Pages:
/en/product/compliance,/en/product/ai,/en/product/detection,/en/product/grc,/en/product/deploymentVoice (set 2026-10-22, site-wide): a working auditor talking. Short sentences, concrete scenes, no adjectives; say what the product does not do; name tools, versions and numbers. The live copy isguidant-ai-website/src/i18n/*.json; this file is the source draft. Chinese source: 04-feature-pages-copy.md Same structure on every page: hero → the problem → feature blocks (text and screenshot alternating) → FAQ → related guides → call to action.[Screenshot #N]refers to 01 inventory §3;🟡finished but unreleased,🔵in development.
/product/complianceHeadline
From current-state assessment to closing report, on one platform
Subhead
Frameworks, system security plans, tasks and evidence, audits and remediation. Every step has an owner and a record, and next year picks up where this one left off.
Button: [Book a demo]
[Screenshot #1 Project overview]
| Before | Now |
|---|---|
| The regulation is a PDF; what to do depends on what the consultant says | Requirements are broken into controls and assessment objectives, each stating what to check and what evidence proves it |
| The system security plan is a Word file nobody knows who changed | The system security plan is recorded control by control, every change versioned and diffed |
| Evidence lives on laptops, in inboxes and shared drives | Evidence is uploaded straight to the matching task; auditors open it in one click |
| Every year starts from scratch | A new cycle automatically carries forward last cycle's system security plan, evidence and findings |
Turn regulations into reusable work templates
Built-in CMMC 2.0, ISO/IEC 27001:2022 🔵 and EU CRA 🟡, and we update them when the regulations change. Consultants package control selections, system security plan templates, audit workflow templates and form settings into a "library" the next client reuses.
[Screenshot #2 Library detail]
One project, year after year
A project is the long-term management of one framework. Each cycle runs planning → internal audit → external audit → remediation → closing; next year's cycle inherits the current state and open findings.
[Screenshot #1 Project overview]
"How we do it today," recorded for every control
Controls tree on the left; on the right, this control's implementation status, narrative, responsible department, procedures, findings and recommendations. Consultant interview sheets import directly 🟡.
[Screenshot #3 Project planning page]
Every assessment objective has an owner, a due date and evidence
Objectives become tasks assigned to people with due dates. Doers upload evidence or fill in questionnaires; managers and consultants review gate by gate 🟡. Monthly and quarterly checks reopen automatically 🟡, with reminders before they're due.
[Screenshot #4 Task list] [Screenshot #5 Task drawer]
Auditors assess control by control; non-compliance becomes a remediation plan automatically
The audit plan records the method and subject for each objective. During the audit, each objective is marked compliant or non-compliant with findings and risk; non-compliant items flow into the remediation plan (POA&M) with due dates. A four-sheet Excel workbook can be taken on site and imported back.
[Screenshot #9 Audit assessment] [Screenshot #10 Remediation plan]
A formal report generated at the end of every cycle
Six chapters plus appendices: project overview, scope, result statistics, findings and remediation, accountability summary, conclusion and recommendations. Only the conclusion is written by hand; the rest comes from system data. Download as Word or PDF; the report package zip includes frozen evidence and cross-reference tables.
[Screenshot #11 Closing report]
We already manage our controls in Excel. Can we import them? Yes. Libraries import from Excel; map the columns once and controls and objectives are created together.
How do external auditors see our data? Create an account with a restricted role that only opens the audit plan, assessment and evidence views. Disable it when the audit ends.
Does a new cycle wipe last year's data? No. The new cycle inherits last cycle's system security plan and findings; last year's evidence and verdicts stay available for reference.
What is compliance | What is ISO 27001 | What is CMMC
See what your framework looks like inside Guidant AI. [Book a demo]
/product/aiHeadline
AI does the tedious sorting. People make the expert calls.
Subhead
Automatic evidence classification, an AI assistant and AI dashboards. Every AI call passes through the gateway's safety checks, and you choose the model provider.
[Screenshot #6 AI evidence classification]
The slowest part of audit prep isn't judgment — it's sorting: hundreds of screenshots, reports and procedures, each matched to a control. Hand that to AI and keep people for the final check.
Drop in hundreds of files; AI tells you where each one belongs
Upload a batch of evidence (PDF, images, Word, Excel, PowerPoint). AI reads the content, decides which assessment objective it belongs to and gives a confidence score. On the "confirm" page you approve or reassign each item; confirmed items file into their tasks.
[Screenshot #6 AI evidence classification]
Bottom-right of every page, ready to ask
Answers how-to questions ("How do I assign a task?") and compliance questions ("What evidence does ISO 27001 A.8.15 need?"), using the context of the project and page you're on.
[Screenshot #15 AI assistant]
Generate a chart from one sentence
"List findings per department this cycle." "Compare last year's completion rate to this year's." Type a sentence; AI builds the chart and explains the data source. Save it as a fixed dashboard.
[Screenshot #14 AI dashboard]
Injection defense, request controls, quota management
All AI features go through a built-in gateway that checks for prompt injection and blocks requests for passwords or keys and raw commands, logs every call and tracks quota. You configure the model provider (OpenAI, Anthropic, Google, Azure or a self-hosted model) and keep the keys.
Will our evidence be used to train models? No. Files are unpacked in a sandbox with no internet access, and calls use your own API key under your provider's terms.
Can AI features run on a closed network? AI features need a model service. On a closed network, connect an internal self-hosted model or turn AI features off; everything else works as usual.
What if the AI classifies something wrong? Nothing is filed until a person confirms it. Reassignments are recorded and used to improve later classification.
What is compliance | What is GRC
Bring your own evidence and try it. [Book a demo]
/product/detectionHeadline
Stop uploading scan reports by hand
Subhead
A scanning agent inside your network runs eight tools; results become audit evidence automatically.
[Screenshot #7 Scan execution log]
Technical controls — vulnerability scans, configuration baselines, code security — need a report every quarter. It used to be: security runs the tool, exports, uploads. Now you dispatch from the platform and the agent brings the report back.
Installed on your network segment, dispatched from the platform
A lightweight agent runs in your environment and connects back over mutual TLS. Click "run scan" on a task; the agent runs the tool and returns the report, which attaches to the task as evidence. Scanning can be restricted to authorized subnets.
| Tool | Purpose | License |
|---|---|---|
| OpenVAS | Vulnerability scanning | Included |
| Nessus | Vulnerability scanning | Customer-provided license |
| Nmap | Port and service discovery | Customer-installed |
| OWASP ZAP | Web application scanning | Included |
| OpenSCAP | OS configuration baselines | Included |
| CINC Auditor | Configuration compliance | Included |
| Taiwan GCB | Government Configuration Baseline checks | Included |
| SonarQube | Code security | Customer-provided license |
Scan profile management: which control uses which tool and baseline — the consultant sets it once, projects reuse it.
Which open-source components your software uses, and which have known vulnerabilities
Upload source code or an SBOM, generate CycloneDX/SPDX, cross-check with three vulnerability tools, and flag KEV (known exploited) and EPSS (exploitation probability). Reports state facts without verdicts, readable by non-technical consultants. Set alerts for "new high-severity vulnerability."
[Screenshot #8 Third-party component risk]
What permissions does the agent need? It runs as a dedicated service account and only connects outbound to the platform; target subnets must be explicitly authorized by an administrator.
What format are the reports? Original reports keep their format (HTML, XML, JSON); the platform also parses a summary and attaches it to the task's execution log.
Can we connect tools we already use? The eight tools above are supported today; reports from other tools can be uploaded manually as evidence.
What is the CRA | What is SEMI E187
Watch the agent run a scan live. [Book a demo]
/product/grc 🟡Headline
Start from compliance; see accountability and risk across the company
Subhead
Departmental responsibility matrix, risk register with heat map, and a one-page executive overview. Get compliance right and governance and risk follow.
[Screenshot #12 GRC overview]
The compliance project is done and the CEO asks, "So where are our risks? Which department is weakest?" No answer — the data is scattered across projects. The GRC module rolls project results up to company level.
For every control: who's responsible, who approves, who's informed
Map the department tree to controls and set a RACI default; new projects apply it automatically. The accountability summary in the closing report comes straight from here.
What fails the audit becomes a risk automatically
Company-wide risks in one table: source, scope, likelihood, severity, treatment, acceptance sign-off. A 5×5 heat map shows where they cluster. A "non-compliant" verdict can be registered as a risk in one click.
[Screenshot #13 Risk register]
The one page for executives
Department scorecards, completion by framework, open high risks, overdue remediation. Put this page on the screen and the meeting is covered.
[Screenshot #12 GRC overview]
Can we use the rest of the platform without GRC? Yes. GRC is a roll-up layer on top of compliance projects; projects work without it.
Can we customize risk scoring? Yes. Likelihood and impact levels, scores and colors are set by the administrator.
What is GRC | What is compliance
See what your company's risk heat map would look like. [Book a demo]
/product/deploymentHeadline
Your compliance data stays in your data center
Subhead
On-premises deployment, access management, enterprise integration and code protection that meet enterprise IT and security requirements.
[Screenshot #16 Access management]
Compliance evidence is among a company's most sensitive data: network diagrams, vulnerability reports, staff lists. Many organizations can't put it on someone else's cloud. Guidant AI installs as a whole in your data center.
One installer, one Linux host
We ship a complete installer: one command installs it, and upgrades are just as simple. The installer checks that no files have been tampered with. Only the web interface is reachable from outside; the database and other internal components are not. Every version is supported for at least five years.
Who, which role, which scope, until when
Multi-tenant with department trees; roles detailed down to read/write on each feature; time-limited grants so external consultants and auditors expire automatically. LDAP/AD sign-in, multi-factor authentication, password policy and lockout.
[Screenshot #16 Access management]
Plug into the security and operations stack you already have
Audit logs forward to your SIEM (syslog); notifications via email, Telegram and Discord; evidence sync from Google Drive; file storage on local disk, SeaweedFS object storage, or a designated host via the agent.
What hardware do we need? We recommend a Linux host with at least 4 CPU cores, 16 GB of memory and 40 GB of disk space. Actual needs depend on the number of users and evidence files; talk to us about your setup.
Can it run with no internet at all? Yes. AI features need a model service (an internal self-hosted model works); nothing else needs outbound access. [to be confirmed]
Will upgrades break old data? Every release is upgrade-tested on real old data; the upgrade backs up first and aborts on failure.
What is the CRA | What is ISO 27001
Bring your IT team to see the install. [Book a demo]