Two separate products from the same security practice. The SecurityVP Platform manages security risk inside an organization. Normdiff follows the standards and regulations that organization answers to.
SecurityVP Platform
The SecurityVP Platform gives a security team one place to keep its risk register, triage findings from code and cloud scanners, model threats from source code and review access requests. AI drafts and checks the work; people approve it.
Available to selected organizations. Contact us for access.
Screenshot coming soon
Cyber risks scored on confidentiality, integrity and availability and mapped to NIST CSF functions; business risks by enterprise category and impact. Owners, watchers, mitigation actions, status history, and YAML import and export.
Findings from GitHub Dependabot, code scanning and secret scanning, any SAST tool that writes SARIF, Prowler and ScoutSuite reports for AWS and GCP, and built-in cloud configuration checks. Triage verdicts carry over to later scans, and a real finding can be promoted to a risk.
Generated from uploaded code or a connected GitHub repository: architecture, attack vectors, STRIDE-LM threats, LINDDUN privacy threats, compliance mapping and recommendations, with a system diagram.
Validates scanner findings, checks whether threat-model recommendations are present in the code, and reviews entry points to build attack paths. It reads the code; it does not run it. Every proposed verdict waits for a person to confirm it.
Vendors with criticality ratings and CSV import, and infrastructure assets populated from cloud scans.
Access requests from the web or Slack, approved by the manager and then security, granted by a fulfiller, with time limits, revocation and a full event history.
Threat models can be checked against the standards you choose.
Only the changes that alter your obligations. Silence when nothing did.
Normdiff is a change feed for security standards and regulations. It watches official sources, such as regulators, standards bodies and national authorities, and publishes what changed, when it takes effect and who it affects.
The public feed is free. Pro is free during early access.
Screenshot coming soon
Step 1
Official publications from regulators, standards bodies and national authorities.
Step 2
What changed, who it affects and when it takes effect, in a few lines, with a link to the original.
Step 3
Pick a country profile and the frameworks you answer to. Everything else stays out of your way.
Severity, jurisdiction, publication, effective and deadline dates, why it matters, who is affected and what to do, with a link to the official document.
From PCI DSS, ISO/IEC 27001 and NIST CSF to NIS2, DORA, the Cyber Resilience Act, GDPR and the EU AI Act. The catalogue also lists what is not monitored yet.
Dates tracked from official sources, each linked to its document, available as a calendar subscription.
A public web feed with filters, RSS for the whole feed or a single framework, and Telegram alerts for the frameworks you follow.
A short email is enough. You will get a reply from the person who would do the work.