Core GRC & Risk Management
Centralised repository linking assets, threats, controls and risks in a single traceable data model — eliminating siloed spreadsheets.
100+ framework content built-in: ISO 27001, NIST CSF, SOC 2, CIS Controls, PCI DSS, NIS2, DORA, GDPR, HIPAA, CMMC, PSPF, APRA CPS 234, and more — no manual entry required.
Methodology-agnostic: supports EBIOS RM, qualitative likelihood × impact matrices, and quantitative Monte Carlo / FAIR models side by side.
Multi-framework control mapping: decouple a control from any audit, map one control to many requirements, and reuse prior work across frameworks automatically.
BIA + CRQ: Business Impact Analysis links assets to business processes; Cyber Risk Quantification converts risk ratings into dollar Annual Loss Estimates (ALE).
Audit, Compliance & Privacy
Multi-framework audit management: run audits against ISO 27001, Essential 8, NIST and custom frameworks simultaneously. Evidence is centralised and reused across audit cycles — no re-uploading the same document.
Automatic compliance scoring: scores update in real-time as controls are marked evidenced or remediated — no manual calculation.
Privacy / GDPR module: catalogue all processing activities (Art. 30 register), link them directly to controls and action plans. Tracks consent, legal basis, data residency and breach obligations in one place.
Incident tracking: incidents are linked to related risks, controls and remediation actions — closing the loop between detection (SOC) and governance (GRC).
AppSec & Security Program
Application-level risk models: apply generic risk and control models to individual applications, covering OWASP ASVS 4.0 and MASVS for mobile.
SDLC & DevSecOps: maturity assessments across design, build, test and deploy phases of the software development lifecycle — track where security is embedded vs. bolted on.
Reusable control library: define a security control once (e.g. "input validation") and apply it to many applications and projects without duplication.
Maturity scoring: score projects, applications or business units on a 1–5 scale using OWASP SAMM-style dimensions. Benchmark against peers and track improvement over time.
Third-Party Risk Management (TPRM)
Built on audit capabilities: vendor assessments use the same framework engine as internal compliance audits — consistent methodology, no separate tool needed.
Questionnaire workflow: tailor a questionnaire per vendor tier, send for self-assessment, then review and score internally. All captured inside the platform.
Centralised posture view: see all third-party compliance scores mapped to your internal control framework — instantly spot gaps that cascade from vendor to your own posture.
Ongoing oversight: track contract expiry, assessment cadence, data-sharing scope and SLA compliance in one dashboard. Trigger re-assessments automatically.
Metrics, Analytics & Reporting
Built-in dashboards: live views of risk exposure, compliance coverage by framework, maturity scores and remediation velocity — no BI tool required.
NIST OLIR crosswalk: automatic mappings between standards (ISO → NIST → CIS → GDPR) using the OLIR registry — a single control assessment populates multiple framework reports.
CRQ & maturity benchmarks: convert qualitative risk ratings to ALE dollar figures; compare maturity scores across projects, divisions, or time periods.
Board-ready reporting: one-click management view with consolidated KPIs (risk score, compliance %, overdue actions) and KRIs (top risks, breach likelihood) formatted for non-technical audiences.
Collaboration, Automation & Deployment
Multi-tenancy: folder-based segregation per department, project or entity — each team sees only their scope. CISO gets an aggregated view across all folders.
Workflows & automation: scoring assistant validates control responses, automatic sanity checks flag inconsistencies, and notification workflows alert owners of approaching deadlines.
Jira & ticketing integration: action plan items can be pushed to Jira tickets (or any REST-capable system) and status synced back — ETA dates stay accurate automatically.
API-first (REST): every object and workflow is accessible via the API — ingest data from vulnerability scanners, push to SIEM, or build custom dashboards using your BI tool.
Deployment options: cloud SaaS, self-hosted Docker/K8s, and the AGPLv3 open-source community edition via GitHub.
Risk by Domain
Stacked bar chart showing the count of open risk scenarios per domain, colour-coded by severity (Critical / High / Medium / Low). Domains with the tallest Critical bars need immediate attention. Click the Risk Register tab and filter by domain to drill in.
Business Impact Analysis (BIA)
BIA links technical assets to business processes and quantifies the financial impact of unavailability or compromise. Key outputs: RTO (Recovery Time Objective), RPO (Recovery Point Objective), and Single Loss Expectancy (SLE) — the basis for the CRQ / ALE calculation. Used to prioritise which assets get the most robust controls.
Risk Scenario Register
Click any row to open a full drill-down with asset linkage, threat details, treatment rationale, related SOC alerts, and recommended controls.
Use the ALE column to sort by financial impact when in Quantitative mode. The treatment column shows the chosen response strategy: MITIGATE (add controls), ACCEPT (document), TRANSFER (insure/outsource), or REMEDIATE (fix root cause).
Multi-Framework Support
Shadow Sentry GRC ships with 100+ framework content libraries built-in. Shown here: ISO 27001:2022, Essential Eight ML2, NIST CSF 2.0, APRA CPS 234, and PSPF — all relevant to Australian government and financial services clients.
The decoupling model means a single "Access Control" control implementation can satisfy requirements across all 5 frameworks simultaneously — one assessment, many compliance credits.
OWASP Top 10 Coverage
Each OWASP category is assessed across all 14 applications. Status: PASS (controls in place, tested), WARN (partial coverage, 1+ apps affected), FAIL (no effective control, multiple apps affected). Mapped to OWASP ASVS 4.0 for detailed control requirements and MASVS for mobile-specific categories.
SDLC Security Maturity
Modelled on OWASP SAMM (Software Assurance Maturity Model). Five domains assessed across the software lifecycle: Governance, Design, Implementation, Verification, Operations. Each rated 0–3 (0=absent, 1=initial, 2=structured, 3=optimised). Target 2.0+ for all domains in production applications.
Vulnerability Register
CVSS-scored findings from DAST, SAST, and penetration testing. Each finding is assigned: application scope, OWASP category, SLA target (Critical 7d, High 14d, Medium 30d), and an assignee from the development team. Overdue items are flagged red and escalated to the Action Plan automatically.
Vendor Risk Distribution
Vendors tiered by criticality based on: data access type (PII, financial, source code), dependency level (single point of failure vs. replaceable), and assessment score. Critical tier vendors require quarterly assessment; Low tier vendors are assessed annually. Tier changes are tracked and notify the CISO.
Data Classification Register (Art. 30)
Implements the GDPR Article 30 "Records of Processing Activities" requirement adapted for Australian Privacy Act 1988. Each entry records: data type, sensitivity classification, all storage locations, retention period, legal basis for processing, and current compliance status. Linked to controls and breach notification obligations.
Australian Privacy Principles (APPs)
The 13 APPs under the Privacy Act 1988 (Cth) form the framework for handling personal information in Australia. Shadow Sentry GRC scores compliance against each principle based on: documented policies, technical controls, staff training records, and audit evidence. Scores below 70% trigger automatic action plan items and OAIC notification risk flags.
Domain Maturity Scores
Maturity rated 1–5 per security domain: 1-Initial (ad hoc, undocumented), 2-Developing (some processes), 3-Defined (documented, consistent), 4-Managed (measured, monitored), 5-Optimised (continuous improvement). Scoring combines control coverage, evidence quality, test frequency, and staff capability indicators.
Cyber Risk Quantification (CRQ)
Annual Loss Estimate (ALE) = ARO (Annual Rate of Occurrence) × SLE (Single Loss Expectancy). SLE is derived from BIA asset valuations and breach cost models (regulatory fines, incident response, reputational damage, operational downtime).
Shadow Sentry GRC uses a simplified Monte Carlo approach to generate 10th/50th/90th percentile loss distributions. Used for cyber insurance sizing and board-level risk appetite conversations.
Board-Level KRI / KPI Summary
KPIs (Key Performance Indicators): measure programme execution — remediation rate, audit completion, training coverage, control implementation velocity.
KRIs (Key Risk Indicators): measure threat exposure — open critical risks, failed MFA logins, unpatched critical CVEs, overdue vendor assessments.
Board view strips out technical detail, consolidates to RAG status (Red/Amber/Green), and includes trend arrows to show direction of travel.
Jira Integration & Automation
Action plan items can be synchronised with Jira (or any REST-capable ticketing system). Shadow Sentry GRC pushes new actions as Jira issues, syncs status updates back automatically, and maps Jira resolution dates to GRC ETA fields.
The REST API also supports: ingesting vulnerability scanner output (Tenable, Qualys), pushing risk data to SIEM, and triggering automated evidence collection workflows via CI/CD pipelines.
🛡
Shadow Sentry GRC — CISO Assistant Capability Reference
Inspired by the intuitem CISO Assistant open-source platform · Hover any feature bullet for detailed explanation · Click area headers to navigate
Community Edition · AGPLv3
Capability Area Summary
Based on CISO Assistant v2 feature set
| Area | Key Capabilities | Shadow Sentry Coverage |
|---|
| GRC & Risk |
Multi-framework content, risk assessments, BIA, CRQ, reusable controls/threats |
|
| Compliance & Audit |
Multi-framework audit, evidence reuse, auto-scoring, privacy/GDPR, incident linkage |
|
| AppSec |
App-level risk/control modeling, maturity scoring, reuse of security patterns |
|
| TPRM |
Vendor audits, third-party compliance capture, centralised TP posture view |
|
| Metrics |
Dashboards, compliance and risk scores, maturity metrics, OLIR-based mappings |
|
| Ops & Dev |
Workflows, collaboration, Jira integration, API-first, multi-tenant, cloud/on-prem |
|
⚠️
Core GRC & Risk
Asset · Risk · Control · Threat repository
Open Register →
-
Centralised repository for assets, risks, controls, and threats with a shared, traceable data model
?
-
Support for 100+ frameworks with built-in content — ISO 27001, NIST CSF, SOC 2, CIS, PCI DSS, NIS2, DORA, GDPR, HIPAA, CMMC, PSPF, APRA CPS 234, and more
?
-
Methodology-agnostic risk assessment workflows — supports EBIOS RM and generic qualitative/quantitative models
?
-
Multi-framework mapping — decouple controls from audits, map one control to many requirements, reuse work across frameworks
?
-
Business Impact Analysis (BIA) and cyber risk quantification modules for translating cyber risk into financial impact and scores
?
✅
Audit, Compliance & Privacy
Multi-framework · Evidence reuse · GDPR/Privacy Act
Open Compliance →
-
Audit management across multiple frameworks with evidence centralisation and reuse from previous audits
?
-
Automatic compliance scoring based on control progress and audit results — no manual calculation
?
-
Privacy / GDPR module to catalogue processing activities, link them to controls and action plans in one place
?
-
Incident tracking and linkage to risks, controls, and remediation plans — closing the SOC-to-GRC loop
?
🔐
AppSec & Security Program
SDLC · DevSecOps · Maturity scoring
Open AppSec →
-
AppSec coverage via generic risk and control models that can be applied to applications, SDLC and DevSecOps workflows
?
-
Central repository of reusable security controls and threats for projects, including application-level use
?
-
Maturity assessments and scoring for projects, applications, or business units — OWASP SAMM-aligned
?
🤝
Third-Party Risk (TPRM)
Vendor audits · Provider compliance · Posture view
Open TPRM →
-
Third-Party Risk Management module built on audit capabilities to capture provider compliance inside the platform
?
-
Vendor risk assessments, internal risk assessments, and ongoing oversight workflows — all in one place
?
-
Centralised view of third-party posture, mapped to frameworks and internal controls
?
📈
Metrics, Analytics & Reporting
Dashboards · OLIR · CRQ · Board views
Open Metrics →
-
Built-in analytics and dashboards for risk, compliance coverage, maturity, and remediation status
?
-
Automatic mapping and crosswalks between standards using NIST OLIR to simplify reporting across frameworks
?
-
Cyber risk quantification scores and maturity scores to benchmark posture across projects and divisions
?
-
Board-ready and management-level reporting views leveraging consolidated KPIs/KRIs
?
⚙️
Collaboration, Automation & Deployment
Multi-tenant · API-first · Jira · Open-source
Open Action Plan →
-
Multi-tenancy with folder-based segregation per department/project and aggregated CISO-level view
?
-
Collaboration features, workflows, automatic sanity checks, and a scoring assistant to reduce manual work
?
-
Remediation follow-up with integration to ticketing (e.g. Jira) and ETA tracking
?
-
API-first (REST) design for automation, data extraction, and integration into existing ecosystems
?
-
Cloud and on-premises deployment options, plus an open-source community edition (AGPLv3 on GitHub)
?
Centralised GRC Repository
A single data model links assets (servers, applications, business processes) → threats (from MITRE ATT&CK or custom) → risks (scenario-based) → controls (ISO, NIST, custom). Every object is traceable: you can navigate from a board-level risk all the way down to the specific control implementation and the evidence file that supports it.
This eliminates the fragmentation of Excel risk registers, separate audit trackers, and standalone TPRM spreadsheets — everything is in one auditable system.
100+ Built-in Framework Content Libraries
Shadow Sentry GRC ships with pre-loaded control content for frameworks including:
International: ISO 27001:2022, ISO 27005, ISO 31000, NIST CSF 2.0, NIST SP 800-53 Rev5, NIST SP 800-171, SOC 2 Type II, CIS Controls v8, PCI DSS v4.0
European / Global: NIS2 Directive, DORA, GDPR, ENISA, TISAX
US Sector: HIPAA, CMMC 2.0, FedRAMP, FISMA
Australian: PSPF, ISM, Essential Eight ML2, APRA CPS 234, Privacy Act 1988
No manual entry — content is pre-populated with control IDs, names, and guidance text.
Methodology-Agnostic Risk Assessment
EBIOS Risk Manager (RM): French ANSSI standard. Defines feared events, threat sources, attack paths, and operational scenarios. Full lifecycle from ecosystem mapping to risk treatment.
Qualitative (ISO 27005-style): Likelihood × Impact matrix (3×3, 4×4, 5×5). Produces risk level labels. Most common approach for SME and mid-market organisations.
Quantitative (FAIR/ALE): Annual Rate of Occurrence × Single Loss Expectancy. Produces dollar figures for insurance, board conversations, and budget justification.
Both models can be run simultaneously and their outputs compared in the CRQ dashboard.
Multi-Framework Control Mapping
The decoupling model is CISO Assistant's core differentiator. A control is defined once (e.g. "Multi-Factor Authentication implemented for all privileged access") and then mapped to requirements in multiple frameworks simultaneously.
A single MFA implementation can satisfy:
• ISO 27001 A.9.4.2 (Secure log-on procedures)
• Essential Eight ML2-7 (MFA)
• NIST CSF PR.AC-7
• APRA CPS 234.17
• PCI DSS Requirement 8.4
Evidence is uploaded once and reused across all mapped requirements. The platform tracks which evidence satisfies which requirement in which audit cycle — automatically.
Business Impact Analysis (BIA) & CRQ
BIA: Maps technical assets to business processes and quantifies the cost of unavailability. Outputs: RTO (Recovery Time Objective), RPO (Recovery Point Objective), Maximum Tolerable Downtime, and asset criticality tiers.
CRQ (Cyber Risk Quantification): Converts qualitative risk ratings into financial figures using the ALE model:
ALE = ARO × SLE
where ARO = Annual Rate of Occurrence and SLE = Single Loss Expectancy (derived from BIA).
A Monte Carlo simulation generates 10th / 50th / 90th percentile loss distributions — used for cyber insurance sizing and board risk appetite statements.
Multi-Framework Audit Management
Run concurrent audit cycles against multiple frameworks from a single interface. The platform manages the full audit lifecycle:
1. Planning: Define audit scope, assign auditors, set timeline
2. Evidence Collection: Upload/link evidence to specific controls
3. Assessment: Rate control implementation (Compliant / Partial / Non-Compliant)
4. Review & Sign-off: Auditor review workflow with comments
5. Report Generation: Auto-generated audit report with findings
6. Remediation Tracking: Gap → Action Plan → Closed loop
Evidence from a 2024 ISO 27001 audit is automatically available for the 2025 APRA audit — no re-uploading.
Automatic Compliance Scoring
The compliance score updates in real-time as controls are assessed. Scoring logic:
• Compliant control: Full weight credited
• Partial control: Proportional credit based on assessment score (e.g. 60% implemented = 60% of control weight)
• Non-compliant / Not assessed: 0 credit
• Not Applicable: Excluded from denominator
The platform calculates domain-level and overall scores, tracks score trends over time, and generates benchmark comparisons against peer organisations (where data is available in the community edition).
Privacy / GDPR Module
Implements GDPR Article 30 Records of Processing Activities (RoPA) adapted for Australian Privacy Act 1988 and APP compliance:
Processing Activity Catalogue: Record each processing activity with data type, purpose, legal basis, data subjects, data locations, retention period, and cross-border transfer details.
Linked Controls: Each processing activity links directly to the security controls that protect it — a breach in a control surfaces immediately as a privacy risk.
Consent Management: Track consent records, withdrawal requests, and data subject access requests (DSARs).
Breach Response: OAIC notification timelines (72h for eligible breaches) and NDB scheme compliance tracking.
Incident Tracking & GRC Linkage
Incidents detected by the SOC are linked into the GRC module to close the governance loop:
Risk linkage: An incident is mapped to the risk scenario it realised (e.g. a phishing incident → RS-006 Credential Theft scenario).
Control gap identification: The failed or missing control is flagged and automatically added to the compliance gap register.
Remediation plan: An action plan item is created in the GRC with owner, SLA, and Jira ticket reference.
Post-incident review: Findings update the risk register likelihood/impact scores — inherent risk is re-evaluated after each significant incident.
AppSec Risk & Control Models
The generic risk/control data model is applied at application granularity:
Application as an asset: Each application is registered as an asset with owner, criticality, data classification, and tech stack.
OWASP ASVS 4.0: Application Security Verification Standard mapped as a control framework — 286 requirements across 14 domains (Authentication, Session, Cryptography, etc.).
DevSecOps integration: SAST/DAST scanner findings can be ingested via API and automatically converted to vulnerability register entries with OWASP category tags.
SDLC gates: Define security requirements per SDLC phase — design review, threat modelling, code review, pen test — and track completion status.
Reusable Security Control Library
Define a security control once and apply it to multiple projects, applications, or business units:
Example: "Input Validation" control defined once with: implementation guidance, test evidence criteria, responsible role, and tool recommendations (SAST scanner, WAF rules).
This control is then applied to: Customer Portal, Mobile App, Payment Gateway, SOC API — each application gets the same control requirement without duplicating the definition.
Control instances can have different implementation scores per application (Customer Portal may be 60% compliant while Payment Gateway is 100%) — aggregated into the application security posture score.
Maturity Assessment & Scoring
Maturity rated 1–5 per domain using a model aligned to OWASP SAMM and CMMI:
Level 1 — Initial: Ad hoc, undocumented, relies on individual expertise
Level 2 — Developing: Some documented processes, inconsistently applied
Level 3 — Defined: Documented, consistently followed, staff trained
Level 4 — Managed: Measured, monitored with KPIs, proactive
Level 5 — Optimised: Continuous improvement, benchmarked, automated
Scores aggregate control coverage (breadth) and implementation quality (depth). Used to benchmark divisions against each other and against industry peers.
TPRM Built on Audit Capabilities
Vendor assessments use the exact same audit engine as internal compliance audits — same workflow, evidence management, and scoring logic. This means:
• No separate TPRM tool needed
• Vendor responses are stored and reused in subsequent assessment cycles
• Vendor compliance scores are calculated on the same scale as your own controls
• A vendor gap automatically surfaces as a gap in your own ISO 27001 A.15 (Supplier Relationships) score
Tiering logic assigns assessment cadence: Critical tier = quarterly, High = bi-annual, Medium = annual, Low = 2-yearly.
Vendor Risk Assessment Workflow
Five-stage assessment pipeline:
1. Initiation: Create vendor record, assign tier, select applicable framework questionnaire
2. Questionnaire: System sends tailored questionnaire to vendor contact via secure link
3. Self-Assessment: Vendor answers and uploads supporting evidence
4. Internal Review: Your team scores vendor responses, may request clarification
5. Approval / Remediation: Pass with conditions, require remediation, or reject
All stages are timestamped. Audit trail is complete and exportable for your own ISO 27001 A.15 evidence.
Centralised Third-Party Posture View
The TPRM dashboard gives a real-time consolidated view of all vendor risk:
Posture map: All vendors plotted on a risk × compliance matrix — immediately see which high-risk vendors are low-compliance
Framework mapping: Vendor scores mapped to your internal ISO 27001 and Essential 8 controls — supply chain gaps surface in your own framework scores
Contract metadata: Contract expiry, data processing agreement status, right-to-audit clause, security SLAs — all tracked and alerted on
Cascade risk: If a critical vendor is breached, affected risk scenarios are automatically flagged for re-evaluation.
Built-in Analytics Dashboards
Live dashboards without requiring a separate BI tool:
Risk dashboard: Heat map, risk distribution by domain/severity, treatment velocity, ALE trend
Compliance dashboard: Framework score radar, control-by-control progress, gap priority matrix, audit completion timeline
Maturity dashboard: Spider chart per domain, score history, peer benchmark comparison
Remediation dashboard: Action plan burn-down, overdue items, velocity by owner, SLA compliance rate
All dashboards exportable to PDF for board packs. Data feeds available via REST API for embedding in Power BI or Tableau.
NIST OLIR Crosswalk Engine
NIST Online Informative References (OLIR) is the official catalogue of mappings between cybersecurity documents, maintained by NIST.
Shadow Sentry GRC implements OLIR so that assessing one control automatically credits equivalent requirements in other frameworks. Examples:
• ISO 27001 A.9.4 → NIST CSF PR.AC-3 → Essential Eight ML2-7 → PCI DSS Req 8 → APRA CPS234.17
• ISO 27001 A.16 → NIST CSF RS.RP → SOC 2 CC7.4 → HIPAA §164.308(a)(6)
A single "Incident Response Plan documented and tested" assessment fills compliance credits across 4+ frameworks simultaneously — without re-interviewing or re-uploading evidence.
CRQ Scores & Maturity Benchmarking
Quantitative outputs for programme comparison:
CRQ per division: Each business unit or project gets its own ALE score — compare which division carries the most financial cyber risk exposure
Maturity benchmarking: Compare domain maturity scores against: prior quarter, target maturity, peer industry average (CISO Assistant community data)
Trend analysis: Track whether risk exposure is increasing or decreasing quarter-on-quarter, and correlate with remediation investment
ROI of controls: Before/after ALE comparison for proposed control investments — quantify the dollar value of implementing MFA, network segmentation, etc.
Board-Ready Reporting
Management and board reporting strips technical complexity to decision-relevant signals:
KRI view (Key Risk Indicators): Red/Amber/Green status for top risks — open critical scenarios, unpatched CVEs, overdue vendor assessments
KPI view (Key Performance Indicators): Programme execution metrics — remediation rate, compliance trend, training completion, audit velocity
Executive summary: One-page view — overall risk score, compliance average, top 3 risks requiring board decision, actions taken since last report
Exportable as PDF with your organisation branding. Scheduled distribution to board members via email.
Multi-Tenancy & Folder Segregation
Designed for organisations managing GRC across multiple departments, entities, or client accounts:
Folder model: Create folders per department (e.g. Finance, IT, HR, Legal), subsidiary entity, or client engagement. Each folder has its own risk register, compliance assessments, and action plan.
CISO aggregate view: Roll up all folder scores into a single executive dashboard — see enterprise-wide posture without losing the per-department detail.
Role-based access: Department managers see only their folder; CISO sees all. Auditors get read-only access to specific folders for their engagement.
MSSPs: Run separate client instances on the same platform with complete data isolation.
Workflows, Collaboration & Automation
Scoring assistant: Validates control responses for internal consistency — flags if you've marked a control "Compliant" but haven't uploaded any evidence, or if your maturity score doesn't match your control coverage.
Sanity checks: Automatic cross-validation — e.g. if risk likelihood is marked LOW but no controls are in place, the system flags the inconsistency for review.
Notifications: Email and in-app alerts for: approaching audit deadlines, overdue action plan items, expiring vendor contracts, control evidence requiring re-certification.
Collaborative assessment: Multiple assessors can work on the same audit simultaneously with conflict detection and comment threading.
Jira Integration & ETA Tracking
Remediation actions flow seamlessly between GRC and development workflows:
Push to Jira: Create a Jira issue from any GRC action plan item with a single click — title, description, priority, and due date are pre-populated
Status sync: Jira issue status syncs back to GRC — when a developer marks a Jira ticket "Done", the GRC action item updates automatically
ETA tracking: Predicted completion dates from Jira velocity data surface in the GRC remediation dashboard
Other integrations: ServiceNow, Azure DevOps, Linear, and any REST-capable ticketing system via the API. Webhook support for real-time sync.
API-First (REST) Architecture
Every GRC object and workflow is accessible via the REST API:
Ingest: Pull vulnerability findings from Tenable, Qualys, Burp, or any scanner → auto-create AppSec vulnerability entries with OWASP tags
Export: Push risk data to SIEM (Elastic, Splunk) for correlation with SOC alerts → risk score becomes a dynamic signal in the SOC dashboard
Automate: Trigger evidence collection workflows from CI/CD pipeline on every production deployment — automated SAST/DAST results attached to AppSec controls
Integrate: Feed compliance scores into Slack/Teams dashboards, embed risk KPIs in Power BI, or build custom mobile apps on the API.
Full OpenAPI 3.0 spec available. Authentication via API keys or OAuth 2.0.
Deployment Options
Cloud SaaS: Hosted by intuitem/Shadow Sentry on AU-region infrastructure. SOC 2 certified. Data residency in Australia. Suitable for most organisations.
Self-hosted (Docker/K8s): Deploy on your own infrastructure using the provided Docker Compose or Helm charts. Full data sovereignty — nothing leaves your environment. Recommended for government and defence clients under PSPF/ISM.
Open-source Community Edition: AGPLv3 licensed, freely available on GitHub. Full feature set. Community support via GitHub Issues and Discord. Used by 1,000+ organisations globally.
Enterprise Edition: Commercial licence with SLA, dedicated support, SSO (SAML/OIDC), and advanced analytics. Shadow Sentry provides local Australian implementation and support.