AI Digital CISO
Most organisations do not lack security knowledge. They lack the hours to apply it every day: to chase the patch that was agreed three weeks ago, to keep the risk register current, to notice that a control silently stopped working.
AI Digital CISO is a digital employee for your security function. It runs on our Digital Employee platform, and for every client we build a custom skill: the automation of one specific security or GRC process, on the infrastructure and tools you already run. It starts with observation and read-only access, takes on more as your team learns to trust it, and runs on the schedule you set. A named Audit3a expert stands behind every deployment.
ISO 27001
PCI DSS
GDPR
DORA · NIS 2
What it does day to day
Any information security or GRC process with a definable workflow that lives in systems it can connect to. Two skills exist today; the others are examples of what we scope with clients.
SOC alert investigation — implemented. Reads alerts from supported SIEM sources, gathers bounded evidence across connected tools, and hands your analyst an investigation record with the evidence, the alternative explanations and the gaps that need a human look. Analysts keep the decisions assigned to them; it does not isolate hosts, disable accounts or close incidents.
Vulnerability management — developed module. Ingests and enriches findings, triages them against your environment and business context, proposes owners and priorities, and runs the remediation ticket workflow with verification records. Deployment depends on matching it to your scanner, asset data and ticketing.
Examples we scope with clients. Risk management. Collecting inputs from control owners, organising control evidence and preparing risk register updates and the committee report for review. Third-party risk. Preparing and chasing vendor questionnaires, organising the answers and evidence, and highlighting the gaps that need a reviewer’s decision. Access reviews. Assembling who has access to what, preparing review records for the responsible managers, chasing the responses and keeping the evidence an auditor asks for.
Examples we scope with clients. Incident management. Organising evidence, drafting the timeline, tracking agreed response tasks and preparing the notifications your regulator expects. Incident decisions and the approval of notifications stay with your people. Patch and configuration compliance. Comparing configuration evidence with the agreed baseline, preparing the exceptions for review and reporting drift before an audit finds it.
If your process is not on this list, that is not a problem. Feasibility depends on the process, the data and the interfaces available, and we say which parts already exist and which need building before we agree delivery.
Define the process
We map the process as it actually runs: the systems, the people, the decisions and the exceptions. Together we pick a first scope, a baseline and the way results will be judged. Most of the value is decided here, and so is the honest answer on whether the process is ready to be automated.
Configure and build
We select the supported integrations, configure the workflow and build what is missing, on your tools: your SIEM, your ticketing, your GRC platform, your document templates. The deployment plan sets hosting, access, data flows, responsibilities and acceptance criteria. The usual choice is a dedicated deployment in your own environment.
Observe
The digital employee runs the process in parallel with your team, with read-only access to the agreed source systems. Your people compare its output with their own. It keeps its own working records; the connected systems are not changed at this stage.
Assist
It prepares, your people decide. The configuration of the process sets which actions it may take on its own, which need a named person’s approval and which are off limits, with limits on scope and duration where you want them. Reviewed corrections can be carried into the workflow and its retained context; an approval does not retrain the model.
Automate what has earned it
Where the skill supports it and the agreed checks pass, selected steps run without a new approval each time; the rest stays with people. You widen that authority one step at a time on evidence, and you can restrict permissions or suspend further processing at any time. Suspending stops future work; it does not undo what has already been done.
Progression follows evidence and approval, not a calendar. End-to-end autonomy is neither the default nor a required destination, and we will say so if asked to start there.
A scoping call on one defined workflow, with a written quote before any work begins.
Human oversight
Human oversight is built into how the platform operates, not added as a policy on top.
Defined authority
The enabled tools and workflow permissions decide what it can do at all; designated actions need approval under the configured policy; exceptions and consequential decisions have a named owner.
Reviewable records
Workflow activity, model calls and approvals are recorded, and the deployment plan fixes which events are captured, how long they are kept and how they are protected from alteration.
People and AI identity
These workflows support security professionals. Any use that would involve consequential decisions about individuals needs a separate assessment and an explicit scope; it does not come with a skill by default. Before a communication channel is enabled, its account identity, templates and disclosure wording are checked so that recipients know they are dealing with an AI system.
Regulatory alignment
Every deployment is classified against the EU AI Act risk tiers and the result documented before it goes live. The platform is built to operate under ISO/IEC 27001, ISO/IEC 42001, GDPR and DORA, and to leave the evidence those frameworks ask for. For financial entities, our contracts include a DORA addendum covering the obligations of an ICT third-party provider. Human oversight is designed consistent with ISO/IEC 42001 principles, and personal data is processed under a data processing agreement.
How engagements start
Run by Audit3a. An Audit3a security expert operates the digital employee day to day, backed by the platform. Named Audit3a and client reviewers hold human-in-the-loop control, with decision rights set in the engagement. Audit3a is accountable for the outcome, within the scope and service levels in the contract. On your side, you need a sponsor, a point of contact, and the access and decisions the workflow needs. Best for organisations without a security function, or teams that want a process taken off their hands.
Run by your team. Your team operates the digital employee day to day, with Audit3a maintaining the platform and the skill as agreed. Your named process owner and authorised reviewers hold human-in-the-loop control. Your organisation is accountable for the process, and Audit3a for the platform and the skill. On your side, you need a trained owner for the process and the environment it runs in. Best for organisations with a security or GRC team that wants to scale without hiring.
In both models the digital employee runs on the schedule you set, including outside working hours; how quickly a task completes depends on the workload and the connected systems. Human coverage is a separate agreement: in the Audit3a-run model the expert who reviews and approves its work is available in working hours, with on-call cover agreed per client. Who operates it and where it is hosted are separate choices: an Audit3a-run engagement does not require your data to sit in Audit3a’s environment.
Where Audit3a audits or certifies your controls, the AI Digital CISO is not deployed on the same scope. The rule that keeps a human auditor independent applies to the platform as well, and the partner responsible for assurance decides.
Hours back. The recurring work of chasing, collecting, drafting and reporting is done by the workflow, and you measure the difference against your own baseline rather than a brochure figure.
Nothing lost in the queue. Case states, owners and outstanding work are visible for everything the workflow covers, with exceptions and incomplete evidence surfaced to a reviewer.
Evidence for review. Workflow steps, model calls and approvals are recorded for investigation and oversight, with the coverage, retention and protection of those records agreed for your deployment. When an auditor asks why, the answer is on record.
Audit evidence as you go. Much of the evidence that ISO 27001, SOC 2, DORA or NIS2 asks for comes out of the process itself rather than being assembled the week before the audit.
Defence at machine speed. Attackers already use AI to scan, phish and adapt faster than a human team can respond. A defence that works at the same speed is no longer optional.
A workflow that improves. Reviewed corrections and selected context are retained under the rules you set and used to refine how the next case is handled. That is configuration and retained context, not automatic model training.
AI Digital CISO is one half of how we work with AI. The other half is making AI safe to use: AI governance under ISO/IEC 42001 and the EU AI Act, security testing of AI systems, and continuous assurance that the controls keep working after go-live. We apply both halves to our own platform, which is why we can show you the governance in a working system rather than in a policy document.
In 2026 our Digital Employee platform was selected for funding by the Netherlands–Ukraine Cybersecurity Fund, a programme of the Dutch government run by the Netherlands Enterprise Agency (RVO) to strengthen the cyber resilience of Ukrainian organisations with Dutch and Ukrainian expertise. Under the project AI-SOC4UA, we deliver it in a consortium led by DataExpert B.V., a Dutch cybersecurity company.
Five organisations in three sectors are taking part: financial services, healthcare and pharmaceutical logistics, and telecommunications and critical infrastructure. Each pilot follows the path described on this page: a scoped process, a dedicated deployment on the client’s own infrastructure, observation first, and results measured against the client’s own baseline.
What this means for you: the same platform and delivery method are being applied in five real environments at once, and what we learn there goes into every skill we build. Behind the platform stand a security consultancy founded in 2009, more than 500 projects and a team of more than 35 specialists.
Honest limits
If you need one assessment done once, hire the assessment. If the process is undefined, automation will produce failures faster, and we will tell you so at the workshop.
And if your organisation is not ready to let a system act even with approval gates, a human vCISO is the honest answer, and we offer that too.
Questions we get most often
Does it replace our security team?
No. It takes on the recurring work that consumes a security team’s week and leaves judgement, escalation and accountability with people.
Where an organisation has no security function at all, the Audit3a-run model provides one.
Where does your data go?
It is written into the contract before anything is connected. The usual choice is a dedicated instance in your own environment, which keeps the application records under your operational control; the model services it calls may still process selected inputs externally, and the deployment plan names both. For the SOC investigation workflow, the platform replaces selected identifiers with tokens and restricts what is sent to the model, and raw log attachments are excluded from that interface; these controls are configured and verified for your data, and other workflows get their own. Before any connection goes live, we agree in writing the model services, sub-processors, storage and inference locations, access, retention and deletion. Where an Audit3a expert operates it, your data stays where the deployment plan puts it, under the engagement’s NDA and data processing agreement. Our information security management is aligned with ISO/IEC 27001.
Can it run fully autonomously?
Selected steps can run automatically within the limits you configure. End-to-end autonomy is neither the default nor a required destination: the skill, the permissions, the consequences and the acceptance criteria decide what may run on its own and what stays with people. Trust is earned on your data, not promised on a website.
What does it cost?
Pricing depends on the process, the delivery work, the operating model and the support you want. Because the platform runs on your infrastructure, you normally pay for that infrastructure and for the model services directly; the proposal says so explicitly. We quote after a scoping call and confirm it in writing before any work begins.
Can we start small?
Yes, and we recommend it. The usual entry point is one process with a limited set of inputs, most often SOC alert investigation or vulnerability triage, subject to integration fit, before anything else is connected.
Our certificates
Team portfolio
A scoping call, a defined first workflow, and a written quote before any work begins.
Where to start?
Active Audit Agency provides extensive cybersecurity services for businesses, ensuring robust protection and compliance for organisations of various sizes.
You can copy our materials only after making sure that your services are safe.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.