# CISO360AI Help Centre > CISO360AI is a security and compliance platform that finds your exposure, tracks risk and keeps you audit-ready. Every page below in one file: https://docs.ciso360.ai/llms-full.txt Any page as Markdown: https://docs.ciso360.ai/llms.mdx/docs//content.md, for example https://docs.ciso360.ai/llms.mdx/docs/getting-started/content.md - [Introduction](/docs): CISO360AI is a security and compliance platform that finds your exposure, tracks risk and keeps you audit-ready. - Your modules: The four modules and Pentest as a Service: what each does end to end, and how to choose. - [Your modules](/docs/modules): A module is a part of the platform you turn on for one job: one of four content modules, GRC / compliance, Attack surface (CTEM), Identity exposure & dark-web monitoring or Cloud posture (CSPM), or Pentest as a Service. - [GRC / compliance](/docs/modules/grc-compliance): The GRC / compliance module shows where you stand against the frameworks you are held to, such as ISO 27001, NIST CSF, SOC 2 and Essential Eight, proves it with evidence, and reports it. - [Attack surface (CTEM)](/docs/modules/attack-surface): The Attack surface (CTEM) module scans your domain from outside to show what an outsider can see of your organisation, and which exposure findings to triage and fix first. - [Identity exposure & dark-web monitoring](/docs/modules/identity-exposure): The Identity exposure module finds leaked credentials, breached passwords and exposed account addresses tied to your domain, for you to resolve once the account is secured. - [Cloud posture (CSPM)](/docs/modules/cloud-posture): The Cloud posture (CSPM) module shows pass and fail configuration results for the cloud and identity services you connect, such as Microsoft 365, mapped to framework controls, and tracks a fix or an exception for each failing check to a decision. - [Pentest](/docs/modules/pentest): The Pentest module records each penetration test as an engagement, from scope to findings to an approved report, and tracks its findings to a fix. - Get started: Choose your modules, set up the organisation and take the first steps. - [Get started](/docs/getting-started): A checklist of your first steps in CISO360AI: create an account, choose your modules, set up your organisation and verify your domain, then a plan for your first week. - [Set up your organisation](/docs/getting-started/set-up-your-organisation): The setup wizard sets your organisation's profile and switches on the modules you choose. - [Verify your domain](/docs/getting-started/verify-your-domain): Verifying your main domain shows the assets, findings and exposures behind your scan totals, and is needed for active scanning. - [Run your first scan](/docs/getting-started/run-your-first-scan): Authorise scanning for your main domain, start a scan and read its first results. - Platform guide: One page per app menu, in the app's order: what is there and how to use it. - [Platform guide](/docs/platform): The platform guide maps the app's menu in its order: what each menu holds, which guide covers it, and what to check if something is missing. - [Home](/docs/platform/home): Home is a one-page overview of the project selected in the switcher: tiles, charts and recent scans, each opening the page that holds the detail. - [AI Sidekick](/docs/platform/ai-sidekick): AI Sidekick is the platform's built-in AI assistant, a set of personas that answer questions from your project's data. - Tasks - [Tasks](/docs/platform/tasks): Tasks is where you decide what your AI assistant proposes, track and plan remediation work, and run scans. - [Actions](/docs/platform/tasks/actions): An action is a piece of remediation work, such as a fix for a control, requirement, risk, finding or vulnerability, or work you add yourself. - [Scans and runs](/docs/platform/tasks/scans): A scan checks the targets you authorise, on demand or on a schedule, and Tasks › Runs lists each time it ran. - [Assets](/docs/platform/assets): Assets is your inventory of networks, identities, applications, devices and data, with the domains you prove you control and a graph of how they connect. - Assurance - [Assurance](/docs/platform/assurance): Assurance holds the evidence behind your security claims and the reports you release from your data. - [Gather evidence](/docs/platform/assurance/evidence): Evidence is the project's library of files and links, such as documents, screenshots and config exports, that back compliance requirements, findings and assessment scores. - [Reports](/docs/platform/assurance/reports): A report is an executive overview, vulnerability, compliance, configuration or assessment document generated from your current data, which you review, approve and export. - **Security** - Exposure - [Exposure: browse, triage and export findings](/docs/platform/exposure/findings): Exposure › Findings is your project's worklist of findings, one weakness on one asset each, to triage, change in bulk and export. - [Vulnerabilities](/docs/platform/exposure/vulnerabilities): Exposure › Vulnerabilities lists the vulnerabilities found in your project with their CVE, CVSS, EPSS and KEV, each with the findings behind it. - [Add or import findings](/docs/platform/exposure/add-or-import-findings): A finding enters your project by hand, from a vulnerability library write-up, or from a Nessus, Burp Suite, Nuclei, SARIF or JSON report produced by your own tools. - Cloud posture - [Cloud posture](/docs/platform/cloud-posture): Cloud posture shows how your connected cloud and identity services are configured, and is where you connect them. - [Configuration checks](/docs/platform/cloud-posture/checks): Configuration checks show pass and fail results for the settings in your connected cloud and identity services, and the NIST CSF controls each check supports. - [Connectors](/docs/platform/cloud-posture/connectors): A connector brings a Microsoft 365 tenant's identities, devices, vulnerable software and configuration settings into CISO360AI. - Dark web - [Dark web](/docs/platform/dark-web): Dark web tracks leaked credentials for your domains and people that turn up in known breaches. - [Identity exposures](/docs/platform/dark-web/exposures): Dark web › Exposures lists leaked credentials and account addresses for your domains, found in breaches and on the dark web, to resolve once each account is secured. - Pentest - [Engagements](/docs/platform/pentest/engagements): An engagement records one penetration test: its scope and testing window, the findings against it, and the client-ready report built from them. - **GRC** - [Governance](/docs/platform/governance): Governance holds your security policies, from a starter policy or your own sections through review and approval to an exported document. - [Risk](/docs/platform/risk): The Risk register records each risk with its likelihood, impact, treatment and owner, links the controls that reduce it, and tracks it to closure. - Compliance: Choose your frameworks, score where you stand, attach evidence, keep it current and report on it. - [Compliance](/docs/compliance): Compliance holds the frameworks you are held to, your score against each requirement, and the controls mapped to them, ready to back with evidence and report. - [Score an assessment](/docs/compliance/score-an-assessment): An assessment records, for one period, whether each of a framework's requirements is claimed, validated, a gap, managed or not applicable. - [Run a gap review or full assessment](/docs/compliance/reviews): A gap review or full assessment has the AI Sidekick propose remediation work for a framework's gaps, for you to decide. - [Choose your frameworks](/docs/compliance/your-frameworks): Frameworks are the standards your project is assessed against: ISO 27001, NIST CSF, Essential Eight and others from the catalogue, or a custom framework you bring. - [Controls](/docs/compliance/controls): Controls are the security measures you run, each with a type, status and effectiveness, mapped to the framework requirements they help meet. - **Separator** - Templates - [Templates](/docs/platform/templates): Templates holds the reusable parts of policies and reports: policy and report templates, the vulnerability library, sections, variables and branding. - [Vulnerability library](/docs/platform/templates/vulnerabilities): The vulnerability library holds reusable write-ups to report a pentest finding from, so wording, CVSS and references stay consistent. - [Sections](/docs/platform/templates/sections): Sections are reusable blocks of text that policies and reports are built from; document variables are the facts they fill in, such as your company name. - **Project and organisation** - [Project settings](/docs/platform/project-settings): Project settings hold one project's name and lock, risk appetite, review cadence, default approver, primary framework and scan modules. - Organisation and account: From the switcher at the top of the sidebar and the account menu at its foot: people and access, organisation settings, billing and your own account. - [Organisation and account](/docs/administration): Organisation and account covers the organisation's settings, people, billing and audit log, opened from the sidebar switcher, and each person's own account, opened from the account menu. - [Users and access](/docs/administration/users-and-access): User Management is where you choose who belongs to your organisation and the role each person, guests included, has on each project. - [Organisation settings](/docs/administration/organisation-settings): Organisation settings hold your organisation's profile, notification emails and deletion; they open from the sidebar switcher, beside Billing & usage and the Audit log. - [AI credits](/docs/ai/ai-credits): AI credits are the allowance the platform's own AI draws on: AI Sidekick replies and the Executive overview report. - [Your account](/docs/administration/your-account): Account settings hold your own profile, your personal API keys, your projects and the notifications sent to you. - Connect your AI agent: Connect your own AI agent over MCP, manage API keys, and find the API and MCP schemas. - [Connect your AI agent](/docs/ai): How your own AI agent connects to CISO360AI over MCP, the API keys it uses, and where the live API and MCP schemas are. - [Connect an agent](/docs/ai/connect-your-agent): Connect your own AI agent, such as Claude, or any MCP client to CISO360AI's Model Context Protocol (MCP) server, from its connector directory or with an API key, to work with your data under your role. - [API keys and MCP connections](/docs/ai/api-keys): An API key lets an AI agent, script or other tool act in CISO360AI with its owner's role in one organisation; create, scope, rotate and revoke keys, and stop an agent. - [API and MCP reference](/docs/reference/api-and-mcp): The CISO360AI REST API and MCP server: where their live schemas are published, and how to call them with an API key. - Reference: Key terms and who can do what. - [Reference](/docs/reference): Look-up material for CISO360AI: key terms, what each role can do, and where the live API and MCP schemas are. - [Key terms](/docs/reference/key-terms): One-line definitions of the CISO360AI terms that are easy to confuse, such as finding, vulnerability and observation, or assessment and engagement. - [Roles and permissions](/docs/reference/roles-and-permissions): A role (Reader, Contributor or Admin) is held per project and decides what a person can do there; Admin on the main project also manages the organisation.