Cyberwatch Advanced — Proactive Advanced Security: What You Get

Audience: CEO, CFO, CSO/CISO, CIO, General Counsel, Owners, and Board Members

Author: Northern Data Solutions, Office of the CTO

Service Line: Cyberwatch Advanced — Proactive Advanced Security: the complete platform portfolio

Purpose: A single-page summary of every platform in the Proactive Advanced Security program, what each one removes from your risk register, what it proves to an assessor, and which components are included in your subscription versus which carry additional fees.

“Proactive Advanced Security transforms security from a burden into an enabler — making best practices easier for employees while dramatically reducing organizational risk.”

1. Executive Summary

Knowing your risks is only the start. Cyberwatch finds the exposures through third-party penetration testing, validation, and vulnerability identification. Cyberwatch Advanced — Proactive Advanced Security is the program that closes them. It is not a single product; it is an engineered portfolio of fourteen platforms that together enforce Identity and Access Management with adaptive MFA, the Principle of Least Privilege, Zero Trust Architecture, attack-surface visibility, password management and rotation, sensitive-data governance, 24/7 detection and response, and workforce security training with attestation.

Eleven of those fourteen platforms are included in your Cyberwatch Advanced subscription. Three — CyberVault Enclave, CyberCloud, and CyberNeQter — carry additional fees, because each provisions dedicated, regulated-data infrastructure or a full governance platform on your behalf. Every platform in the program, included or add-on, is delivered as a managed service: Northern Data Solutions provisions it, tunes it, operates it, and hands you the evidence.

Your subscription also includes something most buyers expect to pay for separately: the complete Cyberwatch Maturity Program — quarterly Level 3 third-party penetration testing and comprehensive assessment, monthly external vulnerability scanning, the proprietary scanning toolkit, dark-web breach detection, and the full ten-report evidence suite. Enforcement and independent verification are one purchase, not two.

Figure 1 — The five layers of Proactive Advanced Security, resting on the included Cyberwatch Maturity Program. Several platforms appear in more than one layer because their evidence serves more than one purpose.

2. What Proactive Advanced Security Actually Is

Most security spending is reactive: a finding or a near-miss triggers a purchase, and the organization accumulates tools that do not talk to each other and evidence nobody can assemble on demand. Proactive Advanced Security inverts that. It begins from the assumption that an attacker is already probing your perimeter, that a credential of yours is already for sale, and that the next assessment is already scheduled. Every platform is selected to remove a standing condition attackers rely on, and to emit evidence as a byproduct of doing so. You are not buying alerts — you are buying the elimination of the conditions that generate them, and the documentation that proves it.

The program rests on four commitments: continuous rather than point-in-time, because an annual pen test is stale for 350 of 365 days; removal of standing privilege, because standing admin rights and static shared passwords are what ransomware operators depend on; evidence as a byproduct, because a control that produces no exportable artifact is not finished; and fully managed delivery, because you are buying an outcome our team operates, not a license you must staff.

3. What Is Included, and What Carries Additional Fees

This is the question every executive asks first, so it is answered up front and without qualification. Eleven platforms are included in the Cyberwatch Advanced — Proactive Advanced Security subscription. Three carry additional fees: CyberVault Enclave, CyberCloud, and CyberNeQter — priced separately because each provisions dedicated infrastructure or a full governance platform sized to your data volume, user count, and regulatory scope. They are not per-seat software; they are environments.

Note what sits on the included side of that line: not only eleven platforms, but the entire Cyberwatch Maturity Program described in the next section. That is the recurring third-party assessment engagement most organizations budget for as a separate annual line item.

Figure 2 — The commercial line. Eleven platforms are included; three provision dedicated regulated-data infrastructure or a full governance platform and are quoted separately.

4. Included at No Additional Cost: The Cyberwatch Maturity Program

Before the platform list, the single largest line of value in the subscription. Your Proactive Advanced Security subscription includes the full Cyberwatch Maturity Program — the recurring, independent, third-party assessment program that is normally purchased as a standalone engagement and that most providers will quote you separately. You are not buying enforcement tooling and then paying a second time to learn whether it worked. Identification and enforcement arrive together, on one subscription, operated by one team.

This matters more than any single platform, because a control nobody independently tests is an assumption. Internal IT departments and incumbent managed service providers cannot objectively grade work they designed and maintain — familiarity, operational pressure, and unavoidable bias make it structurally impossible. The Cyberwatch Maturity Program supplies the outside-in validation that closes that gap, and every report is individually reviewed by a third party before it is delivered. Cyberwatch also carries errors-and-omissions coverage for network auditing, an explicit liability protection most assessment providers do not offer.

Figure 3 — The Cyberwatch Maturity Program, included in the Proactive Advanced Security subscription at no additional cost.

4.1 The Four-Stage Maturity Path

The program is engineered as a progressive path so an organization can enter at the right level and graduate as its program matures. Level 1 is a ground-floor snapshot run by sending a link to three to five users — no passwords, no privileged access — and it consistently surfaces live exposures such as cracked credentials, dark-web listings, and Microsoft 365 misconfigurations. Level 2 covers at least ten percent of devices and adds a credentialed analysis of Microsoft 365, producing the project-plan-grade baseline an IT team can execute against. Level 3 is the compliance- and insurance-grade engagement: credentialed penetration testing using an insider-threat or supply-chain vector, at least ninety percent of devices, and full credentialed Microsoft 365 analysis. Level 3 delivered quarterly is what your subscription includes. The fourth stage is Cyberwatch Advanced itself — the enforcement layer described in the rest of this article.

4.2 Why the Testing Targets People First

The methodology is grounded in two numbers. Roughly 91 percent of cyberattacks begin with a phishing email, which places the attacker inside the organization without ever touching the perimeter, and roughly 19.8 percent of employees click — about one in five. Internal testing therefore deliberately targets the people most likely to be phished and most consequential when compromised: chief executives, chief financial officers, directors, human resources staff, and the sales team, all of whom correspond constantly with outsiders and carry the highest financial, legal, and reputational exposure.

Outcome: continuous, independent, underwriter-accepted proof that the enforcement controls in this program are working — satisfying the periodic risk-assessment and continuous-monitoring expectations of CMMC and NIST 800-171, FTC Safeguards §314.4(d) and §314.4(e), PCI DSS Requirement 11, and the assessment-frequency question every cyber-liability underwriter now asks. Full detail is in the Cyberwatch Maturity Program executive briefing.

5. The Eleven Included Platforms

5.1 Cyberwatch-NZ — Continuous Autonomous Penetration Testing

An annual penetration test is a photograph of a moving object. Your network changes weekly, so the report is stale for roughly 350 of the 365 days you rely on it. Cyberwatch-NZ runs an autonomous attack engine against your live production environment as often as you want — internal, external, cloud, Kubernetes, and Active Directory password audits, all on one subscription, with no per-test fee to discourage you from running it.

Outcome: a continuously current, evidence-backed answer to “can someone actually get in, and how far?” — satisfying CA.L2-3.12.1, CA.L2-3.12.3, RA.L2-3.11.2, RA.L2-3.11.3, NIST 800-53 CA-8 and CA-8(1), FTC Safeguards §314.4(d), PCI DSS 11.3.1, 11.3.2 and 11.4.2–11.4.6, and SOC 2 CC4.1, CC7.1, CC7.2.

5.2 Cyberwatch-NZ WebApp — Authenticated Web Application Penetration Testing

Network testing stops at the login page. Your customer portal, partner extranet, and internal business applications live behind it, and that is where broken access control and insecure direct object reference live — flaws that carry no CVE, no CVSS score, and no patch, and that a scanner will never see. Cyberwatch-NZ WebApp authenticates as a real user, crawls single-page applications, REST, SOAP, and GraphQL endpoints headlessly, and pauses for MFA so the credential never leaves your control.

Outcome: application-layer risk that scanners structurally cannot find, mapped to PCI DSS 6.2.4, 6.4.1, 6.4.2, 11.4.2–11.4.4, FTC Safeguards §314.4(c) and §314.4(d), CA.L2-3.12.1, CA.L2-3.12.3, RA.L2-3.11.2, NIST 800-53 CA-8, CA-8(1), SA-11, and SOC 2 CC6.1, CC7.1, CC8.1.

5.3 Cyberwatch-WX — Sensitive Data Discovery & Classification

You cannot protect, encrypt, restrict, or report on data you have not found. In most mid-market environments, regulated content — PCI cardholder data, PII, PHI, CUI, and FCI — has quietly spread into file shares, mailboxes, collaboration sites, and personal drives over years of ordinary work. Cyberwatch-WX scans structured and unstructured repositories, classifies what it finds against regulatory categories, correlates each file with who actually has access to it, and surfaces the combinations that matter most: sensitive data exposed to everyone, or sitting in locations nobody knew existed.

Outcome: a defensible data inventory and the scope-reduction map that makes every other control cheaper — the foundation for CMMC and NIST 800-171 CUI and FCI boundary definition, PCI DSS 4.0 scoping, the FTC Safeguards Rule data-inventory requirement, and HIPAA and state privacy obligations.

5.4 CyberSecureID IAM — Identity, Adaptive MFA, and Zero Trust

More than eighty percent of breaches involve a compromised credential, which makes identity the real perimeter. CyberSecureID delivers single sign-on across more than 7,000 application connectors, phishing-resistant FIDO2 and WebAuthn authentication, and adaptive MFA that weighs device posture, impossible travel, and live threat intelligence before it decides how hard to challenge a login. Role-based just-in-time privileged access and full joiner-mover-leaver lifecycle automation mean access is granted by policy and revoked automatically — not by a help-desk ticket somebody forgot to file.

Outcome: identity as an enforced control rather than an assumption, covering CMMC AC, IA, AU, and SC families, NIST 800-171 3.1.x, 3.3.x, and 3.5.x, NIST CSF 2.0 PR.AA, FTC 16 CFR 314.4(c)(5), PCI DSS Requirements 7, 8, and 10, HIPAA 164.308 and 164.312, SOC 2 CC6, ISO 27001 A.5.15–A.5.18, GDPR Article 32, and CIS v8.1 Controls 5, 6, and 8.

5.5 CyberSecureID Desktop MFA — The Console and RDP Gap

Cloud MFA protects your applications, and then someone sits down at a workstation, types a password, and is inside your network with no second factor at all. The same gap applies to Remote Desktop, the single most common ransomware entry point. CyberSecureID Desktop MFA extends multi-factor authentication to the Windows, macOS, and Linux login itself, including RDP sessions — and, critically, it works offline, using an encrypted cached factor, so a laptop on an aircraft or a machine on an isolated network is still protected.

Outcome: closure of the console and RDP MFA gap that assessors now specifically probe — IA.L2-3.5.3[b], NIST 800-171 3.5.2 and 3.5.3, PCI DSS 8.3.1 and 8.3.2, and FTC Safeguards §314.4(d).

5.6 CyberElevate — Local Admin Removal and Just-in-Time Elevation

Standing local administrator rights are the single most abused foothold in modern attacks. When a user runs as an administrator, a single click on a malicious file hands the attacker full control of that machine and often the network beyond it. Organizations tolerate the risk because removing admin rights breaks daily work and floods the help desk. CyberElevate removes the standing privilege while preserving the productivity: elevation is granted just-in-time, per application and per action, by policy, in an MFA-validated session that expires when the task is done.

Outcome: a stolen user credential can no longer elevate — enforcing NIST 800-171 3.1.5, 3.1.6, 3.1.7, 3.1.12, the 3.4.6–3.4.9 least-functionality family, and 3.3 audit accountability, plus PCI DSS least-privilege and privileged-action logging, the FTC Safeguards access-control mandate, and the CIS Controlled Use of Administrative Privileges and Application Control benchmarks.

5.7 CyberQP — Automated Privileged Password Rotation and JIT Accounts

CyberElevate governs what a logged-in user may do. CyberQP governs the privileged accounts themselves — the local administrator credential that is identical on every machine, the service account nobody dares rotate, the shared admin password in a spreadsheet that a departed technician still remembers. CyberQP rotates those credentials automatically on a schedule and after every single use, so a stolen password is worthless within minutes, and every machine carries a unique value so one compromise does not become fleet-wide compromise.

Outcome: the two conditions attackers depend on — credentials that stay valid and admin accounts that are always available — are both removed, with audit evidence for CMMC 2.0 and NIST 800-171 Access Control 3.1 and Identification and Authentication 3.5, PCI DSS Requirements 7 and 8, the FTC Safeguards Rule, and the privileged-access controls underwriters now require for coverage.

5.8 CyberGuard — Attack Surface Management and Configuration Change Detection

Between a quarterly vulnerability scan and an incident-response call, there is a long silence. CyberGuard fills it. It continuously discovers and inventories what you actually expose — cloud tenants, endpoints and servers, domains and DNS, SaaS applications, firewalls and their configurations, and identity and SSO infrastructure — and then it watches for change. A new port opened, a storage bucket made public, a firewall rule loosened, an MFA policy relaxed: each is detected in near real time, scored for risk, alerted, and tracked to closure.

Outcome: a continuously accurate inventory and a change ledger for your external and internal attack surface, feeding the asset-inventory and configuration-management expectations of every framework you report against.

5.9 CyberSOC — 24/7/365 Managed Detection and Response

Attackers move laterally in under an hour and they do not keep business hours. Dwell time — how long an intruder operates before being caught — is the single largest driver of breach cost, and an alert that waits until Monday morning is not a control. CyberSOC provides a staffed security operations center around the clock, with behavioral analytics, managed detection and response that can isolate a compromised host immediately, SIEM log collection and retention, and monitoring extended into Microsoft 365 and your cloud tenants.

Outcome: detection and containment measured in minutes rather than months, producing the continuous-monitoring and incident-response evidence required by CMMC Levels 1 and 2, NIST 800-171 families 3.3 (Audit and Accountability) and 3.6 (Incident Response), PCI DSS Requirements 10 and 12.10, the FTC Safeguards Rule, and the CIS Controls.

5.10 CyberMARC — Email Authentication and Anti-Spoofing

Anyone on the internet can send email that appears to come from your domain unless you stop them, and business email compromise remains the most financially damaging attack category by a wide margin. CyberMARC is managed SPF, DKIM, and DMARC: we flatten SPF records to stay under the ten-lookup limit that silently breaks enforcement, rotate DKIM keys, and walk your DMARC policy from monitoring through quarantine to full reject without stranding legitimate mail. MTA-STS, TLS-RPT, and BIMI round out the posture.

This is no longer optional. PCI DSS v4.0 Requirement 5.4.1 became mandatory on 31 March 2025, and Google, Yahoo, and Microsoft now enforce authentication on bulk senders at roughly 5,000 messages per day and up — unauthenticated mail increasingly does not arrive at all.

Outcome: your domain stops being a free impersonation tool, your legitimate mail lands, and you satisfy PCI DSS 5.4.1, the FTC Safeguards Rule, and the System and Communications Protection and System and Information Integrity families of CMMC and NIST 800-171.

5.11 CyberITDoc — SOC 2-Aligned IT Documentation

Every framework assessment ultimately becomes a documentation exercise, and most organizations fail that exercise not because the control is missing but because the proof is scattered across a wiki, a shared drive, three inboxes, and one engineer's memory. CyberITDoc is a version-controlled, encrypted, audit-trailed documentation vault for network diagrams, runbooks, configurations, credentials-adjacent records, and procedures — with secure internal and external collaboration so the evidence can be shared without being copied into the open.

Outcome: the artifact layer that makes SOC 2 Type II, ISO 27001, HIPAA, and PCI DSS 4.0 assessments survivable — and that keeps institutional knowledge in the company rather than in an individual.

6. The Three Platforms That Carry Additional Fees

These three are separated from the included tier for a straightforward reason: each one stands up dedicated infrastructure or a full governance platform on your behalf, sized to your data, your users, and your regulatory scope. They are not add-on features. They are environments and programs, and they are quoted accordingly. They are also, for organizations in the Defense Industrial Base or handling significant regulated data, frequently the difference between holding a contract and losing it.

6.1 CyberVault Enclave — Hyper-Secure Encrypted Storage and Collaboration (additional fee)

SharePoint folders, generic file-sync tools, and consumer-grade collaboration platforms were not engineered to hold Federal Contract Information, Controlled Unclassified Information, ITAR-controlled data, PHI, or cardholder data — and under assessment they do not hold up. CyberVault Enclave is purpose-built for that content: AES-256 encryption at rest and TLS 1.2/1.3 in transit under FIPS 140-2 validated cryptography, with Digital Rights Management that survives download; ransomware protection, antivirus and ICAP scanning, and a rule-based Smart DLP engine; native Active Directory, LDAP, SAML, and SSO integration with NTFS-aware role-based access and MFA through CyberSecureID; tamper-proof immutable audit logs with smart content classification and automated retention; granular internal and external sharing with watermarking, download control, and branded portals; and centralized device inventory with remote wipe and a lost-device kill switch.

The headline number for a compliance program is this: CyberVault Enclave directly satisfies 42 of the 110 NIST 800-171 controls, across the Access Control, Audit and Accountability, Identification and Authentication, Media Protection, and System and Communications Protection domains. Those forty-two are among the most labor-intensive to evidence by hand. It deploys as a FedRAMP-aligned cloud environment on AWS, as a self-hosted enclave in your own data center, private cloud, or AWS GovCloud tenant, or as a hybrid of the two.

Outcome: regulated data lives in one governed, encrypted, auditable place from day one — forty-two controls arrive pre-packaged, external collaboration stops being your leakage path, and the cyber-liability question about data segregation gets an honest yes.

6.2 CyberCloud — Full Encrypted Enclave for CUI and CMMC Level 2 (additional fee)

Where CyberVault protects the files, CyberCloud protects the environment. It is a dedicated, pre-hardened cloud enclave in which CUI is stored, processed, and transmitted — aligned to CMMC 2.0 Level 2, NIST SP 800-171, DFARS 252.204-7012, and ITAR — with identity- and MFA-gated access, an isolated compliance boundary, encryption at rest and in transit, and continuous monitoring and logging built in.

Outcome: a defensible, assessable CUI boundary — and a dramatically smaller, cheaper, faster path to CMMC Level 2 certification.

6.3 CyberNeQter — Unified SIEM and GRC (additional fee)

Security monitoring and compliance governance are two halves of one job, and they are almost always bought from two vendors and reconciled by hand at audit time — which is exactly where findings hide. CyberNeQter collapses them into one platform purpose-built for the Defense Industrial Base and regulated mid-market: SIEM log collection, correlation, and retention on one side; built-in gap assessment against all 110 NIST 800-171 controls, System Security Plan authoring, Plan of Action and Milestones tracking, vulnerability scanning, and asset inventory on the other — sharing the same data.

Outcome: one system producing both the protection and the proof — mapped to all 110 NIST 800-171 controls, DFARS 252.204-7012 and the current SPRS score behind it, the FTC Safeguards risk-assessment and monitoring mandates, and PCI DSS Requirements 10 and 11.

7. Coverage Across the Attack Chain

A useful way to judge a security program is not to count its products but to walk an attacker through it. Below is the path a real intrusion follows, and the platform that intervenes at each step. The point of the portfolio is that there is no stage at which an attacker gets a free pass.

8. Compliance Framework Coverage

Every platform in the portfolio was chosen because it produces evidence, not just protection. The matrix below shows which frameworks each platform contributes to directly. Read it the way an assessor will: each filled cell is an artifact you can produce on demand rather than a narrative you have to defend.

8.1 A Word on Evidence Versus Interpretation

Control mappings in this article describe how each platform supports a requirement. They are our professional interpretation, not a certification. No tool makes an organization compliant; an assessor does, after reviewing your implementation, documentation, and operating discipline. What the portfolio guarantees is that when the assessor asks for proof, the proof exists, it is current, and it is exportable — and that Compliance-as-a-Service and your VCSO translate it into the language your framework, prime contractor, or underwriter expects.

9. How It Works Together: Find, Fix, Verify, Prove

Individual platforms are not the product. The loop is. Cyberwatch identifies the risk, Cyberwatch Advanced eliminates it, Cyberwatch returns to confirm the elimination held, and Compliance-as-a-Service converts the whole cycle into evidence. Nothing in this program is a one-time event.

10. What Deployment Looks Like

Nobody deploys fourteen platforms at once, and nobody should. The sequence below is the order we recommend in nearly every engagement, because each phase makes the next one cheaper and lower-risk. Most mid-market organizations complete Phases 1 through 3 within a quarter.

Figure 4 — The recommended four-phase sequence. Each phase reduces the cost and risk of the phase that follows it. Phases overlap deliberately. Northern Data Solutions runs the deployment; your team approves policy and reviews outcomes.

11. What This Does for Your Cyber Liability Position

Cyber-insurance underwriting has changed faster than most executives realize. The application is now a technical control questionnaire, and answering it inaccurately is a coverage-rescission risk rather than a paperwork risk. Underwriters ask specifically about MFA on remote access and privileged accounts, elimination of standing administrative rights, privileged credential rotation, endpoint detection and response with 24/7 monitoring, email authentication, encrypted and segregated sensitive data, and penetration-testing frequency. Proactive Advanced Security answers every one of those questions affirmatively and with evidence attached. Organizations that implement mature identity and Zero Trust controls have seen premium reductions in the range of ten to thirty percent, and IBM's breach-cost research consistently associates mature identity and access management with $1.5–2 million in avoided cost per incident. The larger benefit is subtler: when you can attach artifacts to your application rather than attestations, you move out of the pool of applicants underwriters assume the worst about.

12. Recommended Next Steps for the Board

Direct your IT or security leadership to take four actions. First, schedule the first quarterly Cyberwatch Maturity Program assessment — it is already included, so the only cost of delay is the blind spot it would have closed — and commission the accompanying baseline — third-party penetration testing, attack-surface discovery, and a sensitive-data scan — so the conversation starts from evidence rather than assumption. Second, approve the Phase 2 identity and privilege rollout, because removing standing administrative rights and phishing-resistant MFA deliver more risk reduction per dollar than anything else in the portfolio. Third, decide explicitly whether your regulatory exposure — CUI, FCI, ITAR, PHI, or cardholder data — justifies the CyberVault Enclave, CyberCloud, and CyberNeQter add-ons; for Defense Industrial Base contractors facing CMMC Level 2, the answer is almost always yes, and the cost of deciding late is contract eligibility. Fourth, require that the evidence artifacts from this program be reviewed at every governance cycle alongside financial reporting, with your VCSO presenting the risk-reduction trend.

13. The Bottom Line

Cybersecurity fails in the gaps — between the test and the fix, the policy and the enforcement, the control and the proof. Proactive Advanced Security is engineered to have none: fourteen platforms, each closing a specific and provable exposure, each operated by Northern Data Solutions, each emitting the evidence your frameworks, your primes, and your underwriters demand. Eleven are included, as is the entire Cyberwatch Maturity Program that independently verifies them. Three — CyberVault Enclave, CyberCloud, and CyberNeQter — carry additional fees because they stand up dedicated regulated-data infrastructure and governance sized to your scope.

This program does not stand alone. Cyberwatch — third-party penetration testing, validation, and vulnerability identification — finds the risk and returns to prove it stayed closed. Cyberwatch Advanced — Proactive Advanced Security is the enforcement layer described in this article: identity and access management with adaptive MFA, the Principle of Least Privilege, Zero Trust Architecture, attack-surface visibility, password management and rotation, and the cybersecurity training platform that carries employee attestation. Compliance-as-a-Service runs your compliance program continuously so the evidence is never more than a click old. And your VCSO owns the posture, sets the priorities, and tells the risk-reduction story to your Board in the language leadership actually uses.

To review which platforms are active in your environment today, which are included and waiting to be turned on, and whether the regulated-data add-ons belong in your program, contact Northern Data Solutions, Office of the CTO, or your Cyberwatch Advanced account team.