AEGIS is the engine beneath the SecureEdge Advisory products. It reads evidence against what a control actually requires, it decomposes the result into eight named dimensions with a written rationale for each, and it computes the arithmetic in the open so that a reviewer can re-derive every figure. That last property is the point of it: a score nobody can reconstruct is an opinion wearing a number.
A grade is not a single judgement. It decomposes into eight dimensions, each answering a different question about the same piece of evidence.
A document can be well made, current and properly approved, and still answer a different question from the one the control asked. This axis is the reason presentation alone does not earn a pass.
A policy stating that access is reviewed quarterly is a description. A record of four completed reviews is an implementation. Auditors test the difference, so the grade separates them.
Evidence carries more weight when an accountable person has approved it. An unsigned procedure and an approved one are not equivalent, and the distinction is recorded rather than averaged away.
Evidence decays. A penetration test from three years ago and one from last quarter do not support the same claim, and a control assessed as satisfied on stale evidence is the most common finding in a first audit.
Evidence drawn from one environment does not automatically speak for another. Where coverage is partial, the grade reflects the part that is covered rather than treating the sample as the whole.
A self-assessment, an internal audit and an external examination are three different strengths of assurance. Recording which one you hold prevents the strongest available claim from being assumed.
Where a record is sealed and chained, tampering is detectable rather than merely discouraged. Evidence that could have been edited quietly after the fact supports a weaker claim than evidence that could not.
Evidence that requires explanation fails when the person who would explain it is unavailable. This axis is the difference between a pack that survives an audit and one that survives a meeting.
A grade decomposes into the eight axes above, and each carries its own written reasoning. A reviewer can therefore audit the audit rather than accept a single number.
Where evidence is stale, partial or outside the scope under examination, the gap is named and the specific artefact that would close it is identified. A list of failures without a next action is of limited use.
The calculation is published deliberately so that an auditor can re-derive every figure we present. A score that cannot be reconstructed cannot be defended, and one that cannot be defended is worth very little in an audit room.
Where AEGIS drafts content, that content carries its provenance, and your team reviews and approves it before it counts toward anything. The engine assists the work; it does not quietly become the work.
AEGIS does not certify you, and it does not render a compliance verdict. It grades evidence against a requirement, explains the grade, and shows the arithmetic. Whether your control environment satisfies a standard is affirmed by an external auditor, a certification body or a regulator. We are deliberate about this line, because a platform that blurs it is selling comfort rather than assurance.