Everything you govern, and how it connects.
Apps, vendors, processes, and AI agents in one place, from a startup’s first twenty tools to a company with hundreds of business units. Add only the structure you need. Pick any item, or any mix of them, to see its compliance, its risk, and everything it touches.
| Item | Where it sits | Compliance | Residual risk |
|---|---|---|---|
| Acme | Company | 81% passing | $640K |
| Engineering | Business unit | Partial | $450K |
| Customer portal | App, under Engineering | Partial | $410K |
| Data warehouse | App, under Engineering | Passed | $40K |
| Employee laptops | Company level, 10,000 as one | One assessment | $120K |
| Stripe | Vendor, Tier 1, owned by Finance | In progress | $70K |
| Corporate identity | App, company level | Passed | $0 |
TruOps keeps everything you govern in one inventory. Connect your tools and your apps, vendors, and AI tools show up as a list, with nothing to assign. Add ties and fields when they help. Pick any item or any mix of items to see compliance, open findings, and residual risk, and group them any way you run the company. A person approves every score.
- What’s in it
- Business units, processes, apps, vendors, AI agents, and your own types
- How items connect
- Optional ties: owns, runs on, depends on, provides, has access to
- On every item
- Compliance, open findings, residual risk in dollars, and tool detail
- Structure
- Optional. Start with a list and group by any field as you grow
What you're probably using today
| What you use now | Where it falls short | With TruOps |
|---|---|---|
| Spreadsheets, shared drives, and email | Your program lives in folders named after last year's audit. Owners paste screenshots the week before fieldwork, and nothing is dated, so you can't show what was true last quarter. | Upload those same files. TruOps pre-fills the assessment from them, cites every answer, and keeps technical checks running so you have evidence for the whole period. |
| Enterprise GRC suites | They can model almost anything, but that flexibility usually runs through implementation partners and admins, so every change turns into a project. | AI reads your existing documents and sets up the program. Your first assessment opens pre-filled with sources, and you make changes by asking in plain language. |
| Point tools that don't connect | A TPRM portal here, a risk register there, findings in your ticketing tool, and the board pack in slides. Each tells its own story, so leadership gets three different answers. | One place for assessments, evidence, and risk. Upload a document, answer a question, or check a control once, and it counts everywhere it applies. |
Start with a list
A ten-person startup connects Google Workspace and Okta and gets a list of its apps, vendors, and AI tools, with nothing to assign. Open any item to see the controls that apply, which ones pass, its open findings, and its risk. TruPilot fills in owners and ties when your tools know them.
Ask what it touches
A new ransomware strain is in the news. Ask TruPilot which of your systems it could reach.
- FindTruPilot turns the advisory into checks: the vulnerability it exploits, exposed remote access, endpoints with no EDR, and backups that can be overwritten. It runs them against your inventory and tool data and finds 23 servers.
- FollowIt follows the ties out from those servers. Nine apps run on them, six processes depend on those apps, two vendors have access, and one AI agent can write to the billing database.
- WeighYou see the controls that matter for this threat on exactly those items, the findings already open on them, and the dollars at risk across the six processes.
- ActSave the set as a scope. Assess it, send the gaps to be fixed as one grouped finding, or add the risk to the register. As each server is patched, the numbers update.
The ties that matter
Each tie answers a different question, and every tie is optional. Together they show how far one problem can travel.
| Tie | Example | What it tells you |
|---|---|---|
| Owns | Finance owns the refunds process | Whose compliance and risk it adds to |
| Runs on | The customer portal runs on 14 production servers | Which failed checks below it count against it |
| Depends on | Refunds depends on the payments vendor | What stops if that vendor has an outage or a breach |
| Provides | The payments vendor provides card processing for the portal | Which vendor findings reach your apps |
| Has access to | The billing agent can write to the data warehouse | How far a compromised agent or account could reach |
Add it up any way you run it
Group the inventory by business unit, division, product line, region, or any field you add. Each group shows its subtotal, and every item counts once, so the company total stays the same whichever way you look. Items with no owner count as company-wide, so nothing is dropped.
A failed control on a server shows on that server, on the app that runs on it, and on the unit that owns the app, wherever those ties exist. Fifty servers failing the same check become one finding that lists all fifty.
Assess look-alikes once
Ten thousand laptops are one thing to assess. A rule such as every server in production keeps the set current, so new ones join on their own. The set carries one result, and its findings and dollars still add up.
Kept current by your tools
Connect Okta, your cloud accounts, Tenable, CrowdStrike, or Intune. TruOps builds the inventory and its ties from them and keeps both current. Each asset carries what those tools know, such as open vulnerabilities and EDR status, as columns you can filter. You can also bring in a spreadsheet, add an item by hand, or add a type of your own.
Bring your history
Moving from TruOps 1.0 or another GRC tool? Drop your exports into TruPilot. It reads your assets, vendors, controls, questionnaires, and past results, asks the few things only you can decide, such as whether to restart assessments that were still open, and sets up the rest. Old results land on each item with their dates, newer ones stay as they are, and one step undoes the import.
Ready for the auditor
Pick a control and an audit period. TruOps shows every item the control covers, which ones held for the whole period, and the day anything failed. Click an item to see each piece of evidence with its source and date, the last assessment answer and who approved it, and the frameworks that read from the control.
How TruOps helps
- Start with a list
- Owners, ties, and fields are optional. Add them as you grow.
- Connected map
- Tie items to what owns them, what they run on, and what depends on them.
- Add up any way
- Group by unit, product line, region, or your own fields. The company total stays the same.
- Assess look-alikes once
- A rule such as every production server, so new ones join on their own.
- Bring your history
- Import TruOps 1.0 or another GRC tool by talking to TruPilot.
- Your own types
- Data centers, contracts, offices, or anything else you govern.
Questions
What can go in the inventory?
Apps, vendors, business units, processes, and AI agents, plus any type you add, such as projects, data centers, contracts, or offices.
Does every item need an owner?
No. A vendor or an app can stand on its own and still counts toward the company total. TruPilot suggests owners and ties when your connected tools know them.
Do we have to map every tie by hand?
No. TruOps reads ties from the tools you connect, such as which servers an app runs on from your cloud accounts. TruPilot suggests the rest for you to confirm, and you can add or change any tie by hand.
Can we add it up by product line or region?
Yes. Group the table by any field, such as business unit, division, product line, or region. Each item counts once, so the company total is the same in every view.
What can I ask about my inventory?
Questions that follow the ties between items. Which processes depend on this vendor? Which apps run on servers with this vulnerability? Which AI agents can write to customer data? TruPilot answers with the list of items and the records behind each one.
Where do the dollar figures come from?
From the risk assessment on that item: likelihood, impact, and the controls in place. They add up by any grouping you choose and to the company total. A person approves the score, and every figure opens to the evidence behind it.
Can we bring our data from TruOps 1.0 or another GRC tool?
Yes. Drop your exports into TruPilot. It asks a few questions, such as whether to restart assessments that were still open, and sets up the rest. Old results keep their dates, and one step undoes the import.
Can it find AI tools nobody approved?
Connect Okta or Entra and TruOps lists the AI tools your people sign in to, including ones nobody approved, next to the agents built on your own platforms.
Do we have to rip out the tools we already use?
No. TruOps connects to your cloud, identity, endpoint, vulnerability, and code tools. Spreadsheets, prior reports, and policies upload into the Data Room. If you're moving from a SOC 2 automation tool or an enterprise GRC suite, you bring over your frameworks, evidence, vendors, and risks.
Can we bring our existing assessments, control lists, and vendor files?
Yes. Upload workbooks, reports, policies, and vendor exports. TruOps turns them into structured questionnaires, controls, and risks, each linked to the file it came from, for you to review.
Related
Compliance, risk, vendor, and customer assessments in one place.
→PlatformVendor risk (TPRM)Tier vendors, read their evidence first, and ask only what it can't answer.
→PlatformControl testingEvery control tested continuously, with verified tests for your tools and AI-written tests for the rest.
→PlatformRisk managementRisks from anywhere, drafted by TruPilot, approved by a person, and tracked in ratings or dollars.
→PlatformIntegrationsYour security stack plus 800+ integrations for cloud, identity, EDR, HRIS, ITSM, and other tools.
→RolesCISOAnswer the board with confidence and show the program's real progress.
→See it run on your own data.
Book 30 minutes with a GRC specialist. Bring a real document, like a SOC 2 report, risk register, or vendor list (redacted is fine), and we'll show TruOps AI working on it.