Your ISMS consultant, right inside the tool.
The AI assistants in WolfISMS know your company. They ask follow-up questions the way a good consultant would, draw on the data you already have and make suggestions that fit you. You keep the decision, WolfISMS takes care of the legwork.
The AI knows your company.
A general AI chat does not know your company and delivers off-the-shelf suggestions. The assistants in WolfISMS draw on what you have already recorded with every request: the company profile from the onboarding dialogue and your registers. That is why their suggestions fit your industry, your size and your risk situation.
Company profile
From the onboarding dialogue: services and customers, locations, crown jewels, IT operating model, interested parties, scope, relevant standards and your rules for risk management.
Your registers
Assets, risks, suppliers, measures, vulnerabilities, incidents, controls and documents, plus your catalogues of threats and vulnerabilities.
Suggestions that fit
The AI links to what already exists in your system instead of creating duplicates, and assesses according to your methodology. You explain things once, and every assistant builds on it.
Eleven assistants that take work off your hands.
Each assistant sits where you are already working: in the asset, the risk, the incident or the document. Under “Uses” you can see which data it draws on.
Onboarding dialogue
Uses: Your answersUploadsStandards
Describe your company in your own words or upload an organisation chart, asset list or company presentation, even as a photo. The AI guides you through the conversation like an ISMS consultant, asks only about what is still missing and agrees the relevant standards with you. The result is the company profile, initial assets, suppliers and risks, and drafts of the scope, the information security policy and the risk management policy.
Your benefit: Instead of weeks of workshops, the foundation of your ISMS is in place after one conversation, and every other assistant knows your company from the start.
Asset assistant
Uses: Company profileAssetsSuppliersRisks
You describe an asset; the AI classifies it according to OBASHI, suggests the protection requirements for confidentiality, integrity, availability and authenticity, and links it to dependencies, suppliers and risks. If a suitable risk is missing, it creates one right away with a reasoned initial assessment.
Your benefit: Your inventory grows complete and linked, instead of as a loose list that someone has to tidy up later.
Risk assistant
Uses: Company profileRisk methodologyAssetsMeasuresCatalogues
You describe a risk in your own words. The AI asks targeted questions, assesses the risk before and after treatment according to your own risk methodology and explains its reasoning. It summarises existing measures and suggests missing ones.
Your benefit: Risk assessments become consistent and traceable, even when they come from different people.
Supplier assistant
Uses: Company profileSuppliersAssetsRisksPublic sources
The AI evaluates uploaded certificates and contracts, sends the security questionnaire if needed and researches public evidence and known security incidents of the supplier itself. It suggests the classification and links the supplier to the assets and risks it affects.
Your benefit: Supplier assessment under NIS2 takes minutes instead of days, and you no longer ask about things that have long been public.
Risk linking
Uses: RisksAssetsMeasuresControlsDocumentsCatalogues
One click, and the AI suggests the matching threats, vulnerabilities, assets, documents, controls and existing measures from your registers for a risk. You choose beforehand which areas it should take into account.
Your benefit: The web of dependencies an auditor wants to see is built in minutes instead of through painstaking manual work.
Measure derivation
Uses: RisksIncidentsMeasures
For risks and incidents, the AI checks which of your existing measures already take effect and suggests the missing ones. Whatever you confirm goes straight into your treatment plan, already linked.
Your benefit: You build on what is already there instead of creating duplicate measures.
Vulnerability search
Uses: AssetsPublic sources
The AI checks the software versions in your asset register for publicly known vulnerabilities (CVE), optionally with research at vendors, the NVD and CERT-Bund. Selected findings are created and assigned to the affected asset.
Your benefit: You find out which of your systems are affected without reading advisories one by one.
Incident assistant
Uses: IncidentsRisksAssetsSuppliersMeasures
The AI classifies an incident by category, priority and cause, checks the reporting obligations under GDPR, NIS2 and the CRA, links it to affected risks, assets and suppliers, and drafts the root cause analysis and improvement measures.
Your benefit: Under time pressure the assessment is quick and complete, and lessons learned are documented instead of forgotten.
Policy assistant
Uses: Company profileStandardsMaster data
Not a template, but your policy: the AI writes or revises it along the requirements of the standards you defined during onboarding, tailored to your company size, your process landscape and your organisation. The draft starts in the policy portal as a “draft” and goes through your usual approval process.
Your benefit: Policies that fit your company and pass the audit, without starting from scratch.
Document linking
Uses: DocumentsControlsProcessesMeasures
The AI reads a document and suggests which controls it implements or evidences, which processes it governs and which documents and measures it refers to.
Your benefit: Your evidence is mapped to the requirements of the standards, and the Statement of Applicability almost fills itself.
Gap assistant
Uses: Company profileStandards
For every requirement on a checklist, the AI explains what it essentially demands, what an auditor looks for and which evidence is common, tailored to your company. A guided dialogue works through the gap analysis requirement by requirement.
Your benefit: You do not need a commentary on the standard beside you to carry out a gap assessment yourself.
AI that you control.
Suggestion, not automation
Nothing is saved without your confirmation. You can edit every suggestion directly before accepting it.
Dialogue, not forms
The AI asks targeted questions instead of presenting empty input screens. Where there are fixed answers, you click instead of typing. Simply upload your organisation chart, asset list or presentation, even as a photo.
Your assessment logic stays
The AI suggests input values such as protection requirements or likelihood. WolfISMS calculates criticality and risk score transparently according to your methodology.
Your AI, your key
Not tied to any language model: you choose the provider, store your own API key and pay for usage directly there. Each tenant works separately.
Built in line with the EU AI Act
The assistants support, they do not decide: every suggestion is labelled as an AI suggestion, and a human reviews and confirms it. WolfISMS is not a high-risk AI system within the meaning of the EU AI Act.
Usable in a GDPR-compliant way
By choosing the provider, you decide where your data is processed: with a provider that processes data in the EU under a data processing agreement, or with a model you run yourself so that no data leaves your premises. WolfISMS does not pass any data to AI services of its own.
Legal assessments by the AI, for example in the legal register, do not constitute legal advice.
An assistant for every phase of your ISMS.
We are extending the AI along the entire ISMS life cycle. The concepts are in place, and so is the order. Every assistant follows the same principle: the AI asks, suggests, and you decide.
Coming next
Build
- Gap-to-action If compliance with a standard is low, the AI shows which measures and documents close the gap fastest, prioritised by impact.
- Cross-standard mapping Implement once, count many times: what you do for ISO 27001, the AI automatically suggests for NIS2, GDPR and the CRA as well.
Record and assess
- Discovery agent An agent on your systems keeps software versions and the asset register up to date automatically, as a basis for the vulnerability search.
Manage suppliers
- Supplier review Regularly checks whether each supplier’s evidence and risks are still current, shows the status as a traffic light and creates the necessary tasks.
Operate and report
- BIA dialogue The AI creates the business impact analysis based on your process map, including recovery times per process.
- Management review report Risks, incidents, audit results and KPIs as a ready-made draft report for your management review.
The AI thinks along in every module.
After the first assistants, we will expand across the board, guided by our customers’ feedback.
Check and evidence
- Control drift: detects measures that have probably stopped working
- Automatically find evidence for a control
- Automatically link audit findings
- Audit plan based on the risk situation and the previous year
- Document review for currency and contradictions
Incidents and crises
- Classify incidents and suggest the matching playbook
- Create playbooks that fit the threat landscape
- Exercise scenarios for BCM tests
- Derive risks from new incidents and vulnerabilities
Law and projects
- Regulatory watch: detect new laws and show the affected documents
- Security-by-design and DPIA screening for projects
- News and breach monitoring for your suppliers
People and access
- Detect critical combinations of permissions
- Recertification: suggest access that is no longer needed
- Derive onboarding and offboarding from the role
- Identify training needs from role and incidents
Steering
- Derive ISMS objectives from risks and the management review
- Ask questions in natural language across all modules
Experience the assistants with your own data.
In a demo, we show you how the AI works in WolfISMS and where it saves you time.