Earn customer trust faster
Evidence-backed questionnaire answers in Arabic and English, reused with every customer.
Arabic-native GRC · for CISOs and GRC leads in regulated companies
Every regulator you answer to, already mapped.
Your local regulators and global frameworks become controls, owners and deadlines, kept current by supervised AI agents that cite every claim, in Arabic and English. Nothing leaves without your approval.
Try your market
Built for your regulator, not translated for it.
A product of
ZySec AI
ZySec AIRegional hosting, confirmed at onboarding:UAE·Saudi Arabia·India·US
01
Vendor incident · reporting clock runningCERT-In 6-hour report drafted for your review
Now
TO APPROVE02
NCA ECC-2:2024 update applies to youGaps mapped · plan in Arabic and English
Plan
TO REVIEW03
Bank due-diligence questionnaireAnswers drafted in Arabic, with evidence
Draft
TO SENDCoWorker: Only three things need you today. Nothing goes out until you approve it.
Built for your regulator.
Pick your market. Regulation packs, reporting clocks and hosting are set for it from day one.
Also: EU DORA, UK
Regulation packs
- UAE IA Standard (TDRA)Federal information assurance standard
- DESC ISR v3 (Dubai)Dubai information security requirements
- CBUAE Consumer Protection & OutsourcingFor licensed financial institutions
- VARAFor virtual asset service providers
- UAE PDPL (Federal Decree-Law 45/2021)Personal data protection
Incident clock
TDRA / aeCERT notification
The clock starts when the incident is logged. The notice is drafted in Arabic and English for you to approve.
Hosting region confirmed at onboarding
Dubai
- Region-locked from onboarding
- No cross-region fallback
What agents do for you here
They track TDRA, DESC and CBUAE circulars, map them to your controls, and draft notices in Arabic and English for you to approve.
Regulation packs
- NCA ECC-2:2024Essential Cybersecurity Controls
- NCA CCC (cloud)Cloud Cybersecurity Controls
- SAMA Cyber Security FrameworkSaudi Central Bank framework
- KSA PDPL (SDAIA)Personal Data Protection Law
- CST CCRFCloud computing regulatory framework
Incident clock
Without delay
Report to the NCA, per NCA ECC 2-13.
SAMA: immediatelyFor critical incidents. Hijri dates in exports.
Hosting region confirmed at onboarding
Riyadh
- Saudi deployment, confirmed at onboarding
- No cross-region fallback
What agents do for you here
They map NCA and SAMA controls to your evidence in one control set, and prepare reports Arabic-first.
Regulation packs
- DPDP Act 2023Digital personal data protection
- CERT-In Directions 20226-hour incident reporting
- RBI Cyber Security FrameworkFor banks and NBFCs
- SEBI CSCRFFor SEBI-regulated entities
- IRDAI guidelinesFor insurers
Incident clock
6 hours
Report to CERT-In from the moment the incident is noticed. The clock starts itself and the draft is ready.
Hosting region confirmed at onboarding
Mumbai
- Region-locked from onboarding
- No cross-region fallback
What agents do for you here
They start the CERT-In clock the moment an incident is logged, draft the report, and keep RBI and SEBI evidence current.
Regulation packs
- SOC 261 criteria · 196 points of focus
- NIST CSF 2.0106 subcategories
- SEC cyber disclosure (Form 8-K Item 1.05)For listed companies
- NYDFS Part 50072-hour notice
- HIPAAAnd state privacy laws
Incident clock
4 business days
SEC Form 8-K, after the materiality determination.
NYDFS: 72 hoursNotice to the New York financial regulator.
Hosting region confirmed at onboarding
Virginia
- Region-locked from onboarding
- No cross-region fallback
What agents do for you here
They collect SOC 2 evidence continuously, track the 8-K materiality clock, and answer customer security reviews from approved answers.
Fix once, satisfy many.
One control set for every framework. Import NIST OSCAL catalogs, profiles and mappings; each framework attaches to your controls as a citation, not a copy.
OSCAL catalog
OSCAL catalog · NIST SP 800-53sha256 verified
- ac-2Account Management
- ac-6Least Privilege
- au-6Audit Record Review
- ir-6Incident Reporting
Your controls
- Privileged access reviewed quarterlyPR
- Audit logs reviewed weeklyDE
- Incidents reported within the regulator's windowRS
Cited by
- NIST AC-2NCA ECCSAMA CSF
- NIST AU-6RBIDORA
- NIST IR-6CERT-InDORA
- Import and export catalogs, profiles and mappings
- Deterministic output, hashed with SHA-256
- Crosswalks with NIST IR 8477 relationships
From signal to decision
The world changes. Agents build the evidence. You decide.
Signals from the world and your company
- Regulator updates
- Assets and vendors
- Control evidence
- Threat and vendor alerts
- Incidents
- Recovery tests
Supervised agents
Map, draft and citeEvery claim carries its source and a confidence.High confidence · cited
Your decision
You approveNothing goes outbound without a human.
How it works
Colour-coded to the NIST CSF functions, so you always know where work sits.
02
Pick your regulations
Ready packs for the UAE, Saudi Arabia, India and the USA, mapped to one control set.
03
Agents do the work
They watch, match, and draft plans and answers in Arabic and English. Every claim cites a source.
04
You decide
Nothing leaves ScaleRisk without your approval. Every decision is logged.
From upload to audit-ready, in one flow.
Upload what you have. Agents extract with citations, you review, and the work runs itself on your calendar until a second person accepts the evidence.
- Upload
Your risk register, policies and vendor assessments. Each file is hashed.
risk-register.xlsx · sha256 - Extract
Agents extract obligations, risks and controls, each with a citation.
High confidence · cited - Review
You accept or correct. Nothing is final without you.
Accepted - Owners
Owners are suggested by role, then assigned.
Owner: IT security lead - Calendar
Twelve months, on your country’s working days and public holidays.
12 months, holidays skipped - Reminders
Reminders and escalations in your time zone, counted in working days.
Escalates in working days - Evidence and readiness
Evidence is collected and accepted by a second person. Audit readiness moves.
Accepted by a second person
Evidence from the tools you already run: read-only by default.
An evolving platform, not a fixed list. Every connector says how it is built, and nothing writes back to your tools.
Upload exports and documents
Agents extract evidence, risks and controls with citations and a confidence; you accept what is right.
Available todayCertified
Built and tested by us, end to end.
PlannedAgent-assisted
Any tool with an API: an agent reads it and drafts evidence for you to accept.
PlannedBring your own
Push evidence through our API and signed webhooks.
PlannedNative connectors are next: identity, cloud, endpoint, device management, vulnerability, code, ticketing, HR, collaboration and SIEM.Request a connector
Meet CoWorker
A teammate that knows your company, and speaks first, in your language.
On every screen, CoWorker finds the one thing worth your time, prepares the action, and leaves the decision to you.
REGULATION"The NCA ECC-2:2024 update changes three of your controls. I've prepared the gap plan."
ASSURANCE"The bank's questionnaire answers are ready in Arabic, with evidence. They are waiting only on your review."
VENDORS"An HR vendor now trains AI on employee data. I've drafted the opt-out."
AI assurance
Agents you can audit.
We publish how our agents are measured. You see the same results your auditor would, and deciding and sending stay with you.
See the full evaluation on our trust page- Quarterly red teamIndependent testing, results on the trust page
- Model and version pinned per tenantNo model change without notice to you
- Nothing outbound without a humanTo customers, vendors or regulators
- No training on your dataWe never use your data to train any model
- Every claim has a source and a confidenceEvidence older than 30 days is not approved
- Override reasons loggedEvery human edit to a draft is logged with its reason
- Separation of duties
Whoever submits never approves; decisions above your authority band escalate to the CISO and the Board.
- Hash-chained audit trail
Append-only. Every action is linked to the one before it, so nothing is rewritten.
- Notified, read-only view-as
Support can view read-only for at most 60 minutes with a reason; your admins are told when it starts and can end it, and it is logged. Edits need your consent.
- Data residency per country
One region per company, locked at onboarding. We confirm which regions a deployment serves before you start.
- Supervised agents, capped spend
Agents draft and cite. A daily AI spend cap per company; past it, imports stay deterministic and wait for your review.
Outcomes, not modules.
Every screen answers a question your leadership asks.
No regulatory surprises
Every circular is checked against your profile and turned into gaps and tasks before it takes effect.
Third parties under control
Continuous watch on breaches, expiring reports and terms changes, with your exposure already mapped.
Risk in business terms
Live exposure tied to controls and evidence, in the language your CFO and board use.
What design partners are testing.
Compliance teams in all four markets are shaping the product with us. No names or logos, at their request.
Board packs in Arabic and English from the same evidence, without a quarterly hand translation.
Testing with usHead of compliance · Payments company, UAE
NCA and SAMA in one control set, hosted in the Kingdom.
Testing with usCISO · Insurer, Saudi Arabia
A CERT-In clock that starts when the incident is logged, with the draft waiting for a person to decide.
Testing with usHead of IT risk · NBFC, India
Customer security reviews that come back with their sources attached.
Testing with usVP security · Healthtech, USA
Become a design partner
We take a small number of partners in the UAE, Saudi Arabia, India and the USA: a 60-day pilot, a hosting region confirmed up front, and a direct line to the product team. We measure your own baseline in the first 30 days.
Illustrative estimate
How many hours come back to your team?
Three inputs, a range in hours, not a promise in dollars. Your pilot measures your real baseline.
Hours back each year
650–1,190
About 0.4–0.7 of a full-time role
Evidence and regulatory tracking450–750 hVendor reviews80–160 hCustomer questionnaires120–280 h
An illustrative range from your inputs and general assumptions: 150–250 hours per person, 2–4 per vendor, 6–14 per questionnaire. Not a promise of results.
See it with your regulator's rules.
A 30-minute walkthrough in Arabic or English, on your market's packs.