Three products. One asset graph.
Our product arm builds its own software — not resold, not white-labelled. One tells you what an attacker can reach, one proves whether they could get in, and one proves what you control. They share a single picture of your organisation, so nothing is discovered twice.
GRCorb
AI-powered GRC: scope a framework, generate branded policy packs in minutes, quantify risk with FAIR, collect control evidence automatically and walk an auditor through it — with build instructions for every failing control.
- Policy, risk, evidence & audit in one place
- 52 frameworks, 3,885 obligations
- Live at grcorb.com
Attack surface monitoring
Continuous external discovery, threat intelligence, supply-chain risk, brand impersonation and dark-web exposure — six modules that share one asset graph, with nothing to install.
- SAK Surface · Intel · Vendor · Brand · Deep · Pulse
- Scored against live threat intelligence
- No agents, no access required
SAK Red Teaming New
Our own agentic attack-simulation and penetration-testing platform — 38 specialist agents and a vetted, governed tool arsenal that confirm which weaknesses are genuinely exploitable and map the paths that reach your crown jewels. Safe by default, MITRE ATT&CK-mapped, with a dedicated AI-security pillar.
- Four authorized levels, safe by default
- Identity, cloud, web, AI & detection validation
- License it, or have us run it
Built for your regulator, not translated for it
Your obligations are mapped natively in GRCorb — NCA ECC, SAMA CSF and PDPL in the Gulf, Essential Eight, the ISM, SOCI and the Privacy Act in Australia, plus ISO 27001, SOC 2 and PCI DSS globally — with the evidence each assessor actually asks for.
| Framework | Who it binds | Obligations mapped | Platform coverage |
|---|---|---|---|
| NCA ECC | All Saudi government entities and critical national infrastructure | ECC-2:2024 · 4 domains · 28 subdomains | All 200 controls & sub-controls |
| SAMA Cyber Security Framework | Banks, insurers and financial institutions regulated by SAMA | 4 domains · maturity levels 0–5 | All 247 controls |
| PDPL | Any entity processing personal data of individuals in KSA | Consent · transfer · DPO | 16 controller obligations |
| Aramco CCC (SACS-002) | Third parties connecting to or serving Saudi Aramco | Supplier certification | Via services |
| NDMO data standards | Entities handling national data under SDAIA governance | 15 domains | Via services |
| Essential Eight (ML1–ML3) | Federal agencies mandatory; strongly recommended for all | 8 strategies · 3 levels | All 126 controls |
| ISM / IRAP | Suppliers handling Australian Government data | 1,150 controls | All 1,150 controls |
| SOCI Act 2018 | Designated critical infrastructure operators | RMP + reporting | 14 obligations |
| Privacy Act 1988 & NDB | Turnover above AU$3m, all health providers | 13 APPs | All 13 APPs + NDB |
| APRA CPS 234 / CPS 230 | Banks, insurers, superannuation funds | Info security + op risk | 24 + 22 requirements |
| ISO/IEC 27001:2022 | Voluntary — commonly contractually required | 93 controls | All 93 controls + clauses 4–10 |
| PCI DSS v4.0.1 | Any organisation storing, processing or transmitting card data | 249 requirements | All 249 requirements |
| SOC 2 | Voluntary — service providers asked for assurance by customers | Trust services criteria | All 61 criteria |
| GDPR | Organisations handling personal data of people in the EU | Controller & processor duties | 27 obligations |
| SMB1001:2026 | Voluntary — small and medium businesses, increasingly asked for in procurement and by insurers | 5 tiers · Bronze → Diamond | All 39 controls |
Every figure is counted from GRCorb's own catalogue. “All” means every item of the published framework is in GRCorb. A plain number is the set of obligations organisations are assessed against, not every clause of the law or standard. Via services — delivered by SAK Services consultants; not yet a GRCorb framework.