CoreCyber combines AI-driven compliance expertise with expert-led vulnerability and penetration testing so you can see, quantify, and reduce cyber risk. Log in or create a free account to start your first assessment and get an executive-ready risk view in minutes.
Stepwise workflow, sector-specific security questionnaires, and asset mapping automate data collection, minimizing manual entry
Visual risk scores, top risk rankings, trend analysis, and drill-downs by unit or geography, illustrated in executive reports for board or investor meetings
Dynamic compliance gap analysis and task management, complete with reporting templates and remediation tracking for major frameworks
Industry-leading rigor meets simplicity for entrepreneurs, CISOs, and GSOC executives
Stepwise workflow with sector-specific security questionnaires and asset mapping that automate data collection, minimizing manual entry
Visual risk scores, top risk rankings, trend analysis, and drill-downs by unit or geography, illustrated in executive reports for board or investor meetings
Dynamic compliance gap analysis and task management with reporting templates and remediation tracking for major frameworks including NIST CSF 2.0, ISO 27001:2022, and more
Four-layer risk aggregation and vendor evaluation clarify enterprise exposure in real time across your entire supply chain
Automated threat intelligence and alerting ensure ongoing protection and enable rapid response to emerging incidents
Dedicated modules tackle key challenges including AI and cloud security risks, secure software development, and insider threats. Each gap has been remediated for regulatory alignment
Choose the plan that fits your organization's security needs
Pricing for US/EU
Essential risk visibility for small teams
No credit card required
Complete risk management for growing organizations
$2,990.00/yr (17% off)
Advanced security for large enterprises
$14,990.00/yr (17% off)
Not sure which plan fits?
New to this?
Connectors are configured on request. After purchase, our team sets up and verifies each integration with you — they are not enabled automatically.
Our expert security team delivers comprehensive external network reviews through vulnerability assessments, penetration testing, or both. In just a few simple steps, gain clear visibility into your cyber risk posture and take control of your security.
Cancel or change plans anytime.
Everything you need to know about CoreCyber – from the live platform experience to penetration testing services and ongoing compliance coverage.
CoreCyber is a cybersecurity risk management and analytics platform that lets founders, CISOs, and security leaders continuously assess, quantify, and manage cyber risk in one place. It combines sector‑specific assessments, advanced risk models (including FAIR‑style financial impact), dashboards, POAM tracking, and reporting so you can move from ad‑hoc spreadsheets to a repeatable, data‑driven program.
CoreCyber is built to serve both small teams and large enterprises with the same underlying risk engine. We cover all 16 U.S. critical infrastructure sectors plus 10 additional commercial sectors (26 in total), and tailor the user experience by persona: entrepreneurs get guided, jargon‑free workflows; CISOs get deep analytics, ROI models, and board‑ready reports; GSOCs and MSSPs get multi‑tenant monitoring, connector integrations and supply‑chain aggregation.
Today, CoreCyber includes guided sector‑specific assessments, dashboards with risk scoring and trends, FAIR‑style financial impact models, POAM and compliance gap tracking, supply‑chain risk aggregation across vendors, and connectors for common security and IT systems. Reporting templates generate executive summaries, board views, and technical remediation details in minutes.
CoreCyber includes a built-in Help Center, a plain-language security glossary, contextual tooltips, and guided product tours that explain security concepts as you work. On the analytics side, SHAP-style driver views explain in plain language why a risk score changed and which factors moved it most. Together these keep busy founders and non‑security stakeholders moving quickly while still letting security teams dive into the underlying detail when needed.
Our supply‑chain module aggregates risk across vendors, contracts, and services so you can see concentration risk and critical dependencies at a glance. You can import vendor data, capture questionnaire results, link penetration tests or third‑party attestations, and roll everything up into enterprise‑level views.
CoreCyber includes a flexible notification system for risk events, assessment milestones, connector changes, and vendor activity. You can configure which events trigger alerts, who should receive them, and how frequently digests are sent. This keeps security, IT, and leadership aligned without flooding inboxes with noise.
CoreCyber offers connectors for common cloud, identity, security, commerce, and logging platforms. Today, the live connectors include Shopify, Splunk, Bitdefender, and CoreCyber vPenTest, along with integrated endpoint and vulnerability-scanning vendors that are already wired into the platform. AWS, Microsoft 365, and Google Workspace connectors are marked as "Coming Soon" in the portal and will be available shortly. Additional connectors for other cloud providers, commerce platforms, SIEM tools, and security products are on our roadmap so you can see what's planned next. These integrations enrich your assessments with real telemetry and reduce the amount of manual data entry required. For Enterprise customers, we can also scope and deliver additional or custom integrations as part of your onboarding or expansion roadmap.
Vendors receive secure, time-bound invitations to the CoreCyber vendor portal, where they can answer tailored security questionnaires, upload evidence, and acknowledge requirements. Their responses are normalised into your supply-chain views so you can compare vendors consistently, track outstanding items, and feed high-risk findings directly into POAM and risk views.
Access is protected using modern authentication with support for multi-factor authentication, backup codes, and granular roles. Administrators can manage users centrally, enforce strong sign-in requirements, and audit access and activity. Combined with strict role-based access and data isolation in the backend, this ensures that only the right people can see the right data.
CoreCyber ships with specialized modules for each critical infrastructure and commercial sector. Question sets, scoring logic, and analytics are tuned for your vertical—so a healthcare provider, a financial institution, and an energy operator see controls and risks that match their reality. Sector modules also drive tailored benchmark views and reporting, so you can compare your posture against peers instead of a one-size-fits-all baseline.
CoreCyber is aligned to NIST CSF 2.0 and ISO 27001:2022, and supports mappings to GDPR, PCI‑DSS 4.0, HIPAA, SOC 2, CMMC and other sector‑specific regulations. Our compliance and POAM views let you run dynamic gap analyses, assign remediation tasks, and generate evidence for audits directly from your assessment data.
Security and privacy are first‑class requirements. CoreCyber is designed to be SOC 2 and ISO 27001 aligned, with strong encryption in transit and at rest, strict role-based access controls, and audit logging. Each tenant's sensitive data is encrypted with its own dedicated encryption key, so one organization's data can never be decrypted with another's. Assessment data stays within your secured tenant, and we provide controls to help you meet GDPR/CCPA and contractual obligations.
Yes. CoreCyber can generate compliance-ready reports using the same data that powers your risk assessments and POAMs. You can produce evidence packs and summary reports aligned to frameworks such as NIST CSF 2.0, ISO 27001:2022, GDPR, PCI-DSS, HIPAA, SOC 2, and sector-specific regulations—without exporting everything to spreadsheets. Filters let you focus on a specific business unit, geography, or time window, and you can export reports for auditors, regulators, or internal review.
A Plan of Action and Milestones (POAM) is a structured list of security gaps, the steps you will take to fix them, and when those fixes are due. In cybersecurity and compliance, POAMs are used to show auditors, regulators, and executives that you understand your risks and have a concrete remediation plan. CoreCyber turns assessment findings into POAM items you can prioritize, assign to owners, track to completion, and report on over time—so you can demonstrate progress instead of managing everything in spreadsheets.
CoreCyber goes far beyond a single risk score. You can drill into temporal risk trends, model different loss scenarios, explore SHAP-style drivers that explain why a score moved, benchmark your posture against sector peers, and evaluate the ROI of specific controls. These analytics are built directly from your assessment, connector, and vendor data—no spreadsheets required.
Yes. CoreCyber includes prebuilt report templates for executives, boards, regulators, and technical teams. You can generate PDF and DOCX reports that summarize risk, financial impact, POAM status, and compliance coverage, then customize filters by business unit, geography, or time period. Many customers use these reports directly in board decks and audit responses.
You can configure scheduled reports to run on a recurring cadence—monthly, quarterly, or aligned to your board and audit cycles. Reports are generated automatically from the latest assessment, connector, and vendor data, so stakeholders receive an up-to-date view of risk and remediation progress without manual effort.
Yes. External vulnerability assessments and penetration tests can be requested from within the CoreCyber portal. You choose scope and timing, complete a short intake, and track engagement status and reports alongside your broader risk and compliance program.
An external penetration test simulates a real‑world attacker operating from the internet. Our team targets your public‑facing assets—web applications, VPNs, email gateways, and other exposed services—using the same techniques adversaries rely on to identify exploitable weaknesses before they are abused in the wild.
Internal penetration testing assumes an attacker has already obtained some level of access to your internal network or an employee account. Rather than testing your perimeter, it focuses on lateral movement, privilege escalation, data access paths, and how far an attacker can progress once they are inside.
Yes. After launching the platform, we enabled both external and internal penetration testing through the same workflow. You can scope internal tests to specific networks, identity stores, or business units and have findings automatically flow into your risk register and POAM views.
Automated assessments and analytics help you understand control maturity and financial impact, but penetration testing validates how those controls behave under real attack conditions. Regular pen tests are often required for compliance, support cyber‑insurance underwriting, and give you concrete exploit chains that can be plugged directly into CoreCyber for prioritised remediation.
After you subscribe, you receive access to the portal immediately and can start your first assessment within minutes. Our team schedules an onboarding session (typically within a few business days), helps you configure sectors, connectors, and user roles, and works with you to define an initial assessment and reporting cadence.
Stay informed with real-time updates from trusted security sources
A malvertising operation dubbed SourTrade is making victims' browsers build the final Windows executable themselves, using a legitimate Bun runtime as its base instead of serving one complete malicious file from a fixed URL.
Security firms ThreatBook and Imperva say attackers are targeting a critical flaw in Fastjson, Alibaba's JSON library for Java.
Security researchers at depthfirst published working exploit code on July 24 for a GitLab flaw that GitLab patched six weeks earlier, on June 10. It runs commands as git on any self-managed 18.11.3 server that has not taken the update.
For years, phishing campaigns targeting financial institutions followed the same playbook. Victims were tricked into entering usernames and passwords, attackers collected the credentials, and accounts were compromised later when an…
Threat actors linked to the Cl0p (aka Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest) ransomware campaign are exploiting flaws in internet-exposed PTC Windmill and FlexPLM deployments as part of a new data extortion campaign.
The operators of the DevMan ransomware-as-a-service (RaaS) scheme are maintaining a dedicated web platform that offers affiliates the ability to build payloads, oversee earnings, and manage various aspects related to victims.