For mid-market organisations
Run the whole security program in one system, without a GRC team.
For the security leader in an organisation of 100 to 2,000 people who owns the program, the audit and the board report. Alvor holds the risk register, the frameworks, the suppliers and the program in one place, and the rest of the organisation works in it too.
One record
Program, risks, controls and suppliers
Engineers
Submit designs for review
Secure by Design
Process owners
Rate the impact of a disruption
Business Continuity
Requesters
File a new vendor
Third-Party Risk Management
Staff
Attest policies
Policy
Risk owners
Treat or accept a risk
Risk Management
Security leader
Reads the board view
Security Management
Mid-market teams come to us when one person is answering everyone.
Board
What our risk exposure is, and what changed since last quarter.
Every quarter
Certification body
Evidence for each ISO 27001:2022 control in scope, and the Statement of Applicability.
Certification audit
Customer or prime contractor
Your Essential Eight maturity level, written into the contract.
At tender
APRA
How the information security of your third parties is assessed under CPS 234.
Supervisory review
With Alvor
What you do with Alvor.
Hand the board a pack in one click
Programs hold projects and projects hold tasks, and progress rolls up as work completes. KPIs carry targets, and the maturity assessment shows where you stand against where you want to be. One click on the dashboard produces a board pack PDF from that live data.
Security ManagementGive every risk an owner and a decision
Each risk is scored for likelihood and impact, checked against your appetite, and given an owner and a treatment. When the business accepts what is left, the acceptance records its conditions, its scope and the date it expires.
Risk ManagementAttach evidence once and reuse it
Install the frameworks you answer to, such as ISO 27001:2022, the Essential Eight or APRA CPS 234. Evidence attached once is reused across the frameworks it serves, and each control's status is set by an audit, an automated check or a recorded override.
ComplianceAssess suppliers in one workflow
A requester files the vendor, the vendor answers the questionnaire in the external vendor portal, an analyst scores the assessment, and the tier sets when it is reviewed again. Every vendor ends with a named decision on the risk that remains.
Third-Party Risk ManagementWhat it replaces
The spreadsheets and decks a security leader keeps alive by hand.
Most mid-market programs run on files only one person understands. Each of these becomes a record with an owner and a history.
The KPI deck rebuilt each quarter
KPIs with targets and data points, and a board pack produced from live data.
The risk spreadsheet with a score column
A register where every risk has an owner, a treatment, a verdict against appetite and a recorded acceptance.
The vendor spreadsheet nobody reads
A tier, a scored assessment, a next review date and a named decision for every supplier.
The maturity workbook on one consultant's laptop
A maturity assessment in Security Management, scored the same way every time.
The audit folder rebuilt every year
Controls that keep their evidence, owners and status between audits.
Questions
Common questions about Alvor for mid-market teams
It keeps the program, the risk register, the frameworks and the suppliers in one system, so the work one person used to keep in spreadsheets has owners, deadlines and a history. The people outside security do their part in it directly: engineers submit designs, process owners rate impact, requesters file vendors and staff attest policies.
Get started
See how Alvor works for your role
Whether you lead security, run IT, manage compliance, or sit in the C-suite - we'll show you your view.