Ara Constellationthe altar · southern sky · origin of the name Aranis

Risk situational awareness, powered by AI

You already have the sensors.What's missing is the cockpit.

Aranis turns your tools, audits and vendor questionnaires into situational awareness of risk.

See it running

Built on recognized frameworks

NIST CSF 2.0 LGPD GDPR SOC 2 ISO 22301 NIST AI RMF

Modules

Seven risk modules, one platform

No module matters more than another. Turn on what you need and centralize all your risk intelligence in one place.

TPRM

Third-party & vendor risk

Assess, monitor, and quantify each vendor's risk with structured questionnaires, a dedicated portal, and automatic AI scoring.

Cyber Risk

Cyber risk

Measure cybersecurity posture with alignment to the frameworks your auditors require — NIST CSF 2.0 and SOC 2.

Privacy Risk

Privacy risk

Data protection compliance under LGPD and GDPR and Latin American laws — Argentina, Chile, Colombia, and Mexico.

Org Risk

Organizational risk

Quantify business risk with impact analysis (BIA), continuity, and the FAIR model — from operational to financial.

Continuity

Business continuity

Map critical processes, calculate RTO and RPO, and keep the continuity plan alive — from the BIA to the exercise, under ISO 22301.

AI Risk

Beta

AI risk

Govern the risk of AI systems — training data, model transparency, and supply chain — under the NIST AI RMF.

Human Risk

Coming soon

Behavioral risk

Assess the human factor: behavior, awareness, and the actions of people — the most exploited risk vector.

Inside the platform

What only shows up once everything is in one place

From the risk to the attack technique, in one path

Risk Path links the risk category to the vendor, to the control with a gap, and to the MITRE ATT&CK technique that gap enables. Not a score — the path an attack would take.

Your risk adds up the risk of who you hire

The composite score weighs your own self-assessment against the aggregate risk of your vendor portfolio, category by category. Neither number alone says where you stand.

From the control with a gap to the figure on the board deck

What the audit records as non-compliant becomes financial exposure on the board’s screen. And what has not been measured yet shows as unmeasured — never as zero.

Ara works across the modules

Ask in plain language and Ara answers with context from vendors, assessments, controls, action plans, BIA and privacy — without you changing screens to assemble the pieces.

The problem

Passing the audit is not being safe

⚠

Twelve reports, no decision

Every team has its own score: the vendor, the exposed domain, the critical process, the personal-data inventory. Nobody has the sum — and the sum is what decides.

⚠

You knew everything, in different places

The vendor gap, the domain exposure and the critical process were all on record. In three systems that do not talk to each other — which is why nobody connected them in time.

⚠

Evidence that does not survive the next question

The auditor signs the control off on paper. The incident does not ask the auditor — it asks whether the control was working that day, and the answer has to be on record.

Average risk by category

Information SecurityHigh

Data Protection (LGPD)Medium

Business ContinuityMedium

Vulnerability ManagementLow

Incident ResponseHigh

Consolidated risk score: 3.2 / 4.0

How it works

Perceive. Comprehend. Project.

Perceive

Questionnaires, external scanning, cloud evidence, integrations and the pre-assessed library bring the signals in — without relying on self-declaration.

Comprehend

The methodology turns signal into risk: a catalogue of 257 controls, categories framed by business impact, and a score that adds what you do to what the companies you hire do.

Project

An action plan with an owner and a deadline, financial exposure for the board, continuity actually exercised and crisis simulation — before the scenario happens.

Features

Everything you need to centralize and understand your risk

Per-control AI analysis

AI assesses each control that applies to the vendor profile individually — up to 257 in the full catalogue — and flags gaps, inconsistencies and risks a manual review would miss.

Exposed surface scanning

Passive DNS, TLS, DMARC, HTTP headers, and reputation — the platform compares what the vendor declares against what's visible on the internet.

Risk score by category

11 risk categories from your business impact perspective, with scores dynamically calibrated as your vendor base grows.

Audit-ready report

Automatically generated with organized evidence, assessment history, and decision trail — delivered in minutes, not days.

Frictionless vendor portal

The vendor responds and submits evidence without creating an account. Dedicated link, simple interface, tracked responses.

Ara — AI agent

Ara assesses vendors, identifies gaps, and generates reports through conversation — no menu navigation needed. Like having a senior risk analyst available 24/7.

Pricing

Scale as your maturity grows

Every plan includes the risk modules, Ara and audit-ready evidence. What changes is the volume.

Free

US$0/mo

To start on your own, no card.

5 vendors

Unlimited manual assessments

Vendor portal

AI analysis, enough to try it

Unlimited assessment reports

Public API

Integrations and cloud evidence

SSO / SAML

Workspaces (multi-organization)

Create a free account

Essential

US$140/mo

25 vendors

2 users