Resources

Everything we publish and everything we ship, in one place: how evidence actually gets collected, how controls get mapped, and what auditors really ask for.

Evidence, from wherever it already lives

Import evidence straight from Google Drive, Dropbox and OneDrive instead of downloading it first.

Evidence

Most evidence already exists somewhere. It is in a Drive folder, a Dropbox share, a SharePoint site, and getting it into a compliance tool used to mean downloading it and uploading it again. You can now import it directly from Google Drive, Dropbox and OneDrive for Business, on one shared cloud-import base so the next provider is a smaller job.

Improvements
  • The dashboard grid is customizable, with vendor risk and assessment widgets to put on it.
  • View as vendor: an authenticated, read-only preview of exactly what a vendor sees before you send it.
  • The evidence inbox is a data-table with bulk triage instead of a card list.
  • A current-state validations worklist, plus a tenant validations page and a unified drawer that links straight to the run.
  • CSV files preview in the read-only data grid rather than downloading.
Fixes
  • The command palette, sidebar search and Inbox label are translated, and question dialogs are fully RTL.
  • Hebrew plurals resolve correctly when a count is exactly two.
  • The add-evidence drawer stacks in the URL, so back does what it looks like it does.

An inbox for evidence, and validations that read it

Drop a file in and Cyberwiz suggests what it proves; a catalog of reusable validations judges whether it holds.

EvidenceCompliance

Two halves of the same idea. The evidence inbox is a triage queue: drop files in, get AI mapping suggestions, accept or delete in bulk. An empty inbox is one large drop zone, pending instances of the same document combine into one, and a no-match reason is kept rather than discarded.

Validations became a catalog rather than bespoke code: 36 reusable validations as the base, with typed parameters per evaluator key. New document evaluators read the file itself: text-detect, date-extract, classification verify-fit, alert-review SLA and log-retention.

Improvements
  • Threshold, rate, coverage-diff and attribute-complete archetypes, so a new validation is configuration rather than a deployment.
  • Per-organization module access, gating what each customer sees.
  • The vendors table was redesigned, and a vendor auto-created from a connected integration carries that provider's logo and an Auto-added badge.
  • Framework logos, a readiness ring, an applicability drawer and bulk owner and applicability actions.
  • An AI copilot for writing questions, and CSV/XLSX import for systems, processes and data repositories.
  • Hebrew across vendor management: list, detail, tabs, dialogs and the data-table's sort, filter and export surfaces.
Fixes
  • Common controls always open their page, never a blank drawer.
  • asset_coverage is a pure union, not a diff.
  • Every compliance read refreshes after an evidence run, instead of showing the number from before it.

Compliance, rebuilt

A new compliance module with per-framework runs, a lifecycle cron, applicability and a Statement of Applicability.

Compliance

The compliance module was rebuilt end to end: backend, shared DTOs and frontend. Runs happen per framework on a lifecycle cron, applicability is explicit, and a Statement of Applicability falls out of it rather than being assembled by hand. A weekly digest says what moved.

Improvements
  • Owners are assigned on the Controls tab, per row or in bulk.
  • The vendor import gained a Confirm step with a skip-or-overwrite choice, so a second import is not a guess.
  • A contact's questionnaire access can be revoked without deleting the contact.
  • The sidebar rail is clickable, and its tooltips are faster.
Fixes
  • Reviewer notes keep their text while you type.
  • A screenshot pastes into the report widget without the focus dance.
  • Organization name edits persist from settings.

Auditors get a role of their own

An auditor is a first-class organization role, scoped to the frameworks and dates of their engagement.

Audits

Handing an auditor a login used to mean handing them everything. An auditor is now a first-class organization role, and the engagement record decides which frameworks they see and for how long.

Improvements
  • A bulk CSV/XLSX vendor import wizard, for onboarding a register rather than typing it.
  • In-app documentation with a nested sidebar, including the Validations and Checks pages.
Fixes
  • Severity is preserved on shared multi-select findings.
  • Questionnaire section order no longer depends on the reader's language.
  • The support dialog lays out correctly in RTL, and vendor portal comments poll faster.