Looking for the free posture scan? It takes minutes and needs no logs. Start with the scan, then come back here to find out whether someone is already inside.
Most intrusions are quiet for weeks before they hurt. The assessment sweeps your identity, mail, cloud and endpoint estate for the traces an intruder leaves behind, judged by Cyvantic AI with the evidence cited, and written up by a person. There is no charge, and the report is yours whether or not you go further.
You grant read permissions to the products you own, through their own consent screens. Response is a separate consent, and you do not give it for the assessment. Nothing in your estate is changed. You can revoke the access at any moment, from your own admin console.
A fixed pack of deterministic checks runs the same way every time: persistence, mail-forwarding rules, application consents, role and policy changes, abnormal sessions, long-lived keys and tokens. Cyvantic AI judges every entity the checks surface, and every judgement carries its evidence. Live detection runs alongside for the whole fortnight, so an alert raised during the window is investigated too.
Every finding marked confirmed, suspicious or clean, with the evidence attached. The exposures an attacker would use next. What we could and could not see, so the gaps are on the record too. A fix list in priority order. A 45-minute readout with the engineer who ran it.
Each one says what was found, where, and why it matters, with the records that prove it. Confirmed means an intruder's hand; suspicious means we want you to look; clean means checked and nothing there.
The weaknesses an attacker would use next: accounts without enforced multi-factor, stale admin roles, open sharing, dormant service accounts with live keys. Each with the fix proposed.
What the sweep could see and what it could not, so you know how much of the estate the conclusion covers. We never let a silent gap read as a clean result.
If we find an active intrusion we tell you the same day, and Emergency Incident Response is ready: a coordinated eviction in waves that your own administrator authorises, stage by stage. It is a separate decision, under its own terms, and never switched on without you.
from part 1, an example
Your telemetry lands in your own isolated tenancy in the European Union (Ireland), which is the region we run today. It stays there for the assessment and is deleted thirty days after the readout unless you choose to continue. Two things can leave that region, and we say so on the page where you connect: the case context Cyvantic AI sends to its model provider, and the indicators (addresses, domains, file hashes) it checks against threat-intelligence services. The second can be switched off for the assessment at your request. Nothing you share trains any model.
If your organisation is under rules that keep health or financial data inside a country, tell us when you ask. Our United Arab Emirates region is in build, and we will say plainly what can and cannot run before it opens, rather than find out together halfway through. The full picture is on the security page.
You have the Microsoft or Google estate, a cloud account, maybe an endpoint product, and nobody watching them at 2 am. The assessment tells you where you stand in plain language.
Alerts outrun the people. The assessment looks past the queue at what has already happened, and the fix list is ordered so the hours you do have land where they matter.
Run it on a client as the first engagement, or on a prospect as the opening conversation. The findings land in the managed-clients console with the rest of your fleet. The provider platform.
A person who builds the product reads every request and replies within two working days to agree a start date and walk you through the read-only connection. No charge, no deck, no commitment.