Question 1

What is CulperIQ and how does it differ from other security platforms?

Accepted Answer

CulperIQ is a modular security platform that combines vulnerability management, compliance automation, and security information and event management into a unified solution. Unlike traditional point solutions, CulperIQ integrates assessment tracking, remediation management, GRC workflows, and AI-powered assistance in a single platform, eliminating the need for multiple disparate tools.

Question 2

What are the main modules of CulperIQ?

Accepted Answer

CulperIQ consists of two main module families: Meridian, focused on security operations including Assessments, Kestrel CSPM, AI Atlas, Vulnerability Management, and Security Operations (SIEM); and Safeguard, focused on governance, risk, and compliance including Horizon GRC, Vendor Management, Policy Library, Kestrel for Horizon, and Aegis for Horizon.

Question 3

Is CulperIQ suitable for small to medium-sized businesses?

Accepted Answer

Yes, CulperIQ is designed for organizations of all sizes. The platform was built by security professionals who understand that lean IT and security teams need enterprise-grade capabilities without the complexity. The intuitive interface allows teams to get up and running quickly without weeks of training, costly consultants or onboarding fees.

Question 4

How does CulperIQ pricing work?

Accepted Answer

CulperIQ offers flexible pricing based on the modules you need. When you get a Penetration Test or other assessment from CulperSec, you receive free access to Meridian's Assessments module for one year. Certain Managed Services will also get you access to your data with CulperIQ. Contact our sales team for detailed pricing on CulperIQ, Managed Services, and Professional Services.

Question 5

How does Meridian Assessments improve upon traditional penetration testing reports?

Accepted Answer

Unlike static PDF reports that provide little actionable value, Meridian Assessments provides a dynamic, interactive platform for managing assessment findings. You get centralized tracking, Kanban-style remediation boards, progress monitoring, and AI-powered remediation guidance through Cody Assist - all designed to ensure findings actually get addressed.

Question 6

What makes Meridian Vulnerability Management different from traditional scanners?

Accepted Answer

Meridian Vulnerability Management goes beyond basic scanning to provide strategic vulnerability management. It offers comprehensive network visibility through the Aegis agent, actionable prioritized insights, fleet-wide threat hunting capabilities, and dynamic dashboards that help you make informed decisions about which vulnerabilities to address first.

Question 7

What does Meridian Kestrel do?

Accepted Answer

Meridian Kestrel is CulperSec's Cloud Security Posture Management module. It integrates with Microsoft 365, Microsoft Azure, Google Cloud, and AWS to run selected security benchmarks, identify cloud misconfigurations and security gaps, score cloud environments, and provide remediation guidance.

Question 8

What does AI Atlas monitor?

Accepted Answer

AI Atlas uses the Aegis endpoint agent to monitor endpoint AI harnesses such as Codex, Claude Code, Google Gemini CLI, and GitHub Copilot in VS Code. It detects sensitive prompt data, reviews skills and MCP servers for security issues, and gives organizations token, cost, usage, and personal-account visibility.

Question 9

How does Meridian Security Operations (SIEM) work?

Accepted Answer

Meridian Security Operations (SIEM), our Security Information and Event Management module, centralizes security events from Aegis-managed endpoints and integrations such as Microsoft 365, Microsoft Azure, and AWS. This gives teams one place to monitor, investigate, and respond to activity across endpoints, cloud platforms, SaaS services, and other connected sources.

Question 10

What platforms does the Aegis agent support?

Accepted Answer

The Aegis agent is a modern, cross-platform, 64-bit agent that supports Windows, macOS (both Intel and Apple Silicon), and Linux (x86 and ARM). It automatically manages its features based on which CulperIQ products you're using. Certain features may only be available on specific platforms.

Question 11

Which compliance frameworks does Horizon GRC support?

Accepted Answer

Horizon GRC supports multiple frameworks including NIST CSF, ISO 27001, SOC 2, CCPA, and more. You can manage multiple frameworks side-by-side and track maturity against each in real time through the unified compliance workspace. For more up-to-date information on our framework support, contact us at sales@culpersec.com as our supported frameworks may change over time.

Question 12

How does Horizon GRC simplify audit preparation?

Accepted Answer

Horizon GRC maintains continuous audit readiness through easy evidence mapping, automated control tracking, and instant report generation. You can upload evidence artifacts, connect them to framework requirements, and generate regulator-friendly exports in seconds that provide auditors with exactly what they need.

Question 13

What is included in the Safeguard Policy Library?

Accepted Answer

The Policy Library provides a centralized repository for critical security documents like your organization's Information Security Policies, Business Continuity Plans, procedures, and other compliance and security documentation. It includes version control, collaboration features, and seamless integration with Horizon GRC for evidence mapping.

Question 14

How does Horizon Vendor Management help with third-party risk?

Accepted Answer

Horizon Vendor Management provides comprehensive vendor risk oversight through detailed risk assessments, compliance monitoring against critical standards, centralized documentation repositories, and performance tracking over time. Visual dashboards give you real-time visibility into vendor risks and remediation status.

Question 15

How does Kestrel for Horizon support cloud compliance?

Accepted Answer

Kestrel for Horizon runs framework-mapped cloud benchmark scans using Kestrel infrastructure. Results apply directly to Horizon Compliance Assessment requirements, and negative results are sent to the Horizon GRC Risk Registry for review and remediation tracking.

Question 16

What is Aegis for Horizon?

Accepted Answer

Aegis for Horizon runs Security Configuration Assessments on endpoints managed by the Aegis agent. Teams can review endpoint benchmark results and map them to Horizon controls so endpoint hardening can support compliance assessments.

Question 17

Can non-compliance professionals use Horizon GRC effectively?

Accepted Answer

Absolutely. Horizon GRC was built by security professionals for IT, Engineering, and Security teams who need to manage compliance without becoming compliance experts. The interface is intuitive enough for anyone to pick up in an afternoon while still providing the dashboards and evidence trails that auditors and CISOs expect.

Question 18

What's the difference between Cody Assist and Cody Chat?

Accepted Answer

Cody Assist comes standard and provides task-specific assistance within modules like Meridian Assessments and Horizon GRC, only accessing data explicitly shared with it when you use it. Cody Chat is an optional add-on that offers conversational AI that has secure access to the full context of your entire CulperIQ environment, available on every page with role-based access controls.

Question 19

How does Cody help with finding remediation?

Accepted Answer

Cody Assist can generate detailed remediation recommendations for complex findings, guide your team through remediation steps, and help prioritize efforts based on risk and business impact. It understands the context of your specific environment and provides actionable guidance rather than generic advice.

Question 20

Is my data secure when using Cody AI?

Accepted Answer

Yes, Cody is designed with security and privacy as core principles. Cody Assist only accesses data explicitly shared with it for specific tasks, while Cody Chat operates with role-based access controls that ensure responses align with user permissions. No data is used to train external models.

Question 21

How does Cody learn about my environment?

Accepted Answer

Cody Chat (the full-context add-on) learns from your CulperIQ environment data with proper access controls, while Cody Assist works with the specific data you share for individual tasks. Both maintain strict privacy boundaries and operate within your defined permissions.

Question 22

What data is saved or stored when using Cody Chat?

Accepted Answer

Cody Chat has full context of your environment and can access all relevant data, including assessment information, asset details, vulnerabilities, and compliance data using your own user accounts role, permissions, and access controls. Data from CulperIQ is only available to Cody Chat through internal tool calling and vectorized embeddings as you are actively using it, this data is not stored outside of CulperIQ and is subject to the same data retention policies as your CulperIQ environment. Prompts and chat messages are only retained for abuse and security monitoring and are deleted after 30 days. No chat data is used to train internal or external models.

Question 23

How long does it take to deploy Aegis?

Accepted Answer

The Aegis Endpoint Agent is designed for rapid deployment. The Aegis agent can be deployed in minutes with minimal user intervention, and most teams can start using the platform productively within an afternoon. Many teams will deploy Aegis leveraging InTune, Addigy, Jamf, PDQ or other enterprise deployment tools.

Question 24

What are the system requirements for CulperIQ?

Accepted Answer

CulperIQ is a cloud-based platform accessible through modern web browsers, Chrome-based browsers are recommended for the best experience. The Aegis agent requires 64-bit systems and supports Windows, macOS (Intel and Apple Silicon), and Linux (x86 and ARM). Specific features may only be available on specific platforms.

Question 25

What types of penetration testing does CulperSec offer?

Accepted Answer

We offer comprehensive penetration testing including network penetration tests, web application assessments, social engineering tests, physical red team engagements, and specialized assessments. All testing results integrate directly into Meridian Assessments for streamlined remediation tracking.

Question 26

How does Managed Compliance work with Horizon GRC?

Accepted Answer

Managed Compliance combines the power of Horizon GRC with expert compliance professionals who help maintain your compliance posture, prepare for audits, and ensure continuous adherence to your required frameworks. We handle everything while you maintain visibility and control.

Question 27

Can CulperSec help with incident response planning?

Accepted Answer

Yes, we offer both incident response planning as a professional service and Managed Incident Response for ongoing support. We can help develop your incident response procedures, conduct tabletop exercises, and provide expert response when incidents occur.

Question 28

Can advisory work include security documentation?

Accepted Answer

Yes. Project-based consulting and ongoing vCISO engagements can include documentation gap analysis, drafting, and maintenance for security policies, procedures, and plans. When Policy Library is included in the engagement scope, teams can manage versions, collaboration, and updates in CulperIQ.

Question 29

How can we effectively manage cybersecurity risk in our enterprise?

Accepted Answer

Effective risk management starts with identifying critical assets and threats, prioritizing risks by likelihood and impact, applying controls that match the organization’s risk appetite, establishing governance through a framework such as NIST RMF or ISO 27005, continuously monitoring control performance and new threats, and using outside experts when needed to validate and improve the program.

Question 30

What is Governance, Risk, and Compliance (GRC) and why is it important to our cybersecurity program?

Accepted Answer

Governance sets security policy and accountability, risk management systematically identifies and treats threats to business objectives, and compliance ensures legal and contractual obligations are met; integrating them in a GRC program aligns security with strategy, eliminates silos, and gives leadership clear oversight.

Question 31

Which cybersecurity framework (e.g., NIST CSF, ISO 27001) should we adopt, and why?

Accepted Answer

NIST CSF is a flexible U.S. framework ideal for internal improvement, ISO 27001 is a certifiable international standard valued for external assurance, and many organizations use NIST CSF for day-to-day guidance while pursuing ISO 27001 certification to demonstrate commitment to partners and regulators.

Question 32

What does it take to achieve and maintain ISO/IEC 27001 compliance?

Accepted Answer

Define the ISMS scope and policy, perform a risk assessment to create a statement of applicable controls, implement and document those controls, run internal audits and management reviews, pass a two-stage certification audit, and sustain the cycle with annual surveillance and continual improvement.

Question 33

What are the key requirements for HIPAA compliance and how can we meet them?

Accepted Answer

Identify PHI and responsible officers, implement administrative, physical, and technical safeguards, enforce privacy-rule policies such as minimum necessary use, secure business associate agreements, train staff, maintain breach-response readiness, and audit and document these measures regularly.

Question 34

What is CMMC and how can our organization prepare for its requirements?

Accepted Answer

CMMC 2.0 has three maturity levels; most contractors need Level 1 self-attestation for FCI or Level 2 certification for CUI, so perform a gap analysis against NIST 800-171, close technical and policy gaps, document an SSP and POA&M, rehearse with a mock audit, certify, and keep controls effective.

Question 35

What does PCI-DSS compliance entail for our business?

Accepted Answer

PCI-DSS requires limiting the cardholder data environment, implementing twelve security domains covering network, data protection, vulnerability and access management, logging, and policy, validating annually through an SAQ or QSA audit plus quarterly ASV scans, remediating findings promptly, and monitoring controls continuously.

Question 36

What are the best practices for implementing an enterprise vulnerability management program?

Accepted Answer

Maintain a complete asset inventory, run regular internal and external scans, prioritize findings by severity and business context, patch or mitigate within set timelines, verify fixes through rescans, track metrics such as mean time to remediate, and integrate the cycle with change and asset management for continuous improvement.

Question 37

Why is penetration testing important and how often should we conduct it?

Accepted Answer

Penetration testing safely shows how attackers could exploit your systems, validates defenses and response, and satisfies many compliance rules; perform a comprehensive test at least yearly and after major changes, with more frequent or continuous testing for high-value or high-risk assets.

Question 38

What is the difference between vulnerability scanning and penetration testing?

Accepted Answer

Vulnerability scanning is automated and frequent, listing known flaws across many systems, while penetration testing is a manual or guided exercise that exploits weaknesses to reveal real business impact; scanning provides breadth, testing provides depth, and both together offer a complete view.

Question 39

How do we develop an effective incident response plan for cybersecurity incidents?

Accepted Answer

Create a trained team, define detection, triage, containment, eradication, and recovery steps, establish internal and external communication paths, document everything, rehearse regularly, and conduct post-incident reviews to feed lessons back into security controls.

Question 40

How can we ensure our third-party vendors and partners meet our cybersecurity standards?

Accepted Answer

Run a third-party risk program that classifies vendors by impact, assesses them before onboarding, embeds security and breach-notification clauses in contracts, grants only necessary access, reviews evidence like SOC 2 reports annually, monitors continuously, and suspends or replaces vendors that pose unacceptable risk.

Question 41

What steps can we take to protect our organization from ransomware attacks?

Accepted Answer

Maintain tested offline backups, patch quickly, deploy EDR with email and web filtering, enforce least privilege and MFA, segment networks, train users to spot phishing, and rehearse a ransomware response that isolates infected hosts and restores systems without paying attackers.

Question 42

Does meeting compliance requirements guarantee our security?

Accepted Answer

Compliance supplies a baseline set of controls at a point in time, but threats evolve and gaps outside the compliance scope remain, so real security needs a continuous risk-based program that goes beyond checklists with proactive monitoring, testing, and improvement.

Question 43

How important is cybersecurity awareness training for our employees and how should we implement it?

Accepted Answer

Regular, engaging training helps employees recognize phishing, protect data, and follow policies; combine onboarding courses, annual refreshers, simulated phishing, and ongoing reminders, and measure outcomes to build and maintain a security-conscious culture.

Question 44

What is the difference between vulnerability and risk management?

Accepted Answer

Vulnerability management identifies, prioritizes, and remediates specific technical weaknesses, whereas risk management evaluates how those and other threats affect business objectives, weighs likelihood against impact, and decides whether to mitigate, transfer, accept, or avoid each risk.

Frequently asked questions

What is CulperIQ and how does it differ from other security platforms?

What are the main modules of CulperIQ?

Is CulperIQ suitable for small to medium-sized businesses?

How does CulperIQ pricing work?

Still have a question?