Ready to strengthen your security programme?
Book a Discovery CallAI Security Company · London
The platform watches your estate and your vendors around the clock, cross-checks what it is told against what is actually exposed, and raises a finding the day a control regresses. Nothing changes in your environment until a person you name says yes.
Vendor attests to MFA on all administrative access. The exposed admin login accepts a password alone.
What the AI does on its own
Three jobs run without anyone asking. Every output names what it read and what it could not read, so you can check the work instead of trusting it. How the AI works sets out each job, the guardrails and the audit trail.
The SOC 2 report, policy or DPA a vendor uploads is read, not filed. Each high-stakes questionnaire answer is compared with the document behind it, and with what is exposed on the vendor's own estate.
Carries: the evidence it relied on, and the answers it could not verify.
A detection is written up before a person has to open it: the logs, hosts and identities examined, the timeline reconstructed, and the gaps in the data.
Carries: what it examined, and a plain statement of what remains unknown.
Domains, certificates, exposed services, email authentication and cloud posture are checked on a cadence. When a control that passed last time fails this time, a finding is raised that day.
Carries: the last result that passed, the result that failed, and when each was taken.
What it reads
Penthropic does not ask you to replace what you already bought. It reads it. Three security tools connect and start sending within minutes, and anything that can send JSON over HTTPS pushes its events in without waiting for us to write a connector for it.
CrowdStrike Falcon detections, AWS CloudTrail and the Okta System Log. Okta gives us every sign-in and every administrative change. CloudTrail arrives through a cross-account role you create yourself, so we never hold an access key of yours.
Create a connector, take the token it shows you once, and point your tool at the endpoint. It posts JSON over HTTPS and the events land in the same timeline as the rest. You do not need us to build a connector first.
Your DNS records, your certificates and your email authentication are readable by anyone, so those are what we read first. You have a picture on day one, before a single credential changes hands.
What it never does on its own
The AI can propose a fix. It cannot run one. Every action passes through the same gate, and the record of who opened it is part of the evidence.
What was claimed, what was observed, and the source of each. The control and framework clause it maps to.
The exact change, the system it touches, and what the AI expects to see afterwards. Written before anything moves.
A person you have named approves or declines. Approval covers this one change, not the class of change.
Who approved, when, what ran and what it returned, kept on the approval record itself.
The finding is not closed because the fix ran. It is closed when the next check observes the control working.
An action class must be armed for your tenant, you must approve the specific action, and the platform-wide switch must be on. Turning that switch off stops every automated change. Ask to see it during onboarding.
What you get out
Not a dashboard to interpret. Three things, each with the source attached.
Each risk names the person responsible, the date it was raised, the date it was last verified, and the framework clauses it bears on.
For each control: the check that ran, when, what it returned, and the document or probe it came from. Files, not screenshots.
Claimed, observed, delta, control. The same four fields whether the subject is your own cloud account or a vendor's SOC 2 report.
Two service lines, one partner
Start where your problem is. The platform is the same either way; advisory adds the people for the audit, the programme design and the leadership around it.
One portal that flags what matters and drives the fix: a live security score, a prioritised action inbox, and automation that never acts without your approval.
Protection that doesn't clock off.
Explore PlatformFixed-fee assessments, TPRM design, threat modelling, and fractional vCISO leadership for regulated firms. Boutique London team, no generalist fluff.
Walk out audit-ready.
Explore AdvisoryThe platform at work
Signals stream in from across your estate. The platform flags what's real, ranks what matters, and drives each fix through your approval, with the evidence filed as it goes.
Watches every signal and flags what's genuinely a risk, no alert noise.
Ranks what matters by real-world exploitability and business impact.
Drives each fix through, Autopilot acts only with your approval.
Files signed evidence as it goes, ready for your board and insurers.
How it works
From install to a live risk picture in the portal, then an operating rhythm of flag, fix, and prove.
Install the Penthropic agent, connect AWS, Okta or CrowdStrike, point anything else at the JSON endpoint, and bring your vendor list into TPRM.
The platform maps your estate and builds your risk picture: a security score, a risk register, and your external attack surface.
Approve prioritised fixes, watch your score climb, and pull board packs when you need them. Advisers and vCISO support on tap.
What the platform solves
Why Penthropic
Most tools stop at the finding: a scan, a score, a PDF of problems. Penthropic is built around the fix. Each flagged risk lands in one register, gets ranked by what it would actually cost you, and moves through approval to done, with the evidence to prove it.
Behind the platform is a boutique London practice, CISSP and CCSP certified, working to ISO 27001:2022, SOC 2, DORA, NIS2 and FCA expectations. Advisory and vCISO support are there when you want humans in the loop.
Evidence
We argue that attestations should be verified rather than trusted. That applies to ours. Everything here is checkable without speaking to anyone.
A worked demonstration against penthropic.ai using only public sources, published with the two gaps it found in our own configuration.
Read the demonstrationWhat was verified, what was found, what changed and over what period. A fixed structure, with at least one number in each.
Read the case studiesWhat the vendor claimed, what we observed, the delta, and the control it maps to. The actual output, before any call.
See a sample findingGet in Touch
Whether you're preparing for an audit, designing a TPRM programme, or looking for ongoing security leadership, we'd love to help.