What is VAPT for compliance and why do auditors ask for it?

VAPT (vulnerability assessment and penetration testing) is the security testing evidence frameworks like PCI DSS, ISO 27001 and POPIA require on a recurring basis. AIMI AttackIQ runs continuous VAPT mapped to MITRE ATT&CK and regenerates audit-ready reports on every run, so compliance evidence is always current instead of a once-a-year scramble.

Does AIMI provide penetration testing for PCI DSS, ISO 27001 or POPIA compliance in Africa?

Yes. AIMI AttackIQ delivers continuous penetration testing and vulnerability assessment for enterprises in South Africa, Zimbabwe, Zambia and Kenya, producing assessor-ready reports mapped to PCI DSS, ISO 27001 and POPIA control requirements.

How does AIMI help with FIC Act compliance in South Africa?

AIMI automates PEP and sanctions screening, adverse-media checks and suspicious-activity report (SAR) preparation under FIC Act Section 29, with human approval gates on every consequential action.

Launching soon · founding cohort forming

27 AI agents. One unified risk operations platform.

Q: What fraud-intelligence capabilities does AIMI FraudShield include?

FraudShield combines real-time transaction anomaly detection with counterparty cross-examination: PEP and sanctions screening, cited adverse media, breach exposure, South African case-law search, entity-relationship graphs across companies and directors, mule-network detection, and FIC Act Section 29 SAR drafting.

Continuous attack simulation, autonomous SOC triage, real-time fraud intelligence, and compliance automation — built for African enterprises. A human approves every consequential action.

Apply for 30-Day VAPT POV → Explore the live demo

Johannesburg · Harare · Lusaka · Nairobi

◆ The Uncomfortable Part

Your last penetration test is already out of date.

Point-in-time testing is a photograph; your attack surface is a movie. Three truths security teams learn the hard way — then what to do about it.

PASSIVE SCAN · PUBLIC OSINT ONLY · NO PORTS TOUCHED FREE

WHOIS · DNS · TLS · security headers · CT-log subdomains · reputation. 5 scans/min per IP.

That was the view from the street. No ports probed, no attack paths walked, no exploitable findings. The 30-day Continuous VAPT POV shows you what an attacker actually gets — mapped to MITRE ATT&CK, rolled into a live 0–100 risk score.

Apply for the 30-day POV →

◆ Take Action

Grade your public attack surface in under a minute. Free, passive, no signup — the same first move an attacker makes.

See what an attacker sees: DNS, TLS, security headers, forgotten subdomains
Walk away with a board-ready grade for your own domain, today
Like knowing? AttackIQ keeps it current — continuous testing with audit-ready evidence for PCI DSS, ISO 27001 & POPIA

Attackers don’t schedule annual assessments. The gap between what your last audit found and what is true right now is where breaches live.

Most African enterprises discover their exposure from an incident report. The rest discover it from a regulator.

Once you’ve seen a live 0–100 risk score for your own estate, not knowing stops being a posture. It becomes a decision.

◆ What’s Coming

Six products. One pane of glass.

Colour-coded the way security teams already think — red attacks, blue defends, green proves it, purple governs it.

Red Team · Offense

AIMI AttackIQ

Continuous VAPT that never sleeps. Every finding mapped to MITRE ATT&CK — 14 tactics, 200+ techniques — rated for exploitability and asset criticality, and rolled into a live 0–100 risk score your board can read. Audit-ready evidence for PCI DSS, ISO 27001, and POPIA compliance — penetration testing reports your assessor accepts, regenerated on every run.

MITRE ATT&CK-mappedLive 0–100 risk scorePCI DSS · ISO 27001 · POPIA evidenceAlways-on offense

Open the live demo →

Blue Team · Defense

AIMI CyberWatch

An AI-run Security Operations Centre replicating the three-tier model with specialist agents — triaging ~80% of Tier-1 alerts autonomously, containing in seconds rather than hours, and stopping at a human approval gate before anything consequential happens.

~80% Tier-1 automationSeconds-not-hours containmentHuman approval gates

Open the live demo →

Fraud Intelligence

AIMI FraudShield

Real-time fraud detection and financial-crime intelligence tuned to African banking, fintech, and payment rails — behavioural and transaction analysis that catches fraud patterns as they emerge, not after the write-off. Every counterparty is cross-examined end-to-end: PEP & sanctions screening, cited adverse media, breach exposure, South African case-law search, and an entity graph that connects companies, directors, and mule networks — with FIC Act Section 29 SAR drafting built in.

Real-time detectionBehavioural analysisPEP & sanctions screeningAdverse media & case lawEntity graphBuilt for African rails

Open the live demo →

Green · Prove It

AIMI ComplianceOS

Automated governance, risk, and compliance across all 5 NIST CSF functions — controls mapped to frameworks, implementation evidence collected while you focus on critical issues, and manual audit effort cut to review-and-sign.

5 NIST CSF functionsEvidence automationAudit-ready

Open the live demo →

Regulatory Intelligence

AIMI Regulator Intelligence Cloud

Regulatory intelligence and reporting tailored to your jurisdictions — know what’s changing before your compliance deadline does.

African jurisdictionsChange trackingTailored reporting

Open the live demo →

The Full Suite

AIMI Security Fabric

The unified platform that ties it all together. 27 agents, one operating picture across cyber, fraud, compliance, and SOC — and one accountable human in the loop.

One pane of glass27 agentsUnified risk view

Open the live demo →

◆ Capability, Quantified

The numbers the platform is built to move.

Composite risk score ▾ 30 pts / 90 days

Every finding scored, fixed, re-tested — the number your board watches goes down and stays down.

Tier-1 alert triage virtual SOC

~80%auto-triaged

Resolved by agents 80%

Escalated to a human 20%

Agents clear the noise. People make the calls that matter.

Findings mapped / week MITRE ATT&CK

Coverage compounds — every week the map of your estate gets sharper.

MITRE ATT&CK coverage 14 / 14 tactics

Reconnaissance to impact: 200+ techniques continuously exercised across all 14 enterprise tactics — not once a year, every day.

27AI agents, one platform

5 / 5NIST CSF functions covered

100%consequential actions human-gated

Illustrative pilot-simulation data

“Agentic, not autonomous. No consequential action executes without a named human approving it.”

◆ The AIMI operating principle

◆ Founding Pilot Cohort

The platform launches soon. The founding pilot cohort is forming now.

We onboard a limited number of enterprises per region into a 30-day trial before general availability. Founding pilots get priority onboarding, direct access to the engineering team, and founding terms that won’t survive launch.

Start a 30-day trial → Explore the live demo

◆ Threatwire · powered by AIMI News

The Africa cyber wire.

One consolidated channel for the region’s cyber news — attacks, breaches, regulator actions and zero-days. The AIMI News agent continuously researches the web, cross-checks each story against its original source, and verifies every link before anything is published — cyber news as a service, kept fresh around the clock.

threatwire · africa cyber wire ● LIVE

Pulling latest incidents…