How exposed are we?
- Today's answer
- A maturity score from 1 to 5, which fits no budget line.
- Indene's answer
- Expected loss in currency, as a range, with confidence beside it.
How exposed is your institution: in currency, as a range, with confidence.
Control assessment with an evidence hierarchy, quantified into financial exposure that holds up in the boardroom and in front of the regulator.
Expected annual loss
R$ 8.4M to R$ 21.7M
P10most likely valueP90
confidence38%low: 61 of 184 controls with validated evidence
Example figures: they exist to show the output format, not an actual measurement.
The three questions
The board asks. The spreadsheet does not answer.
If I approve this investment, how much does it drop?
- Today's answer
- No tool connects spending to reduction.
- Indene's answer
- A before-and-after simulation, on the same scale.
How do we compare to the market?
- Today's answer
- Without an external reference, every number looks wrong.
- Indene's answer
- A sector benchmark right next to your number.
Why now
The deadline has passed. Supervision is documentary.
- CMN 5,274 · BCB 538
Published 18 Dec 2025: 14 verifiable minimum procedures and controls, an independent annual intrusion test, and evidence retained for 5 years.
Resolutions CMN 5,274/2025 and BCB 538/2025
- 1 Mar 2026
The adaptation deadline has passed. Institutions still answering with spreadsheets are answering late.
CMN 5,274/2025
- < 650 supervisors
The Central Bank's supervision staff fell from 1,100 to under 650. Inspection arrives as a written request; whoever responds with a dated, traceable dossier has an objective advantage.
Sinal/BC, 2025
- R$ 8.92M
Average cost of a data breach in the Brazilian financial sector. It is the argument the board understands without translation.
IBM/Ponemon, Cost of a Data Breach 2025
How it works
You bring documents and exports. You leave with a dossier and a board report.
The product path is the onboarding path: a first exposure reading within 10 business days.
- 01
Assessment
Every control gets two scores, design and effectiveness, that never collapse into a single number.
- 02
Ingestion
Evidence arrives via documents, CSV and connectors. Each with origin, date and author.
- 03
Exposure
The FAIR engine with Monte Carlo translates control state into a loss range, with confidence pinned to the number.
- 04
Plan and dossier
A queue ordered by exposure reduction, and an inspection dossier as PDF: immutable trail, no manual collection.
Evidence hierarchy
Stated is not proof. The number knows that.
“When did you last actually restore from backup, time it, and have the result match the declared RTO?”
Stated
Someone said so. Deliberately colorless; it proves nothing yet.
Weight in the numberlowest
Evidenced
A document, a tool export, a connector collection.
Weight in the numbermedium
Validated
An active test that answered. Only this raises the ceiling.
Weight in the numberhighest
The three metrics
Three scenarios the board already fears, now with a number.
M1The entry point
Ransomware resilience
If our systems are encrypted tomorrow, how much do we lose and how fast do we recover?
M2The differentiator
Shadow AI
What data of ours is already leaving through AI tools nobody approved?
M3The regulatory obligation
Third-party risk
If a critical vendor goes down or leaks, how much do we lose, and can we prove to the regulator that we knew?
Simulation
Approving investment becomes a reduction number.
Toggle the controls and watch the range shrink: on the same scale, because comparing ranges on different scales is a visual lie.
BeforeR$ 8.4M to R$ 21.7M · confidence 38%
AfterR$ 7.3M to R$ 19.6M · confidence 45%
Single scale from R$ 0 to R$ 24M on both ranges.
Example figures: they show the output format, not an actual measurement.
One control, every framework
A new regulation stops being a new project and becomes a mapping.
Control-to-requirement mapping is many-to-many, with an explicit degree of coverage. A control assessed once answers every framework mapped to it.
CTL-014
Tested immutable backups
full coveragepartial coverage
- CMN 5,274full coverage
- ISO/IEC 27001full coverage
- CIS Controlsfull coverage
- NIST CSFfull coverage
- ISO 22301partial coverage
- ISO/IEC 42001partial coverage
Full and partial coverage are shown separately; partial never rounds up to "met".
What you take away
Two documents that leave the platform and enter the meeting.
Board report
PDF · 3 to 5 pages3 to 5 pages in the language of the board. Opinionated, printable, generated with history.
Inspection dossier
PDF · full trailOrigin, date and trail for every piece of evidence, with zero manual collection. The promise is commercial because the database guarantees it.
Where the data comes from
Connected today, kept apart from the catalog. On purpose.
Connected today
- Wazuh
- Proxmox VE
- Proxmox Backup Server
In the catalog · not yet verified against a real environment
- Veeam
- Rubrik
- CrowdStrike
- Microsoft Defender
- Intune
- Nessus
- Qualys
- AWS
- Azure
- GCP
- VMware
- Acronis
- Cohesity
- Commvault
- Veritas
A connector brings evidenced evidence, never validated; only an active test validates.
Aegis · AI on rails
The AI proposes. A person decides.
- 01
The AI reads documents and proposes classification, origin and excerpts, on rails, under versioned prompts.
- 02
No risk snapshot exists without human sign-off.
- 03
A content filter runs before every call: sensitive data is stopped at the rails before it ever reaches the model.
- 04
The product measures its own no-edit acceptance rate. The stated target is 70%.
Who uses it
Three people, three screens, the same number.
Board
10 minutes before the meeting
Range, confidence, variation and sector benchmark. What to bring to the council.
Consultant and GRC
All day, during inspection season
Program, frameworks, SoA, work queue and filtered-view export.
Practitioner
Gets in, fixes, attaches proof, gets out
Consolidated view, vulnerabilities, backup, detection and compliance.
Design partner program
Five seats. Founder terms.
We have no customer to name yet, and we will not invent one. The first five accounts join at half the list price for the first year, onboarding included, a first exposure reading within 10 business days, and roadmap priority.
- Half the list price in year one
- Onboarding included
- First reading within 10 business days
- Roadmap priority
5seats
Come through unharmed.
A 30-minute demonstration: range, confidence, simulation, and the dossier exported as PDF. A person answers, within 24 business hours.
Book a demo (30 min)
Or write directly: contato@indene.io