AI-first GRC platform
Read the systems you run. Close the gaps they show.
Gwenda is an AI-first GRC platform. It connects to what you already run, works out which controls you already have, measures them against the gold standard for your industry, and tells you exactly what closes the difference.
The risk dashboard
The big picture. And what needs your attention.
Explore Gwenda’s new dashboard: risk exposure, priority risks, action due dates and reviews by owner, together in one view. This preview uses sample data to show the layout.
Your risk overview
Risk dashboard
Risks monitored
48
Across the sample portfolio
Need attention
8
High or extreme rated risks
Open actions
12
2 overdue · 10 on track
Controls effective
86%
Based on sample assessments
Risk heatmap
Where likelihood meets impact
| Likelihood / impact | 1 | 2 | 3 | 4 | 5 |
|---|---|---|---|---|---|
| 5 | 0 risks, medium rating | 0 risks, high rating | 0 risks, high rating | 1 risks, extreme rating | 1 risks, extreme rating |
| 4 | 0 risks, low rating | 1 risks, medium rating | 2 risks, high rating | 2 risks, high rating | 0 risks, extreme rating |
| 3 | 1 risks, low rating | 3 risks, medium rating | 4 risks, medium rating | 2 risks, high rating | 0 risks, high rating |
| 2 | 2 risks, low rating | 5 risks, low rating | 6 risks, medium rating | 2 risks, medium rating | 0 risks, high rating |
| 1 | 5 risks, low rating | 6 risks, low rating | 4 risks, low rating | 1 risks, low rating | 0 risks, medium rating |
- Low
- Medium
- High
- Extreme
Top 5 risks
Highest priority · risk score out of 25
Risks by rating
A balanced view of your exposure
Actions by due date
12 open actions · overdue and upcoming
- This week5 actions, 2 overdue
- Next week3 actions, 0 overdue
- Week 32 actions, 0 overdue
- Week 42 actions, 0 overdue
- On track
- Overdue
Reviews needing attention 10
Overdue assessments by owner
Coming up next
Assessments and actions · next four weeks
This week: 6 assessments and 5 actions
Next week: 4 assessments and 3 actions
Week 3: 3 assessments and 2 actions
Week 4: 2 assessments and 2 actions
- Assessments
- Actions
All figures and names are illustrative sample data.
The dashboard is currently a demonstration in the app. Figures, names and charts shown here are illustrative, independent of organisation records.
See Gwenda in a demoCompliance tooling usually starts by asking you questions. Gwenda starts by looking.
A questionnaire records an intention. Configuration records what is actually happening. That difference is the whole product, and it is why a Gwenda finding can be handed to an auditor or an assessor, or put in front of a board, without anyone having to vouch for it.
The loop
Connect, discover, benchmark, remediate.
Then it runs again. Posture is recalculated as your environment changes, so drift is visible within days, long before the next audit would find it.
- 01
Connect
Point Gwenda at the systems you already run: identity, cloud, endpoints, code, HR, rostering, ticketing.
Read-only access that takes minutes to set up and can be revoked at any time. There is nothing to install on staff devices and nothing to migrate. Gwenda asks for the narrowest scope that answers the question and no more.
- 02
Discover
Gwenda reads those applications and works out which controls you already have in place.
Who has access to what, how it is enforced, what is logged, what is backed up, who has been trained, what is overdue. It records the evidence as it goes, with the source system and a timestamp attached to every finding.
- 03
Benchmark
Your posture is scored against Gwenda's gold standard for your industry.
The control set a well-run organisation in your sector is expected to have, drawn from the legislation, the regulator's own guidance and the practice of organisations that pass assessment. It is a measured benchmark, not a generic checklist you fill in yourself.
- 04
Remediate
Every gap arrives already owned, with the specific action that closes it and the evidence that will prove it is done.
Close it, and Gwenda picks up the change on the next scan. Nothing has to be marked complete by hand, because the proof comes from the same system that created the gap.
The benchmark
The gold standard, and where it comes from
For each module Gwenda maintains a gold standard: the control set a well-run organisation in that sector is expected to have. It is drawn from the legislation, the regulator's own guidance, and the practice of organisations that pass assessment. Your score is the measured distance between what Gwenda found and that.
- It is specific to your sector.
- A childcare service and a payments platform are not held to the same standard, so they are not measured against the same one.
- It moves when the regulator moves.
- When the reformed AML/CTF Rules commenced on 31 March 2026, programs still written around Part A and Part B became descriptions of a repealed regime. The benchmark moved; your score moves with it, without you rewriting anything.
- Every number traces back to a control.
- A score you cannot explain to a board is worse than no score. Each one resolves to a specific control, read from a named system and mapped to a clause.
- One control, counted everywhere.
- Multi-factor authentication evidenced once satisfies the Essential Eight, ISO 27001 and SOC 2 simultaneously. Gwenda knows the overlap, so you evidence it once.
Illustrative figures. Yours are measured from your own systems.
What that gives you
Posture you can explain and hand over
Continuous scoring
Posture recalculates as configuration changes. An MFA exclusion added on Tuesday shows up in your score well before next year's assessment would have caught it.
Evidence with provenance
Every artefact carries its source system and a timestamp, which is what makes it acceptable as evidence of operation over a period.
Multi-entity by default
Sites, services, entities and franchises hold their own position. A problem at one location is never averaged away by good performance at another.
Board-ready reporting
Export your standing against any framework at any point in time, with the trend across quarters and the evidence behind it.
Cross-framework mapping
Controls are mapped to every standard they satisfy, so adding a second framework is mostly a question of what is left over.
Ownership that sticks
Gaps carry an owner and the evidence that will close them, so remediation is a task list rather than a report nobody actions.
Integrations
Connect what you already run
Read-only by default, with nothing to install on staff devices and nothing to migrate. Nobody has to learn a new system of record.
Apex Group
Unit registry: investor register, holder identification numbers, unit holdings, application and redemption
Allvue Systems
Deal pipeline and credit approval workflow records
Salesforce Financial Services Cloud
Investor and prospect records including wholesale/sophisticated investor classification flags and certificate
FrankieOne
Per-customer KYC verification results with the data sources used and match confidence
OWNA
Enrolment and waitlist records
AlayaCare
Visit schedules and clock-in/clock-out records showing which visits were actually delivered
Diligent
Board and committee papers, agendas, minutes and resolutions with version history
RiskMan
Incident records with type, severity, date/time of occurrence and date notified
Deputy
Rostered hours against required coverage
Ausmed
Mandatory training requirements set per role, team, facility or provider
Microsoft Entra ID
Privileged role assignments
Amazon Web Services
IAM roles, policies and root account MFA
Trust
Read-only by default. Your data stays yours.
Gwenda is a system that reads your most sensitive configuration. The access model is the product decision that matters most.
Least privilege, always
The narrowest read scope that answers the question, and nothing beyond it.
Configuration, not content
Gwenda reads how systems are configured and who can reach what. It does not read the personal data inside them.
Hosted in Australia
Your data is stored and processed in Australian regions.
Yours to take back
Export everything, revoke every connection, and Gwenda goes quiet.
See it read your actual environment.
Thirty minutes. Connect one system, or watch it run against ours. Either way you will see what it finds and where that sits against the gold standard for your industry.