The Platform
We build a single platform, not a catalogue. 28 modules across four capability groups, on one data model and one dashboard — so security, compliance and risk stop being three separate systems that disagree with each other.
The standard enterprise security stack is a scanner, a compliance tool, a risk register in a spreadsheet, a ticketing integration and a reporting layer somebody built in a BI tool. Each is defensible on its own. Together they produce a specific and expensive failure: the same asset exists as five different records, none of them agree, and a meaningful part of somebody's job becomes reconciling them.
SemperWise One™ is built as one product on one data model for exactly that reason. A vulnerability found by scanning, the control it affects, the risk it feeds, the ticket raised against it and the evidence produced when it is closed are all the same object seen from different angles — not five records that have to be kept in step by hand.
Capability Groups
Start with the group that solves today's problem and enable the rest as you grow — same platform, same login, same evidence. No migration, no re-implementation.
Continuous discovery, automated testing and vulnerability management that prioritises by real business impact — not just CVSS scores.
ISO 27001, SOC 2, HIPAA, GDPR and DPDP mapped to live controls. Evidence collects itself and audits stop being an annual fire drill.
One living risk register, third-party assessments and access governance — with the workflow to actually close what you find.
The AI layer that reads your evidence, drafts your answers and reports to the board in language the board actually uses.
Inside the Platform
The full module list as it stands. Modules marked "coming soon" are still in development — everything else is part of the current platform scope.
Under the Hood
Scanning is only useful if it sees enough. These are the published figures, refreshed as of 8 August 2026.
Built On AWS
SemperWise One™ is a multi-tenant SaaS platform built on AWS. The same codebase deploys to our AWS cloud, to a customer private cloud, or on-premises where regulation demands it.
Our managed SaaS runs on AWS, so capacity scales with scanning and monitoring load rather than being provisioned up front.
Attack-surface discovery, continuous controls monitoring and AI analysis are bursty workloads — the architecture scales out and back down with them.
The same platform deploys into a customer-controlled cloud account when data residency requires it.
A self-hosted deployment for regulated environments that cannot use shared infrastructure.
How It Runs
Every module and every engagement follows the same six-stage loop, so findings from a one-off assessment feed the same register the platform monitors.
Assets, exposures and shadow IT mapped automatically across cloud and on-premise.
Automated VAPT, config review and control testing scored by business impact.
Prioritised remediation guidance routed into the tools your teams already use.
Controls mapped to ISO, SOC 2, HIPAA, GDPR and DPDP with evidence attached.
Continuous controls monitoring and drift detection between formal audits.
Board-ready reporting, attestation packs and a defensible audit trail.
Questions
SemperWise One™ is a cloud-native SaaS platform, architected on AWS, that unifies security, compliance, risk and AI governance in one dashboard. It covers 28 modules across four capability groups — Protect, Comply, Govern and Intelligence — on a single data model, so there is nothing to integrate between them and no reconciliation between tools.
One product. Everything else is a module inside it, sharing one data model, one login and one set of evidence. This matters more than it sounds: in a suite of separately-acquired tools, an asset in the scanner and the same asset in the compliance register are two different records that drift apart. Here they are the same record.
The platform section on this page marks every module as live or coming soon, and we keep it accurate rather than aspirational. As of now, 25 of 28 modules are live, with Threat Detection & Monitoring and Identity & Zero Trust still in development. We would rather show you that honestly than have you discover it during an evaluation.
Yes. The same codebase deploys to our managed AWS cloud, into a customer-controlled private cloud account where data residency requires it, or on-premises for regulated environments that cannot use shared infrastructure. This is a deliberate design decision — a meaningful share of Indian healthcare, financial services and government work simply cannot use multi-tenant SaaS.
No. The services practice stands entirely on its own and many clients only ever use it. The platform is what makes continuous work practical to deliver — attack surface monitoring, continuous controls monitoring, managed vulnerability management — so clients on those services get access as part of the engagement.
Yes. Findings route into Jira, ServiceNow and standard service desks, cloud accounts connect read-only for continuous configuration monitoring, and everything is available through an API. Findings also export as SARIF and JSON so they load into code-scanning dashboards natively.
Next step
A demo against a real target you control tells you more in thirty minutes than any deck. We will show you what it finds, including the parts that are still in development.
