Defensibility as a Service · for evidence-sensitive SMEs
If you were breached tomorrow,
could you prove your cyber insurer should pay?
Most companies don't fail at security. They fail at proof.
Axulu helps you see, close, and defend the evidence gaps before
the insurer, regulator, or board ever ask.
Free 12-minute diagnostic · No credit card · Senior-led, not script-led
How Axulu works
From "we think we're covered" to "we can prove it."
Four moves. Senior-led. Evidence-first.
Each step ends with something signed, shareable, and stress-tested.
Step · Check my policy
01 / 04
Upload your policy. See what it would actually demand.
Your cyber insurer expects evidence — not intentions. Axulu reads your
wording line-by-line and surfaces every obligation, exclusion, and
condition you'd need to prove on the worst day of your business.
Policy parserObligation mapExclusion registerDenial-vector list
Live · policy analysiscyber-policy-2026.pdf
cyber-policy-2026.pdf
2.4 MB · 14 pages · parsed in 8.2s
✓ Parsed
MFA required for all usersEvidence partial
Quarterly backup restore testNot provable
Endpoint protection — all endpointsEvidence on file
72-hour breach notification planUndefined
No unsupported operating systems2 found
Step · Defensibility diagnostic
02 / 04
Every obligation tested. Every gap visible.
A senior architect (not a checklist factory) maps every policy
requirement against every piece of evidence — what exists, what's
missing, what's stale, and which gap puts your claim at most risk.
No restore-test evidence for the last 12 months · 2 unsupported endpoints in scope
Survivable gaps
MFA enforcement signed for 94% of users · 6 to escalate
What's defensible
Endpoint protection deployed and logging · Access reviews on quarterly cadence
Step · 7 year plan
03 / 04
See cost, risk, and certification before they surprise you.
Forward visibility, not a static roadmap. Every asset, control, and
warranty plotted across seven years — toggle a decision (extend, replace,
migrate, accept) and watch cost and risk curves move in real time.
No more "we thought IT had that." Each material decision is logged,
owned, dated, and reviewable — so when scrutiny starts, you have an
audit trail that's reasonable, evidenced, and defensible.
Signed decision logAccepted risk registerEvidence freshnessBoard pack export
Defensibility score
73/100▲ +18 since baseline
19 of 23 controls evidenced · last verified 3 days ago
Recent certified decisions
MFAEnforced for finance team · accepted by CFOWorked
Cyber claims. Regulator reviews. Customer security questionnaires. Tender qualifications.
The conversation you've been avoiding — defended.
FCA · Cyber renewal · Defensibility check
If our underwriter walked in tomorrow, what evidence could we hand over?
Claim simulation
Strong defensibility · 19/23 controls evidenced
3 critical gaps, 1 survivable, fixable inside 30 days
83%
Critical risks
Unsupported Windows Server 2012 in payroll segment · backup restore tests not evidenced for 14 months · two FCA-relevant roles missing access reviews.
Survivable gaps
MFA enforcement signed for 94% of users; 6 senior accounts on grace period. Vendor risk register exists but not refreshed against insurer schedule.
What's already defensible
Endpoint protection deployed across estate with central logging. Identity tenant locked-down, joiners/movers/leavers automated. Quarterly access attestations on file.
What we'd certify next
Restore-test cadence with logged outputs · two-track decommissioning plan for legacy segment · evidence-freshness alerting in HubSpot for renewal cycle.
Five outcome layers
5 layers of defensibility.
Each layer shapes a different kind of evidence. Smart Setup picks the layer
you need first — or your senior advisor will.
Hover the avatars below.
Axulu's outcomes are senior-led — same judgement that scaled Flywheel
from start-up to £12m, across 40 client estates, M&A integrations,
TOGAF-grade architecture, and decades of regulated-sector experience.
Matthew — Principal & founder
30 years across IT strategy, enterprise architecture, M&A integration,
cyber policy interpretation, vCIO work, and AI-native operating design.
Behind every Axulu engagement is a senior architect — not a script,
not a checklist, not a junior in a suit.
TOGAFCIO/CTO operatingvCIO · 40+ estatesFlywheel · scaled to £12mM&A integrationRegulated sector10-Year Plan methodologyAI-native delivery
What makes us different
More than just a checkbox.
Most cyber providers sell controls. Axulu sells the evidence those
controls actually existed when scrutiny started.
Evidence Hub
Every claim, dressed in its proof.
Stop scrambling through email threads when the insurer asks. Each control,
obligation, and accepted risk is hung against its evidence with date, owner,
and source. Generate the claim pack in one click.
Auto-refreshes from your stack · Audit trail on every artefact
Certified Decisions
Build the advisor you need.
Every material risk decision logged, signed, dated. No more "we thought IT
had that." Defensibility starts with knowing who decided, when, and why.
Director-signed · Quarterly review cadence
Multi-sector
Your sector. Your wording.
Construction supply chain, regulated finance, legal, education.
Axulu speaks each sector's language — FCA evidence, ISO 27001 control
mapping, supplier assurance — natively, not as a translation.
Your context
Your policy. Your wording.
Upload the policy, the MSP contracts, the supplier register. Axulu
references them throughout — no generic templates, no
scary-but-irrelevant findings.
Integrations
Plugs into what you already run.
Microsoft 365, Intune, your MSP's RMM, HubSpot, Sharepoint, Jira.
Axulu reads from your stack so evidence freshness updates itself —
no rip-and-replace required.
Pricing
Three ways to start. One way to scale.
Begin where the pain is loudest — claim defensibility — and expand into
Titanium, Plan, and Supercharge as the base stabilises.
Defensibility Snapshot
A 12-day deep diagnostic. Find out where you stand, signed off by a senior architect.
What boards, MSPs, and finance directors ask before signing.
How is Axulu different from my MSP?
Your MSP runs your tickets and tools. Axulu runs your evidence.
MSPs are paid to fix things; we're paid to prove the things that were
true on the day a breach started. We don't compete with your MSP — we
sit above them and make sure the controls they implement actually
satisfy your insurer, your auditors, and your board.
Do you sell cyber insurance?
No. We're not a broker and we don't sell indemnities. We help you read,
interpret, and evidence the cyber policy you already have so it pays
out when it has to. Your broker stays your broker; we make their job
easier.
What does "evidence-sensitive SME" mean?
Any business where someone might one day ask "prove it": an FCA-regulated
finance firm, a construction tier-1 supplier with security questionnaires,
a law firm handling sensitive matters, an education group under DfE scrutiny,
a healthcare provider, an acquirer in due diligence, a tenderer for public
contracts. If your customers, regulators, or insurers expect proof — you're
evidence-sensitive.
What if my environment is a mess?
Most are. The Defensibility Snapshot tells you exactly how messy, in
plain English, and prioritises the gaps that actually move claim risk —
not the ones that just look bad on a slide. Then Titanium standardises
the base.
Is this just a consulting engagement?
No. We sell outcomes, not bodies. Consulting is the bridge to a
software-like service: the Snapshot is fixed-scope and fixed-price,
the Retainer is recurring with measurable evidence coverage, and every
repeated motion becomes more automated as we go. You'll see senior
humans where judgement matters — and software where it doesn't.
Who reviews our policy?
A senior architect with three decades of operating-leadership experience
— TOGAF-grade, CIO/CTO operating, vCIO across 40+ regulated estates.
The diagnostic is AI-assisted, not AI-only. You'll never get a
junior consultant on a script.
What if our data is sensitive?
We operate under UK data residency, with a per-engagement NDA, ISO-aligned
handling, and the ability to work entirely inside your tenant if required.
Policy uploads can be redacted before parsing; evidence stays inside your
Microsoft 365 or your equivalent.
CIOCTOARCH
Your next renewal deserves a defensible answer.
12 minutes. Free. Senior-led. You'll walk away knowing exactly where you stand.
