How it works
Runs inside your boundary. Reads what you already collect. Explains itself.
AlloyGRC is a packaged platform installed in your environment. Your data, your tools, models on your own hardware. Nothing leaves.
The data path
From the sources you already have to answers you can act on
There is no page per data source. A source is described once, and every feature reads it by the role its fields play.
01
Your sources
Scan data from the scanners you already run, identity state, the policies and evidence you upload, and the ATIP threat corpus refreshed daily.
Raw collections
02
Dataset Builder
Profiles a source, asks you to confirm what its fields mean (which one is the severity, which one joins to a system), and publishes it once.
Dataset roles
03
Every feature
Vulnerability views, sprint boards, dashboards, Ask Alloy and the ATO workflow all ask for a role, never a column name. A new source needs no release.
Ranked, scoped views
04
AI on top
Ask Alloy, GenAI Dashboards, AVISSAA, PolicyForge and evidence analysis read the same roles and run on local models. The model writes prose and picks shapes; code produces every number.
Answers, boards, drafts
What the models do
Five AI features, all inside the boundary
AI-assisted RMF and control guidance for ISSOs and ISSEs
AVISSAAAVISSAA provides control-specific guidance grounded in authoritative NIST sources, including control requirements, expected assessment evidence, and required activities throughout the RMF lifecycle. Every answer is retrieved from the NIST corpus and cites its source publication.
AI-assisted policy development and control gap analysis
POLICYFORGEGenerate policies aligned to selected control baselines, evaluate existing policies for semantic coverage, identify gaps, and develop recommended language to address deficiencies.
AI-assisted control evidence analysis
cATOEvaluate submitted evidence against applicable control requirements and assessment criteria. AlloyGRC provides a documented determination and supporting rationale for human review and approval.
Generate operational dashboards using natural language
GENAI DASHBOARDSDescribe the information you need and AlloyGRC generates the appropriate visualization. AI determines presentation while deterministic code calculates the underlying metrics.
Natural-language access to operational security and compliance data
ASK ALLOYAsk Alloy enables users to navigate the platform, retrieve authoritative metrics, and understand security and compliance information through a single natural-language interface.
Sovereign AI
Deployed inside your security boundary.
AlloyGRC is deployed on premises or within your cloud environment. AI models execute locally, allowing sensitive security data, prompts, artifacts, and analysis to remain within your security boundary.
Nothing leaves your boundary.
Tested on Qwen and Gemma. Want to know whether it works on your model of choice? Ask us
-
Where it runs
On premises or in your own cloud, as containers. Never hosted by Avint.
-
Who installs it
Avint engineers install and configure it today. A fully automated Ansible install is in development so that no Avint engineer ever has to touch your data.
-
Who gets in
Role gated seats for the Authorizing Official, ISSO, ISSM, ISSE, System Owner, Security Control Assessor, administrators and IT support, with the authorization workflow being made configurable to your agency's practice. Every view is scoped to the systems a person is cleared for, enforced by the server.
-
What is recorded
Consequential actions, approvals and overrides are written to an activity ledger you can export to the SIEM you already run.
Integrate, do not replace
Connects to what you already run.
Nobody rips out a working stack for a new platform. AlloyGRC reads from your tools and hands work back to them.
| Source | What it does | Status |
|---|---|---|
| Tenable Security Center and Qualys | Vulnerabilities, compliance results and assets, ingested and ranked by AREA | Today |
| ATIP threat corpus | Enriched CVE intelligence, refreshed daily by the Avint pipeline | Today |
| Jira | Send a sprint or a group of findings to Jira as tickets, opt in per send | Today |
| MidPoint identity | Live account, role and entitlement state for Access Control assessment | Today |
| Active Directory | Sign in and role resolution from your directory | Today |
| CrowdStrike Falcon | Endpoint detections beside the findings on the same asset | In development |
| Microsoft Intune | Hand remediation to endpoint management | Planned |
| ATIP API | Query the threat corpus from outside AlloyGRC | Planned |
| Existing ATO import | Bring an authorized system straight into continuous monitoring | Planned |
Avint's comparison
Seven capabilities a federal program needs. Thirteen platforms reviewed.
Avint scored the platforms it competes with against the capabilities that matter to a federal authorization program. This is Avint's own assessment, not an independent benchmark, and it reflects what each vendor published at the time of review.
On premise or air gap
5 of 13 platforms reviewed offer it, 2 in part
Local model execution
0 of 13 platforms reviewed offer it
Native threat intel collection
0 of 13 platforms reviewed offer it, 3 in part
Exploitation weighted scoring
0 of 13 platforms reviewed offer it, 2 in part
RMF and ATO artifacts
2 of 13 platforms reviewed offer it, 6 in part
OSCAL support
2 of 13 platforms reviewed offer it, 1 in part, 10 do not say
Executable BPMN workflow
0 of 13 platforms reviewed offer it, 9 in part
- AlloyGRC
- Offered by a reviewed platform
- Offered in part, or conditionally
- Not offered
- Publishes nothing either way
Source: Avint's capabilities and competitive comparison, September 2026. Platforms are counted, not named. A platform counts as offering a capability only where its own published material says so without a condition attached.
See it installed, not hosted.
We demo on synthetic data so you see everything without exposing anything. Then we install it against your own sources.