Supervised-agent GRC · UAE · Saudi Arabia · India · USA
Regulation-native GRC for the Gulf, India and the US.
Supervised AI agents run your compliance, third parties and customer reviews in Arabic and English, and nothing goes out without your approval.
Built for your regulator, not translated for it.
A product of
ZySec AI
ZySec AIUAEHosted in Dubai
Saudi ArabiaHosted in Riyadh, in-Kingdom
IndiaHosted in Mumbai
USAHosted in Virginia
01
Vendor incident · reporting clock runningCERT-In 6-hour report drafted for your review
Now
TO APPROVE02
NCA ECC-2:2024 update applies to youGaps mapped · plan in Arabic and English
Plan
TO REVIEW03
Bank due-diligence questionnaireAnswers drafted in Arabic, with evidence
Draft
TO SENDCoWorker: Only three things need you today. Nothing goes out until you approve it.
Built for your regulator.
Pick your market. Regulation packs, reporting clocks and install site are set for it from day one.
Also: EU DORA, UK
Regulation packs
- UAE IA Standard (TDRA)Federal information assurance standard
- DESC ISR v3 (Dubai)Dubai information security requirements
- CBUAE Consumer Protection & OutsourcingFor licensed financial institutions
- VARAFor virtual asset service providers
- UAE PDPL (Federal Decree-Law 45/2021)Personal data protection
Incident clock
TDRA / aeCERT notification
The clock starts when the incident is logged. The notice is drafted in Arabic and English for you to approve.
In-country install
Docker Compose, your host
- You choose the site at setup
- Nothing moves to another country
What agents do for you here
They track TDRA, DESC and CBUAE circulars, map them to your controls, and draft notices in Arabic and English for you to approve.
Regulation packs
- NCA ECC-2:2024Essential Cybersecurity Controls
- NCA CCC (cloud)Cloud Cybersecurity Controls
- SAMA Cyber Security FrameworkSaudi Central Bank framework
- KSA PDPL (SDAIA)Personal Data Protection Law
- CST CCRFCloud computing regulatory framework
Incident clock
Without delay
Report to the NCA, per NCA ECC 2-13.
SAMA: immediatelyFor critical incidents. Hijri dates in exports.
In-Kingdom install
Docker Compose, your host
- In-Kingdom, for NCA CCC
- Nothing moves to another country
What agents do for you here
They map NCA and SAMA controls to your evidence in one control set, and prepare reports Arabic-first.
Regulation packs
- DPDP Act 2023Digital personal data protection
- CERT-In Directions 20226-hour incident reporting
- RBI Cyber Security FrameworkFor banks and NBFCs
- SEBI CSCRFFor SEBI-regulated entities
- IRDAI guidelinesFor insurers
Incident clock
6 hours
Report to CERT-In from the moment the incident is noticed. The clock starts itself and the draft is ready.
In-country install
Docker Compose, your host
- You choose the site at setup
- Nothing moves to another country
What agents do for you here
They start the CERT-In clock the moment an incident is logged, draft the report, and keep RBI and SEBI evidence current.
Regulation packs
- SOC 261 criteria · 196 points of focus
- NIST CSF 2.0106 subcategories
- SEC cyber disclosure (Form 8-K Item 1.05)For listed companies
- NYDFS Part 50072-hour notice
- HIPAAAnd state privacy laws
Incident clock
4 business days
SEC Form 8-K, after the materiality determination.
NYDFS: 72 hoursNotice to the New York financial regulator.
In-country install
Docker Compose, your host
- You choose the site at setup
- Nothing moves to another country
What agents do for you here
They collect SOC 2 evidence continuously, track the 8-K materiality clock, and answer customer security reviews from approved answers.
Fix once, satisfy many.
One control set for every framework. Each framework cites your controls, not a copy.
OSCAL catalog
OSCAL catalog · NIST SP 800-53sha256 verified
- ac-2Account Management
- ac-6Least Privilege
- au-6Audit Record Review
- ir-6Incident Reporting
Your controls
- Privileged access reviewed quarterlyPR
- Audit logs reviewed weeklyDE
- Incidents reported within the regulator's windowRS
Cited by
- NIST AC-2NCA ECCSAMA CSF
- NIST AU-6RBIDORA
- NIST IR-6CERT-InDORA
- Import and export catalogs, profiles and mappings
- Deterministic output, hashed with SHA-256
- Crosswalks with NIST IR 8477 relationships
From signal to decision
Agents build the evidence. You decide.
Signals from the world and your company
- Regulator updates
- Assets and vendors
- Control evidence
- Threat and vendor alerts
- Incidents
- Recovery tests
Supervised agents
Map, draft and citeEvery claim carries its source and a confidence.High confidence · cited
Your decision
You approveNothing goes outbound without a human.
How it works
02
Pick your regulations
Packs for the UAE, Saudi Arabia, India and the USA.
03
Agents do the work
They watch, match and draft. Every claim cites a source.
04
You decide
Nothing leaves without your approval.
From upload to audit-ready.
- Upload
Risk register, policies and vendor assessments. Each file is hashed.
risk-register.xlsx · sha256 - Extract
Agents extract obligations, risks and controls, each with a citation.
High confidence · cited - Review
You accept or correct. Nothing is final without you.
Accepted - Owners
Owners are suggested by role, then assigned.
Owner: IT security lead - Calendar
Twelve months, on your working days and public holidays.
12 months, holidays skipped - Reminders
Reminders and escalations in your time zone, in working days.
Escalates in working days - Evidence and readiness
A second person accepts the evidence. Readiness moves.
Accepted by a second person
Evidence from your existing tools, read-only.
Upload exports and documents
Agents extract evidence, risks and controls with citations. You accept what is right.
Available todayCertified
Built and tested by us, end to end.
PlannedBeta
Running, earning certification through a 30-day clean record.
PlannedBring your own
Push evidence through our API and signed webhooks.
PlannedNative connectors are next, in the categories below.Request a connector
Meet CoWorker
A teammate that knows your company.
REGULATION"The NCA ECC-2:2024 update changes three of your controls. I've prepared the gap plan."
ASSURANCE"The bank's questionnaire is drafted in Arabic, with evidence. It waits for you."
VENDORS"An HR vendor now trains AI on employee data. I've drafted the opt-out."
- Quarterly red team
- Model and version pinned per company
- Nothing outbound without a human
- No training on your data
- Every claim has a source and confidence
- Override reasons logged
- Separation of duties
Whoever submits never approves. Decisions above your authority go to the CISO and Board.
- Hash-chained audit trail
Append-only. Each action links to the one before it.
- Notified, read-only view-as
Support views read-only for up to 60 minutes, with a reason. Your admins are told and can end it. Edits need your consent.
- Data residency per country
One region per company, locked at onboarding.
- Supervised agents, capped spend
Agents draft and cite. A daily AI spend cap per company.
Outcomes
No regulatory surprises
Third parties under control
Risk in business terms
Design partners
Board packs in Arabic and English from the same evidence, no manual translation.
Testing with usHead of compliance · Payments company, UAE
NCA and SAMA in one control set, hosted in the Kingdom.
Testing with usCISO · Insurer, Saudi Arabia
A CERT-In clock that starts at logging, with the draft waiting for a person.
Testing with usHead of IT risk · NBFC, India
Customer security reviews that come back with their sources attached.
Testing with usVP security · Healthtech, USA
Become a design partner
A 60-day pilot, a confirmed region and a direct line to the product team.
Illustrative estimate
How many hours come back to your team?
Hours back each year
650–1,190
About 0.4–0.7 of a full-time role
Evidence and regulatory tracking450–750 hVendor reviews80–160 hCustomer questionnaires120–280 h
Illustrative range from general assumptions, not a promise.
See it with your regulator's rules.
A 30-minute walkthrough in Arabic or English, on your market's packs.