Catch where your ISMS records disagree with each other, or with reality
Your AI compares your records with each other and with your live systems. ISMS Copilot says which differences an auditor would raise and how to fix them. You make the changes.
Drift is the finding nobody wrote
Many ISMS findings are not missing policies. They are records that stopped agreeing: a scope list that misses vendors other registers already name, an access review table that still shows an old status after a correction further down, an inventory that does not match what is running. Each one is easy to fix and easy to miss, because it sits between documents. Your AI can read all of them, and with read-only credentials it can check the live systems too. That part is mechanical. Which differences an auditor would raise, and what the right fix is, is the judgment ISMS Copilot adds.
Run it every week: the audit-readiness routine →How the work splits
- 01
Your AI compares
Lists against the single source they repeat, each record against itself, and live readings (machines, tokens, members) against the inventory.
- 02
ISMS Copilot judges
It says which differences an auditor would raise, under which control, and what the fix is.
- 03
You fix the source
You correct the record or the system. Credentials and revocations stay with you.
Receipt: our own ISMS, September and October 2026
- Lists vs their source
- The ISMS scope list missed 3 sub-processors that the inventory, the third-party register and the records of processing already named
- Records vs themselves
- An access review table that contradicted its own later correction
- Reality vs records
- The September 2026 access review's live read of the hosting provider's token list: 20 organization tokens never revoked, several unnamed, one sitting in an app that had been destroyed
- ISMS Copilot's part
- Said which items an auditor would raise and the fix for each
Frequently Asked Questions
What access does my AI need?
Read access to your files and registers, and read-only credentials for each system it checks live, for example a source-control token that can only read members. ISMS Copilot needs none: it has no connector to your systems and judges what your AI sends.
Can it fix the drift itself?
Your AI can prepare the fix when the right value is already decided elsewhere in the ISMS, such as a version header or a list row. Anything that needs judgment, such as a risk score or closing a finding, stays with you.
How often should this run?
Weekly works well, before your regular ISMS sitting. The docs have a ready-made weekly routine for it.
Find the drift before the auditor does
Your AI compares the records, ISMS Copilot says what matters, you fix the source.