Products & tools

Two platforms. And the tools we built along the way.

Two of these are products in their own right, with their own roadmaps. The rest are working tools that live on this site and support the consulting work — each one genuinely running, not a screenshot.

In development · coming soon Flagship product

It measures who is actually at risk — not who attended the training.

Realistic, safe phishing simulations sent to every employee on a standardised annual programme. Each action is measured against a category-capped scoring model and rolled into a live human-risk score for every person, department and the organisation.

9 mandatory simulations a year, difficulty climbing toward spear-phishing
66-payload library, so an adaptive re-send is never a repeat
Category-capped scoring — bounded by design, explainable in one line
Board-ready score with the full event log behind it

Explore PhishingPulse phishingpulse.com

AI Governance OS

In development

AI governance, risk & compliance

Governance · Risk · Compliance · Evidence

Helps organisations inventory and assess AI systems, determine their role for each one, manage AI risk, and prepare for the EU AI Act — reusing the ISMS controls they already run rather than building a parallel programme.

AI system inventory by use case, not by vendor
Provider or deployer role determination
Risk classification support
Evidence model for technical documentation

Tools

Free, running, and open in your browser.

Consultancies usually ask you to take competence on trust. These are working tools — no sign-up, no email gate, nothing stored.

Regulatory Scope Navigator

Available

“Am I in scope?”

Thirteen regulations, standards and frameworks assessed against your answers — each with the reason it applies and a confidence level. Separates law from standard from framework from assurance.

Open

PDPA Compliance Navigator

Available

Sri Lanka Personal Data Protection Act

Scope against the four statutory triggers, controller or processor determination, the data lifecycle, the real commencement timeline, GDPR comparison and a ten-dimension readiness self-assessment.

Open

ISO 27001 Gap Assessment

Available

ISO/IEC 27001:2022 readiness

Clauses 4–10 and all 93 Annex A controls, assessed on implementation, evidence and effectiveness rather than document count. Includes the interactive Annex A explorer.

Open

SOC Maturity Assessment

Available

SOC-CMM · security operations

The open model the industry benchmarks against. Five domains, with maturity and capability scored separately — because a SOC can own excellent tooling and still score badly on how it runs.

Open

Security Header Check

Available

Live, read-only

A genuine check against seven HTTP response headers on a domain you own. Small, but actually running — not a screenshot of a tool.

Open

NIS2 Readiness Platform

External platform

Directive (EU) 2022/2555

A dedicated platform for NIS2 applicability, Article 21 measures, organisational readiness, evidence and remediation. Hosted separately.

Open

Regimes & frameworks

What we help organisations understand, assess and prepare for.

Grouped by what they actually are, because the distinction decides how you should respond. A regulation binds you whether you like it or not. A standard is something you choose to conform to. An assurance report is an auditor's opinion you commission.

Regulations — legal obligations→ Standards — structured requirements→ Frameworks — risk & control guidance→ Assurance — independent evidence

See all services

Building your compliance programme?

Talk to DATADEFENZ about your readiness.

Thirty minutes, no charge. Regulatory and cybersecurity readiness, assessed against your actual situation.

Book a 30-minute call Contact us