Cloud, on-prem or hybrid

Compliance you can prove, not attest.

Fortress Cyber maps what really runs on your network and checks every control against live evidence.

Book a working sessionSee how it works

Five steps, from the network to the evidence.

  1. Discover

    Every component on your network and in your security tools.

  2. Map

    Who talks to whom, from observed traffic.

  3. Build processes

    Business processes your team validates and names.

  4. Calculate impact

    Business impact, with your crown jewels carried down.

  5. Evaluate

    Risk and compliance, against controls that actually operate.

Frameworks and policies, checked against live evidence

  • ISO/IEC 27001
  • SOC 2
  • NIST
  • PCI DSS
  • DORA
  • Your own policies

Built for regulated organisations: banks, insurers, defence, healthcare and critical infrastructure.

One platform for the CMDB and compliance, on live evidence.

Know what really runs on your network.

Read-only discovery from your directory, virtualisation, EDR, patching, firewalls and a passive sensor. Every field shows its source.

  • Directory
  • Virtualisation
  • EDR
  • Patching
  • Firewalls
  • Network sensor
Fortress CMDBCorrelating
Insight

25 machines run in virtualisation but are missing from the directory.

The directory lists 412 computers. Virtualisation runs 437. Each of the 25 is listed with the source that saw it.

Insight

36 devices on the network are not in the directory.

The sensor sees 448 devices on its segment. The directory lists 412. Each gap names the device, the control and the evidence.

Insight

12 connections nobody declared.

The sensor saw them on a lower-tier service that declares no such traffic, with the devices, protocols and ports involved.

1 of 3

See who talks to whom, and what breaks when something fails.

esx-dc1-02esx-dc1-01

Two hypervisors: esx-dc1-02 runs internet-bank-01, core-banking-01 and payments-db-01; esx-dc1-01 runs ad-dc-01 and teller-app-01. internet-bank-01 calls core-banking-01, which calls payments-db-01. Internet banking depends on internet-bank-01, Card clearing on core-banking-01 and payments-db-01, and Branch network on teller-app-01. Each hypervisor is a button that fails it.

Select a hypervisor to see what breaks if it fails.esx-dc1-02 is down: Internet banking and Card clearing are disrupted. Branch network keeps running.esx-dc1-01 is down: Branch network is disrupted. Internet banking and Card clearing keep running.

Business impact, calculated from the assets that carry it.

  • Declared stated by a named person
  • Derived computed from asset evidence
  • Conflict the two disagree

Map a control once. It counts for every framework it satisfies.

Every gap names the assets, the control and the evidence behind it.

One control

Asset inventory maintained and current

  • ISO/IEC 27001A.5.9 (2022)Satisfied
  • SOC 2CC6.1Satisfied
  • NISTCSF 2.0 ID.AM-01Satisfied
  • PCI DSSReq. 12.5.1 (v4.0.1)Satisfied
  • DORAArt. 8(6)Satisfied

Book a working session

It keeps checking after the audit.

An audit is a snapshot. Fortress Cyber keeps reconciling your sources, so a new device, traffic nobody declared or a conflict shows up as it is found, with the source behind it.

  • A new machine in virtualisation that is not in the directory.
  • Evidence attached to ISO/IEC 27001 control A.8.9, configuration management.
  • Traffic nobody declared, seen by the sensor on a lower-tier service.
  • Reconciliation complete: 36 objects from 3 sources.
  • No open gaps on your crown jewels.
  • A new device on the network, first seen by the passive sensor.
  • A conflict on a business service: its declared and derived impact disagree.
  • All evidence under 24 hours old: 36 of 36 objects.

Audit prep, with and without Fortress Cyber.

The same evidence, gathered once and kept current, instead of rebuilt by hand before each audit.

By hand

A spreadsheet of assets with the owners and evidence missing, a calendar with the weeks before the audit crossed out, a pile of screenshots and an email thread asking who owns a server.

Exports, screenshots and chasing owners, before every audit.

With Fortress Cyber

An evidence board for ISO/IEC 27001: five controls, each ticked green with its source and the time its evidence came in today, and a link to share with the auditor.

One board. Every control current, with its source and date.

The difference, in words

By hand

Weeks of screenshots, exports and chasing owners before each audit. Analysts line up one tool's list against another's in a spreadsheet, and one question about one server takes days, because the picture is split across the directory, spreadsheets, the patch tool, the EDR console, the firewall console, GRC documents and email.

With Fortress Cyber

Evidence comes in every day from the connectors and the sensor, and the signed pack is ready to export. Gaps are found with their source before anyone opens a spreadsheet, and every asset shows its owner, what depends on it, its risk and business impact, the controls it carries and the evidence behind them, in one place.

Your number: hours saved × your analyst or consultant day rate.

Run it in the cloud, on-prem or hybrid.

The same platform in every setup: hosted by us, on your own servers, or hybrid. Start hosted, and move on-prem later without changing the product.

Your network

  • Your security tools
  • Passive sensor
  • Collector
Encrypted, outbound only

Fortress Cyber cloud

A region in your country

Fortress Cyber platformYour own database and encryption key

Book a working session

Module by module, one CMDB underneath.

Every module works from the same CMDB and the same live evidence.

CMDB

One record of every asset on your network, kept current from live evidence.

ForCIO,IT operations,CISO

  • Every field shows the source that reported it.
  • Kept current by read-only connectors and a passive network sensor.
  • Every other module works from this same record.

Discovery

Finds what runs on your network, from two sources that check each other.

ForCISO,IT operations

  • Read-only connectors show what your tools think exists: directory, virtualisation, EDR, patching and firewalls.
  • A passive sensor shows what actually exists. It reads traffic metadata, never the payload.
  • The gaps lie in the difference, each with the source that saw it.

Relationships

Who talks to whom, drawn from observed traffic.

ForCIO,IT operations,CRO

  • Each business process, traced to the servers it runs on.
  • Fail a server and see which processes are disrupted and which keep running.
  • Traffic nobody declared stands out.

Correlation review

Where two sources disagree about an asset, you see both side by side.

ForCISO,IT operations

  • Each side carries the evidence from its own source.
  • For example, a machine that runs in virtualisation but is missing from the directory.

Compliance posture

Where you stand on every framework, checked against the assets that actually exist.

ForCompliance,Internal audit,CISO

  • ISO/IEC 27001, SOC 2, NIST, PCI DSS, DORA and your own policies.
  • Every gap names the assets, the control and the evidence behind it.
  • It keeps checking between audits, so a new gap shows up as it is found.

Control map

Each control, linked to the clause it answers in every framework.

ForCompliance,CISO

  • Work done for one framework counts for every other it satisfies.
  • Each clause is checked against the same evidence.
  • Your own policies sit on the map beside the published frameworks.

Evidence packs

Signed packs of evidence, ready for your auditor.

ForCompliance,Internal audit

  • Built from the evidence the connectors and the sensor bring in every day.
  • Ready to export when the audit comes, instead of weeks of screenshots.
  • A pack's signature can be verified offline.

Risk and BIA

Business impact, calculated from the assets that carry it.

ForCRO,Risk,CIO

  • Your crown jewels, carried down to the assets under them.
  • Each value shows whether a named person stated it or it was derived from asset evidence, and where the two disagree.
  • Risk evaluated against controls that actually operate.

  • Portrait of Menachem Tauman, smiling, in a white shirt

    Menachem Tauman

    CEO and co-founder

    About 30 years in IT and cyber security. Founded QMasters, a cyber security company, and sold it. Has led Fortress Cyber for about six years.

    LinkedIn
  • Portrait of Jonathan Tauman, smiling, in a white shirt

    Jonathan Tauman

    CTO and co-founder

    About six years building complex systems. Leads the development of Fortress Cyber.

    LinkedIn

Meet the founders.

An Israeli cyber security company, built for organisations where compliance has to be proved, not attested.

Questions, answered plainly.

What is Fortress Cyber?

A CMDB and compliance platform for regulated organisations. It maps what really runs on your network from live evidence, keeps your CMDB current, and checks your controls against ISO/IEC 27001, SOC 2, NIST, PCI DSS, DORA and your own policies.

What makes Fortress Cyber different?

Two things. The CMDB and compliance sit in one platform, so every control is checked against the assets that actually exist. And it runs where you need it: in our cloud, on your own servers or hybrid, as the same product.

Where does the evidence come from?

From two sources that check each other. Read-only connectors show what your security tools think exists: directory, virtualisation, EDR, patching and firewalls. A passive network sensor shows what actually exists. The gaps lie in the difference, and every field shows its source.

Which frameworks does it check?

ISO/IEC 27001, SOC 2, NIST, PCI DSS, DORA and your own policies. A control is mapped once and counts for every framework it satisfies, and every gap names the assets, the control and the evidence behind it.

Can we run it on our own servers?

Yes. Fortress Cyber installs on your own servers and can run fully air-gapped, so no data leaves your network. Evidence packs are signed and verified offline, releases are signed, and the licence works offline.

In the cloud setup, what runs inside our network?

A small collector on a host or VM you provide, with read-only connectors and a passive sensor. It opens outbound TLS connections only and listens on no network port. Source credentials stay on the collector; only observations leave.

Does the sensor read our traffic?

It reads metadata from a TAP or SPAN port: which device talks to which, over which protocols and ports. It never reads the payload and decrypts nothing.

Who can reach our data in the cloud?

Your tenant has its own database and its own encryption key, in a region in your country. Your team signs in through your identity provider, with OIDC or SAML 2.0 and your MFA. Nobody has standing access: a support session needs a ticket, a time limit and your approval, and it is recorded in your audit trail.

Can we leave, or move on-prem later?

Yes. You can export all of your data at any time, and move on-prem or to a dedicated instance without changing the product.

How do we start?

With a working session. We connect to a defined segment of your network and show you the gaps on your real data.

See the gaps on your own data.

Start with a working session. We connect to a defined segment of your network and show you the gaps on your real data.

  • Read-only connectors.
  • A passive sensor that never reads the payload.

We use these details only to reply to you about the session. Privacy policy