Veralus: Your organisation. In view. In control.
Veralus brings risk, evidence and action together so you can make clearer decisions and build a more resilient future.
One Field. Six connected modules.
Veralus is Acuity Risk Management’s cyber-risk operating platform, launching November 2026. It connects six modules (Assure, Govern, Sense, Quantify, Resolve and Resilience) inside one Field: the connected picture of your organisation, its risks, controls, evidence and actions. Most GRC and security work is rich in findings, tickets, controls and reports, but weak at proving the chain from an observation to a genuinely reduced risk. Veralus is built to close that gap: it turns structured GRC work from any GRC tool you use, supplier assurance evidence and other trusted sources into prioritised decisions, tracked actions and board-ready reporting, with AI that recommends and explains but never moves a risk position without evidence and human approval behind it. You will be able to start free and grow into governed operations when you are ready.
Why Veralus exists
- AI is automating attacks: as AI-driven attackers find gaps faster than manual review can catch them, defending at the same pace means harnessing AI to orchestrate your cyber defence, not just report on it.
- Policy and reality drift apart: what your policies say should happen and how your critical business systems are actually configured pull apart over time, and closing that gap is central to what Veralus does.
- Decisions still require manual synthesis: teams spend real time turning raw data into priorities, escalations and board-ready narrative, rather than acting on it.
Where Veralus fits in Acuity’s product strategy
Veralus brings Acuity’s cloud products together. The GRC workspace of STREAM Cloud, the supplier assurance of Vendor Management Hub and the RiskOS operating layer become one platform, with one Field and one view of risk. It is designed to work alongside your other trusted tools, so you are not locked into a single closed system. STREAM Classic remains our on-premises platform for programmes that must run inside their own boundary.
| Veralus | The cyber-risk operating platform, in the cloud. Six connected modules, governed AI, and a free account to start. |
| STREAM Classic | On-premises cyber GRC, including air-gapped deployment and quantitative risk modelling, for the public sector, defence and the largest enterprises. |
Six connected modules
Veralus works as one operating model, not a stack of disconnected products. Every module contributes to the same outcome: clearer decisions and better resilience.
Assure
Define what good looks like.
Set the standard your organisation, and the suppliers it depends on, are working towards.
Govern
Run the programme with accountability.
Give every control and action an owner, with approvals and a record of who did what.
Sense
See changes across the environment.
Bring the signals in your scope into one view, so change is noticed rather than discovered at audit.
Quantify
Understand exposure, priority and impact.
Rank risk by what it could cost the business, so effort goes where it matters most.
Resolve
Coordinate action and follow-through.
Move from finding to fixed, with each step reviewed, approved and evidenced.
Resilience
Adapt, recover and become stronger.
Use what each incident and review teaches to strengthen the programme over time.
Governed action matters more than AI chatter
Veralus is designed so AI helps your team understand, prepare and act within transparent permissions, approvals and evidence. People stay accountable. Automation expands what a lean team can do without hiding the work.
- 1
Recommend. AI proposes a next step and explains why.
- 2
Review. Your team checks the reasoning and the evidence.
- 3
Approve. The right person signs it off.
- 4
Act. The approved action is carried out and tracked.
- 5
Verify. Evidence confirms the change before the risk position moves.
- Transparent permissions
- Required approvals
- An audit trail for every action
- People remain accountable
What it isn’t
Veralus is not designed to be another dashboard your team maintains by hand. It is not designed to be a single opaque score: exposure, confidence and what remains unknown are intended to stay visible and explainable, not blended together. It is not designed to let AI fill evidence gaps with plausible-sounding text: the intent is that it answers from approved evidence or says plainly that it cannot, rather than guessing. And it is not designed to treat a closed ticket or a completed task as proof that risk was actually reduced.
Who this is for
Veralus is built for everyone who needs the same risk position, from the people who run the programme to the board that relies on it.
CISO / Head of Cyber Risk
The operational user: wants a defensible, evidence-backed view of exposure and action, not another dashboard to maintain by hand.
GRC / Risk Leader
Wants structured GRC work to translate into prioritised decisions automatically, rather than manual synthesis every reporting cycle.
CFO / CEO
The board-facing reader: wants to know what changed, what needs funding or a decision, and what has genuinely been proven.
Board / Risk Committee / Non-Executive Director
Needs a defensible, evidence-backed narrative it can rely on, not a status update with no context behind it.
Third-Party / Supplier Risk Lead
Wants supplier assurance evidence connected to the same operating picture, not a separate, disconnected process.
Start free. Keep your plan.
From launch, a free Veralus account gives you somewhere to research and plan before you commit to anything. No payment details.
Research frameworks
Explore routes, published sources and the questions that matter to you.
Explore generic scorecards
Compare planning ideas before choosing your desired position.
Save a desired plan
Keep your choices and return to them as your priorities develop.
Research and generic scorecards support planning. They do not assess your organisation or verify compliance. Maintained service plans and governed operations are separate choices.
From here to launch
Veralus has no customers yet: it has not launched. Rather than dress up a placeholder as a case study, here is what happens between now and the November 2026 launch.
Register interest. Tell us a little about your organisation and what you would want a risk operating layer to answer for you.
Early conversation. Where relevant, we will talk through your current GRC and evidence setup ahead of general availability.
Build your First Field. When Veralus opens, registered organisations will be invited first to create a free account and build their First Field.
Veralus FAQs
Common questions about Veralus: what it is, who it's for, and when it launches.
Be first to know when Veralus launches
Register your interest now and we will be in touch as access opens ahead of the November 2026 launch.