Capabilities Reference
Every Aegis capability in one place, the complete feature map, from AI onboarding to the auditor view.
This is the full reference for what Aegis does, grouped by area. For depth on any one area, follow its link.
AI-native foundation
The capabilities that set Aegis apart are the ones where AI does the work, not just the storage.
| Capability | What it does |
|---|---|
| Security assessment & scoping | Ten sections of questions decide which control families and policies apply, with a reason for each decision, and record a readiness baseline per family |
| Program materialization | From your submitted assessment, generates your controls, policies, evidence backlog, risk register and vendor list, scoped and mapped to your frameworks |
| Document Vault analysis | Reads the documents you upload and suggests vendors, risks, organisation facts and assessment answers, each with a verified quote, for a person to approve |
| Assessment by agent | Your MCP assistant proposes assessment answers under server-enforced rules; nothing counts until a person confirms it |
| Context-aware policy authoring | Writes full policies around your real cloud, data types, workforce and residency, not generic templates |
| AI risk-to-control mapping | Matches each risk to the controls that mitigate it and drafts treatment tasks |
| AI vendor assessments | Produces a scored risk assessment for each vendor automatically |
| Questionnaire automation | Extracts questions from a customer questionnaire and drafts grounded answers |
| Compliance assistant | An in-product "Ask AI" for questions about your program |
Planning
| Capability | Detail |
|---|---|
| Roadmap | Phases and milestones from kick-off to audit, each with a "done when" and the real tasks and policies behind it |
| Optional client dates | Target dates per milestone and audit dates per framework, set by your owners and admins; on-track, due-soon and overdue only where a date exists |
| Up next | Open work you can start now, overdue first |
| Status board | Roadmap tasks and policies in To do / In progress / In review / Done; moving a card changes the real task |
| Curated by NexusVoid | NexusVoid reviews and publishes the roadmap structure for your organisation |
See Security Assessment and Roadmap.
Frameworks & controls
Multi-framework support
SOC 2, ISO 27001, ISO 42001, NIST CSF, NIST AI RMF, EU AI Act, GDPR, DPDP, HIPAA, PCI DSS and more.
Shared-control model
One control satisfies requirements across many frameworks; work and evidence count everywhere.
Control library
Owned, mapped, evidence-backed controls with live status and framework roll-up.
Live coverage
Real-time completion percentage per framework, derived from shared controls.
Policies
| Capability | Detail |
|---|---|
| AI-drafted policies | Full documents written in your organization's context |
| Versioning | Authoritative current version with retained history |
| Approval workflow | Draft → needs review → published; every publication is accepted by the assigned approver, published text is frozen and changes go through a new version, enforced by the API |
| Editor and PDF | Rich in-place editor, or upload an externally signed PDF |
| Attestation | Require employees to read and sign the policies that apply to them |
| Control mapping | Policies map to controls, so policy work advances your program |
See Policies.
Evidence & automation
| Capability | Detail |
|---|---|
| Structured evidence backlog | Tasks grouped by category, with owners, cadence and status |
| Recurring tasks | Reviews and attestations that regenerate on schedule |
| Evidence approval | Optional: tasks, including ones an automated check passes, are submitted for review and only the assigned approver completes them, enforced by the API |
| Integrations | Identity, cloud, source control, HR, security and analytics as evidence sources |
| Cloud tests | Active posture checks against AWS Security Hub, GCP Security Command Center and Azure |
| Documents checklist | Standalone artifacts (pen-test report, minutes, diagrams) tagged by framework |
| Document Vault | Upload existing policies, vendor lists, risk registers and diagrams; review and apply what Aegis finds in them. See Document Vault |
| Evidence export | Hand an assessor a complete package, or give them the auditor view |
See Evidence & Tasks and Integrations & Cloud Tests.
Governance
Risk register
Inherent and residual scoring, heat map, treatment strategy, AI-mapped controls and linked treatment tasks.
Penetration testing
Connect Striker VAPT; promote findings to risks and save reports as pen-test evidence.
NexusVoid Argus
Two-way connection to Argus: findings to risks, a fail-closed Secure Code check, scores back to Argus.
Vendor / third-party risk
Categorized register with automatic AI risk assessments and residual bands.
Trust Center
Hosted, branded trust page with access requests, granted access and NDA gating.
Questionnaire automation
Turn inbound security questionnaires into a review pass.
Endpoint & workforce
| Capability | Detail |
|---|---|
| Device agent | Lightweight endpoint agent reporting device compliance posture |
| Software inventory | Fleet-wide installed-app inventory with a review workflow and cross-fleet search |
| Shadow AI | Discover AI tools on devices and classify them sanctioned / unsanctioned / prohibited |
| People management | Employees and contractors, their roles, tasks and attestations |
| Security training | Built-in courses with quizzes, assignment by role or department, automatic evidence on pass and re-training every six months |
| Employee portal | Where employees accept policies, install the device agent and complete training |
See Endpoint & Shadow AI and Security Training.
Administration
| Capability | Detail |
|---|---|
| Role-based access | Owner, admin, auditor, employee, contractor, plus custom roles |
| Granular permissions | A resource:action model enforced across the product |
| Auditor view | Read-only access to controls, evidence and policies for external assessors |
| Overview dashboard | Program-wide readiness, coverage and priority work at a glance |
| MCP server | Connect Claude and other assistants with exactly your access. See Connect Claude (MCP) |
See Team & Access.
Platform
| Capability | Detail |
|---|---|
| One account across NexusVoid | Shared identity, roles and billing with Argus and the teaming suites |
| Argus connection | One OAuth connection, both directions: Argus findings feed Aegis risks and Secure Code evidence; Aegis framework scores appear in Argus. See NexusVoid Argus |
| Honest reporting | Unaddressed controls are shown as such; checks that cannot run report not-determined, never pass |
Next steps
Getting Started
Turn this list into a running program.
Use Cases
See the capabilities in real scenarios.
Frameworks
The shared-control model underneath it all.
Security & Data Handling
How Aegis handles your data.
Contact us
- Website: nexusvoidai.com
- LinkedIn: linkedin.com/company/nexusvoidai
- Email: ujwal@nexusvoidai.com