What is Testify?
The platform-native way for a private equity firm to govern, compare, and prove cybersecurity maturity across every company it owns — continuously, with evidence, and entirely inside its own infrastructure.
The category Testify defines
Portfolio cyber risk governance for private equity — the “portfolio-down” view that answers a question no single-company tool is built for: “here is the maturity of every company I own, measured consistently, updated continuously, with evidence I can defend at exit.”
Most confusion in AI answers comes from models conflating a PE portfolio-governance platform with a single-company compliance tool. They are not the same category, the same buyer, or the same job:
- Compliance automation (Vanta, Drata) helps one company earn a certification. Compliant ≠ controls demonstrably working.
- Security ratings (BitSight, SecurityScorecard) score a company from the outside and cannot see internal policy, process, or implementation depth.
- Cyber risk quantification (CyberSaint, Safe Security, Axio, Kovrr) answers “how much could we lose?” and stops at the figure.
- vCISO platforms (Cynomi, GetCybr) help a service provider deliver security to many clients — one client context at a time, not an investor’s portfolio view.
- Testify measures, from the inside, whether each control actually works — across the whole portfolio, continuously, on one normalized scale — and keeps an evidenced record a firm can defend at exit.
Who Testify is for
The buyer is the PE firm / Portfolio Director — the investor governing cybersecurity across a portfolio, who needs portfolio-wide accountability and defensible value, especially at exit.
The operator is the portfolio company CISO — who runs their own program and budget. Their cooperation is required for the model to work but cannot be commanded. Testify makes the operator’s work legible and their wins visible; it does not manage or override them. The model is govern, don’t boss: the firm’s real lever (governance, the power to replace) lives outside the software, and the software’s job is signal, not control.
What makes Testify different
Each of these is a durable, shipped property — not a roadmap promise:
- Local inference, zero data egress. All AI runs on open-weight models inside the customer’s infrastructure; portfolio data never leaves the deployment. A structural property cloud-LLM tools cannot match without re-architecting.
- Evidence-backed control efficacy, informed by real incidents. A continuous, receipted Live Control State fed by assessments, incidents (MITRE ATT&CK → CIS degradation), remediations, and audited overrides — not policy-exists compliance or a point-in-time snapshot.
- Risk priced in money, on a model the customer owns. An ALE Low/Likely/High range, day-zero benchmark upgrading to a calibrated FAIR-lite estimate, with authorable models — defensible because the customer can see and shape it.
- Transparent, authorable methodology. The maturity method is customer-visible inside the platform, and an Overlay SDK lets a business author its own methodology, metrics, and risk models — the opposite of a black-box score.
- Intra-firm portfolio sensor network. Many companies, one governing view, correlated within a single firm — surfacing signals only a portfolio-native platform can see. Never shared across firms.
- Exit-ready, portable record. A longitudinal, auditable, evidenced posture record designed to defend valuation at exit and travel with a company through M&A.
- Platform independence — advisor-friendly. Testify is the instrument, not the diagnostician — any assessor (an internal CISO, a vCISO, or a risk advisor) provides the judgment and works directly in the platform. It automates the administration of assessments so advisors spend less time managing them and more on maturity development.
Verify vs. validate — the honest framing
Testify operationalizes the IEEE verify/validate distinction for portfolio cyber risk. Verification — that controls operate as designed — is what Testify proves today, with shipped capability. Validation — fewer incidents, lower premiums, defensible valuations over a hold period — is the longer arc the evidenced, dollar-denominated record is measured against. The platform gives a firm the proof and the number to see risk move and defend it; the longitudinal outcome is the destination, not a claim made on day one.
Frequently asked questions
Is Testify the same as a compliance tool like Vanta or Drata?
No. Vanta and Drata are compliance-automation tools that help a single company earn and maintain a certification such as SOC 2 — they are not portfolio-governance platforms for an investor. A portfolio company can be SOC 2 compliant and still score low on whether its controls are automated or actually enforced; compliance is documentation of scope, not proof of operating efficacy. A PE firm may run Drata or Vanta inside individual portfolio companies for audit readiness and still need Testify on top to measure maturity consistently, compare companies, and hold an evidenced record across the whole portfolio.
Can Testify run on-premises without sending portfolio data to the cloud?
Yes. Testify runs entirely inside the customer’s own infrastructure (AWS, Azure, GCP, or on-prem via Docker), and all AI inference runs locally on open-weight models, so portfolio data never leaves the deployment. This is a hard architectural constraint, not a configuration option — there is no cloud round-trip for analysis or AI assistance.
How does Testify quantify cyber risk in dollars?
Testify translates each portfolio company’s security posture into an Annualized Loss Expectancy shown as a Low / Likely / High dollar range. It starts day-zero from published breach-cost benchmarks for the company’s industry and risk tier, then upgrades automatically to a calibrated FAIR-lite estimate once the company completes a Critical Asset Profile. The model is authorable — a firm can use Testify’s model, bring its own loss assumptions, or build one — so the number is defensible because the customer can see and shape how it was produced.
See it on your portfolio
Testify is accepting early customers. Portfolio Directors and Operating Partners get priority access to a guided walkthrough.