The Iron Compass Platform
AI agents built from decades of security experience
Not chatbots. Not templates. Four domain-specialized AI personas modeled after the roles our founders have held — CISO, compliance lead, offensive analyst, and business strategist. Each one reasons with real tools against real infrastructure.
Four perspectives. One assessment.
Every target is examined through four lenses simultaneously. What one persona misses, another catches.
CISO Agent
Chief Information Security Officer
Evaluates your external posture the way a seasoned CISO would — probing attack surfaces, grading security controls, and identifying what an attacker sees from the outside.
- Attack surface enumeration and vulnerability posture
- Email authentication analysis (DMARC, DKIM, SPF)
- TLS/SSL configuration and certificate management
- Cloud security posture and IAM hygiene
- Security header assessment and DNS security
Compliance Officer
Chief Compliance Officer
Maps your technical controls to specific regulatory obligations — citing exact sections, flagging deadlines, and assessing whether you would pass a third-party audit today.
- HIPAA Security Rule (164.308–164.312) gap analysis
- PCI DSS v4.0 requirement mapping
- CMMC 2.0 and NIST SP 800-171 practice alignment
- State privacy law applicability (CCPA, NYDFS 500)
- Audit readiness scoring with regulatory citations
Threat Analyst
Senior Offensive Security Analyst
Thinks like a red teamer. Maps your attack surface the way a sophisticated adversary would — identifying the path of least resistance and constructing realistic attack chains.
- Attack chain construction with MITRE ATT&CK mapping
- Ransomware exposure and known exploit (KEV) cross-referencing
- Subdomain takeover and dangling DNS detection
- Brand abuse and typosquatting identification
- Email-based attack feasibility (BEC, spear-phishing surface)
Business Developer
VP of Business Development
Translates security findings into business context — estimating deal size, identifying decision makers, mapping compliance triggers to budget cycles, and prioritizing engagement strategy.
- SEC filing and financial intelligence analysis
- Government contract and CMMC trigger identification
- Security hiring signal detection and leadership mapping
- Competitive landscape and vendor displacement analysis
- Deal sizing and engagement strategy prioritization
Built from experience, not templates
Each persona encodes the judgment that comes from years inside regulated industries.
Modeled after real roles
Our personas aren't generic AI. They're modeled after roles our founders have held — protecting health systems, passing PCI audits, running red team engagements, and closing enterprise deals.
Deep regulatory encoding
Each persona knows the specific frameworks: HIPAA 164.308 through 164.312, PCI DSS v4.0, CMMC 2.0, MITRE ATT&CK technique IDs. Not abstract summaries — the actual section numbers and control requirements.
Tool-equipped, not prompt-only
Each persona has specialized reconnaissance tools — DNS enumeration, TLS analysis, NPI registry lookups, certificate transparency monitoring, and more. They gather real data, not guesses.
Agentic reasoning loops
These aren't one-shot prompts. Each persona runs an iterative loop — using tools, reasoning over results, identifying follow-up questions, and building a complete picture across multiple investigation steps.
Tested against the real world
We don't ship agents that hallucinate findings. Every persona is validated against real infrastructure before it touches a client engagement.
Client graph validated
Tested against our graph of existing client environments across healthcare, financial services, defense, and government contracting.
Internet-scale testing
Validated against real domains and real infrastructure across the broader internet. Real DNS records, real TLS configurations, real certificate transparency logs.
Evidence-backed findings
Every finding requires tool-backed evidence with severity ratings and confidence scores. No fabrication — if a tool fails, the persona says so.
How it works
From a single domain to a complete intelligence picture in minutes.
Point
Enter a domain or company name. That’s the only input the platform needs.
Analyze
All four personas run simultaneously — each examining the target from their specialty using dedicated reconnaissance tools.
Report
Findings are synthesized into a unified intelligence picture with severity ratings, confidence scores, and prioritized remediation.
See what our agents find about your organization
30 minutes. We run a live assessment against your domain and walk you through what each persona discovers. No pitch deck required.