Manifesto
Indene, your cybersecurity team.
Indene exists to end inferred security: no organization should conclude it is protected because a control exists, rather than because it works.
The problem
More tools than ever, and fewer answers than ever.
The scanner knows one piece, the EDR knows another, the backup knows a third. The maturity assessment lives in a spreadsheet that ages without warning. The pentest ends in a PDF that never touches the control score. Three truths about the same company that never meet, and nobody tells the board what it costs or what changes if they approve.
What it is
Your cybersecurity team, without having to hire one. Our own platform, services and AI specialists coordinated by Aegis, a manager who is accountable: Indene finds what exposes the company, fixes it with the company’s IT, proves what was done and puts the risk in Brazilian reais for whoever decides.
What we do
Three inputs, one meeting point: the control.
Real state
API connectors into the cybersecurity, infrastructure and cloud tools the company already runs. Whatever has no connector comes in by manual entry, with the same rigor.
Process maturity
Design and effectiveness assessment, separate scores, evidence attached. It is a consulting work tool, not a questionnaire.
Offensive testing
Pentest and red team linked to the same control by the technique exercised and the kill chain stage.
The connector says the control exists and is up. The assessment says whether it is well designed. The test says whether it holds. The control is where the three meet, and that is why it is the unit of the product.
What comes out
Exposure by scenario, always as a range.
Best case, where the company stands today, and worst case with the declared recurrence. Next to every number, the confidence, which is not an opinion about the model: it is how much proof supports that scenario’s chain. Every action shows the loss it avoids, as a range, and the statement of applicability comes out per framework, without repeating proof.
Why it cannot be copied
- Whoever assesses by questionnaire stops at the documented step and cannot claim any confidence in their own number.
- Whoever only pentests delivers findings without process.
- Whoever only does GRC delivers process without proof.
- Whoever only connects delivers a dashboard.
Indene is the junction, and the junction happens at the control, not in a report assembled afterwards.
What Indene is not
Saying what we are not is part of what we are.
It is not where operations happen.
Tickets, changes and requests stay in the customer’s tools.
It is not one more green dashboard.
It is not a compliance checklist.
Compliance is a consequence of proof.
It is not independent assurance where Indene itself designed the control.
It is not a tool that only talks to technicians.
If the executive needs a translator, layer 3 has failed.
How we charge
Never per user, never per connected asset: connecting more sources raises the confidence of the number, not the invoice.
Principles
What we do not negotiate.
Every value is a range, never a single point.
The symbol is the principle: an error bar, not a dot.
No number without its confidence beside it.
Not even in a screenshot.
All evidence has a source, a date and an author.
Declared is not proof.
AI proposes, a person decides.
No snapshot without human sign-off.
One word, one meaning.
The same term on screen, in the contract and in the board conversation.
Where we want to get
That the accountable executive can, on one screen, say what sustains the operation, what has already been proven and what is missing, and that this answer is accepted without translation by the board, the regulator and their customers.
Design partner programme open: five seats, founder terms. Indene comes from the Latin indemnis: one who came through unharmed.
Indene Security
indene.io · contato@indene.io
Indene, your cybersecurity team.