Why we built CyberTwin.
CyberTwin is the security decision engine: it reads the configs you upload, maps the attack paths they open, and labels which findings are proven and which are modeled — across 24 frameworks.
- (01)Commission-free — We sell the engine output, never a vendor referral. No reseller cut, no sponsored ranking.
- (02)Deterministic — Same inputs, same output. A validator rejects any narrative that contradicts the math.
- (03)Published with its source — Every price has a source URL, every score a provenance label, every recommendation its reasoning.
Security advice is mostly conflicted. Resellers, commissions, sponsored research — and the buyer sits in the middle.
Most of a security decision is calculable — the products, the prices, the coverage, the exposure. The industry sells that calculable part as six-week, six-figure consulting.
We do the calculable part in a single session — sourced, auditable, refreshable. Your judgment goes where it counts: the politics, the regulator, the board.
The second belief: publish the math. Every price has a source URL, every score a provenance label, every recommendation its reasoning.
If we can't defend it in writing, we don't ship it.
One founder and a focused engineering practice on a deterministic spine — no invented team page. What ships today is the floor, not the ceiling: more analysis, more vendors, more provable findings.
Want to talk to a human? hello@cybertwin.io or book time at cal.com/cybertwin/15min (15-minute calls).
Most of these numbers come straight from the code — the framework, catalog, vendor, extractor, technique, and threat-actor counts are read off the lists and mappings that drive the engine, so each moves the moment we add or drop one. Three are maintained by hand — the test total, the insurance-carrier count, and the report count — each a real figure we keep current, not a marketing number invented for this page.
- Compliance frameworksscored simultaneously24
- Catalog productswith verified prices99
- Configuration review vendors1,913 deterministic checks37
- Vendors in attack pathstheir uploads feed the attack-path graph14
- MITRE techniquesmapped to edge types26
- Threat actor categoriespaths matched by TTP overlap11
- Insurance carriersauto-fill questionnaires5
- Boardroom-grade reportsfrom one upload12
- Automated testscounted 2026-09-15 · rounded down18,000
As CISOs sign on and agree to public attribution, their stories land here. We don't run logo walls of unconfirmed customers, and we don't pay for testimonials.
We're early. A logo wall of "pilots" that never signed is the credibility trap — we're not walking into it.
What ships here, when it's real: one customer per story, named and titled, one specific quote, and the metric we moved. Nothing anonymous, nothing paid for.
Want founder-direct access while we're early? Tell us about your environment.
Start the conversation →The honest case for whether CyberTwin is real isn't on the About page. It's in the assessment output, the methodology page, and the sample report. Spend 10 minutes with those.