Unified Decision Queue
Alerts, identity risks, access requests, data exposures and response tasks arrive in one ordered list, ranked by consequence and deadline rather than by the tool that raised them.
Evidence-backed Decision Workspace
Each item opens into a workspace that shows the supporting evidence and its source, the confidence in that evidence, what is missing, the applicable policy and the recommended action.
Account-compromise assessment
Sign-in anomalies, mailbox rule changes, token activity and device signals are assembled into a single judgment about whether an account is compromised and what containment is proportionate.
Access and entitlement review
Standing access is compared against role, activity and policy, so reviewers can see which entitlements are justified and which should be reduced or removed.
Privileged-access governance
Administrative rights are tracked with the reason they were granted, the approver who authorized them and the date they are due to be revisited.
External-party access governance
Contractors, partners, consultants and volunteers are reviewed on the same evidence basis as staff, including what they can reach and when their access should end.
OAuth and automation authority
Connected applications, service accounts and automations are inventoried with their scopes, so the organization can see what non-human identities are permitted to do.
Guided incident-response workflows
Response follows an ordered sequence with the required authority named at each step, and the outcome of each step recorded as it completes.
Board and funder reporting
Reports are generated from the real decision history in the KRYOS Decision Ledger rather than reconstructed at the end of a reporting period.
Framework and control evidence
Decisions are mapped to the control frameworks the organization is accountable to, so evidence requests can be answered from records that already exist.
Decision-based security training
Training is drawn from the decisions the organization actually faced, so staff practise the judgments their roles require.
Expandable integrations
Deployment begins with Google Workspace and extends to identity providers, endpoint and detection tooling, and cloud estate evidence as the organization authorizes each connection.
Governance and safeguards
Consequential actions require a named human approver, connected systems remain the point of enforcement, and every decision keeps its evidence, authority and outcome on the record.
