Recurring questions in the evaluation process.

The platform is sized for organizations with between 10 and 500 employees, and investment follows the size of the monitored environment. It is worth noting that target selection in automated attacks considers ease of exploitation rather than organizational size.

Capacity to execute the corrections identified is required, which may be met by an internal IT professional, the vendor responsible for the infrastructure, or, under the Managed plan, a CyberSeven analyst. Following the platform and reading the security index require no technical knowledge.

No. The layers are complementary. Antivirus addresses malicious files already present in the environment, and firewalls address network traffic according to established rules. Neither determines the organization’s current exposure or establishes the order of remediation, which is the function of CyberVision.

Artificial intelligence performs the stage that traditionally demands a specialist: it converts natural-language instructions into technical scans, correlates findings across the different monitoring fronts, classifies each risk considering technical severity and asset criticality, and presents the recommended action in clear terms.

No. Interaction takes place in natural language, without specific syntax and without configuring technical parameters. Requests such as an assessment of current priorities, the issuing of an executive report, or the scheduling of recurring scans are expressed in ordinary text.

No. The platform identifies, classifies, and instructs. Executing changes depends on formal approval from the organization and remains restricted to the automation scope expressly authorized in contract.

Classification combines the technical severity recorded in public vulnerability databases with the criticality of the asset in the organization’s context. The impact and likelihood matrix documents the criteria applied to each record, allowing prioritization to be verified in audit processes.

Up to six fronts, according to the contracted plan and the established scope: internal network, external network, known vulnerabilities in operating systems, web applications, cloud resource configuration, and exposure of corporate credentials in restricted forums.

Monitoring the internet-facing surface requires no installation. Monitoring the internal network requires an agent installed on a machine in the corporate network, with installation carried out jointly with the organization.

Scans are parameterised to operate without impact on system availability, with scope and execution window agreed in advance. Sensitive equipment, such as medical devices and industrial control systems, is subjected exclusively to passive verification.

The figure derives from three variables: the volume of assets included in monitoring, the modules enabled, and the level of follow-through performed by CyberSeven. The proposal with scope and investment is presented within one business day of the scoping meeting.

Because the surface to be monitored varies considerably between organizations of the same nominal size. A fixed table would transfer cost between materially different environment profiles. Sizing the scope precedes presenting the investment.

Implementation is conducted by the CyberSeven team and its composition appears in the commercial proposal, together with any associated costs. Amounts additional to the subscription, where they exist, are presented in that document.

No. The evaluation period precedes any contractual commitment and requires no credit card. The scope of the evaluation is recorded in writing before scans are executed.

Technical configuration and exposure data: asset inventory, published services, software versions in operation, and applicable known vulnerabilities. The platform does not scan mailboxes, working files, or client databases on its own initiative.

Verification is executed exclusively on content voluntarily submitted to the assistant by the user. There is no automated access to the organization’s mailboxes.

Processing of the data collected observes Brazil’s General Data Protection Law. The platform also contributes to the organization’s own compliance obligations by identifying exposures involving personal data. Details appear in the privacy policy.

Access is restricted to the team assigned to the organization’s account and limited to the authorized scope. Under the Managed plan, the assigned analyst follows the risk queue, which corresponds precisely to the service contracted.