Team
One team, two lenses
Full register and decision ledger. Two AI assessment lenses. AI credits included monthly. Email support.
Business
The full nine, and the vendor portal
Full register and decision ledger. All nine AI assessment lenses. Vendor portal, integrations, API and webhooks. AI credits included monthly. Priority support.
Enterprise
Groups, regions and custom roles
Unlimited users. Everything in Business. Choice of hosting region, custom roles and separation-of-duty rules, security documentation and contractual SLAs. AI credits by agreement.
Priced per assessment lens and user band, so the number depends on which lenses you switch on and how many people use them. A quote takes one call, and we will tell you the number on that call. Business impact analysis is included in every plan and sits outside the nine, because it is the assessment that runs without AI.
How you get running
Guided setup wizards for each assessment type: third-party risk, privacy, maturity, business impact and agreements.
Framework and obligation packs for your region, loaded with the frameworks and obligations you answer to.
A tenant on your own data configured and running in weeks, not quarters.
How AI usage works
AI runs are metered per call at the provider’s cost plus a platform margin, against a credit balance you top up or that renews with your plan. Every run shows an estimate before it starts and its actual cost after. A run that fails is refunded automatically. There are no surprise invoices.
Questions we are usually asked
Can we start with one lens and add more?
Yes. Lenses switch on per tenant without migration.
Do vendors need licences to use the portal?
No. Vendor users are free and unlimited.
What happens to our data if we leave?
You export everything through the API or a full export we produce for you, and we delete your tenant on written instruction.
Regions
Hosted where you are. Mapped to the rules you answer to.
ControlDesk deploys per region, so your data stays in your jurisdiction, and each region ships with its regulators, frameworks and obligation packs pre-loaded.
Australian data, Australian rules.
ControlDesk runs in AWS Sydney with data residency in Australia. It ships with APRA CPS 230 and CPS 234 obligation packs, the Australian Privacy Principles in the privacy lens and Essential Eight as a maturity framework. Regulatory change monitoring watches the bodies Australian organisations answer to, from APRA and the OAIC to the ASD. Critical-infrastructure and government-supplier requirements are handled as frameworks in the same catalogue.
For APRA-regulated entities: material AI systems and third parties carry CPS 230 tags through the register, incident timers reflect notification obligations, and the decision ledger gives you the “why” that a supervisor asks for.
About
We filled in registers for years. Then we built the thing that comes before them.
ControlDesk is built by Deteqted, a security and risk practice based in Melbourne, Australia. For years our work was the same: a vendor already signed, a system already live, an AI model already in production, and a risk register that recorded the consequences. The decision had happened somewhere else, undocumented, and we were paid to write it up afterwards.
ControlDesk is our answer. It is cyber GRC, the category built for the security team rather than the enterprise risk office, with one difference at its centre: the decision happens first. The assessment is done by AI built for that exact job, a person decides on the record, and the register holds the outcome rather than the surprise. Governance for AI systems is native to it, on the same register as every other risk, because the team answering the board about vendors and privacy is the same team being asked about AI.
We built it for teams like the ones we worked in: mid-market, one team wide, expected to answer the board on vendors, privacy and AI at the same time, without a twelve-month implementation or a second platform for each question.
We are a small company that ships weekly and answers its own support. Deteqted Pty Ltd, ABN 50 167 691 509, Melbourne, Australia.
See a decision made before the fact.
Forty-five minutes, on your own scenario: a vendor you are onboarding, a contract on your desk, or an AI system your business wants to switch on. A new tenant is configured and running on your own data in weeks, not quarters.
The best demo is your own situation. Tell us which and we will build the forty-five minutes around it.