01 / PIPELINE

One pipeline. Every figure keeps its source.

Nothing in Verity is typed in by hand and left to age. A connector is read, normalised into a measure, and that measure scores the standards, raises the findings and writes the board pack. Follow any number backwards and you arrive at the system it came from and the moment it was read.

STAGEWHAT HAPPENSDETAILCADENCE
01 READA connector runsRead-only wherever the vendor offers the distinction, with the narrowest permission that will do the job. Several sources need no credentials at all.06:00 daily, plus on demand
02 NORMALISEIt becomes a measureEach measure has a definition, a unit and a target. Two tools reporting the same thing land on the same key rather than becoming two numbers that disagree.Per sync
03 SCOREThe standards moveOne reading can move NIST, ISO, Cyber Essentials and CIS at once. Each is judged in its own terms, not on one invented scale.Per sync
04 RAISEFindings get a deadlineEvery finding carries the remediation window its severity earns it, stamped from your own policy where you have set one.Per sync
05 REPORTThe pack writes itselfGenerated for the month that just finished, then frozen. Correcting a reading afterwards cannot rewrite a published month.07:00 on the 1st

02 / PROVENANCE

Follow any figure backwards.

A board pack is read by people who were not in the room when it was made: an insurer at renewal, a customer doing due diligence, an auditor. Every figure carries where it came from and when it was read, and the printable pack carries the same appendix.

The standards it scores
Where the figures come from: every measure traced to its source with a freshness badge.
Where the figures come from

03 / CONFIDENCE

The score, taken apart on its own screen.

The score screen says what moved the number, by how much and in which direction, and states the confidence that follows from how much of the programme has been assessed.

Low coverage produces a low-confidence score, and it says so on the tile. A score built from a fifth of the controls is not the same claim as one built from most of them.

The score, explained: the confidence band, what moved the score, and where it is heading.
The score, explained

04 / LIMITS

What it will not do.

  • It does not change anythingNo isolate, no reboot, no patch push, no policy change, no agent install. Every connector reads. Nothing writes back to any system it is connected to.
  • It is not real-timeOne scheduled pass a night, plus sync on demand. Suppliers come round a few at a time, the ones never read first and then the oldest, so a register is refreshed in turn rather than all at once. Every screen tells you when it was last read rather than implying it is live.
  • It does not certifyCyber Essentials is awarded by a licensed body and ISO 27001 by an accredited auditor. Verity tells you where you stand before you go.
  • It does not go inside a supplierA supplier assessment is unauthenticated. It reads what they publish and asks the public certificate and header graders for their grade of the site. There is no port scan and no credential guess, and their problems never enter your own posture score, though they still reach the queue for somebody to chase.

CONNECT ONE SOURCE

The first picture of your attack surface arrives before anybody raises a ticket for an API key.

Several sources need no credentials at all, so there is something to look at on day one.

Request a working session