One score, one VaR, one what-if simulator. Cluu turns your cloud inventory into a defendable board report — and into a roadmap your CISO can actually run.
Every audit committee asks it. Most teams answer with a 0–100 score nobody can defend in dollars, or a four-month consultancy that costs more than the controls. Cluu replaces both — with the same screen, refreshed every Monday.
| Scenario | LEF | ALE | VaR 99% |
|---|---|---|---|
| E1 — Ransomware on Core Banking | 1.40 | USD 94.6M | USD 298.1M |
| E2 — Customer Data Exfiltration | 2.20 | USD 118.6M | USD 362.1M |
| E3 — DDoS on APIs / Digital Channels | 1.80 | USD 61.4M | USD 146.3M |
| E4 — Supply-Chain Compromise | 0.80 | USD 52.1M | USD 211.4M |
| E5 — Mass GenAI-Enabled Fraud | 2.80 | USD 113.4M | USD 186.0M |
A read-only AWS role. CloudTrail, Config, VPC Flow. Nothing leaves your tenant.
The Investigator narrative ranks every finding, names the responsible owner, and prices it.
Move the budget in the What-If, ship the initiatives, hand the board pack to your regulator.
Cluu replaces an $300K, 4-month consulting engagement with a screen we open every Monday. The Resilience Score and FAIR VaR will be in your quarterly board packs by default now.
Bottom-up to 1.5–2% of the cloud spend you protect. Self-serve through AWS Marketplace at the entry tier; field-sales for regulated workloads.
Sure — but you'd be replicating three years of work: CloudTrail ingestion, an LLM narrative engine, FAIR Monte Carlo, controls mapped to regulators. Most internal attempts stall at the live-inventory stage. Buying us is ~18× cheaper.
Read-only IAM role. Tenant-bounded perimeter. SOC 2 Type II in progress. Encryption at rest and in transit. We never store raw payloads — only metadata and aggregates.
AWS-first today; FOCUS-1.0 ingestion plus Azure / GCP on the v2 roadmap (H2 2026). Most LATAM customers are AWS-majority.We can deploy the solution in the private cloud of our customer, but it has costs and support implications. For that, we may have a talk.
Standard 30-day exit clause. We export your full ICR history, FAIR calibrations, and What-If scenarios as JSON/CSV. No lock-in design.
ICR is a weighted composite over NIST CSF 2.0 dimensions, with weights documented and adjustable. Every score is reproducible from the underlying inventory — defendable to a CMF, DORA or SEC examiner without a black box.
Every distribution is editable — LEF, ALE, contact frequency, threat-event frequency. We ship sensible defaults from public data + your audited financials, then your team calibrates. The full Monte Carlo is rerun in seconds.
One read-only role. Five minutes to the first ICR. Four weeks to the first FAIR VaR delivered to the board.