Lens Platform Documentation

Comprehensive guide for Crownstone consultants conducting cybersecurity assessments

Platform Overview

The Lens Assessment Platform is Crownstone's proprietary cybersecurity assessment tool implementing the Cybersecurist Lens™ framework. It enables consultants to systematically identify systemic security risks that traditional tools miss.

Full Engagement Workflow

Quick Start Guide

Get started with a new assessment in minutes by following these steps:

1. Create the Client Record
   Go to Dashboard > Clients tab and click "New Client". Enter company name, industry, and primary contact information.
2. Create a New Assessment
   From the Dashboard, click "New Assessment". Select the client, set assessment type, and define scope parameters.
3. Configure API Integrations
   If the client uses Snyk or Wiz, add their API credentials in Assessment Settings > Connectors to pull findings automatically.
4. Import or Add Findings
   Import scan results from security tools or manually add findings discovered during interviews and documentation review.
5. Review and Map to Lens Questions
   Review each finding, accept/modify/reject, and map to the appropriate Lens question (Q1-Q5) to enable systemic analysis.
6. Generate Recommendations
   Use the AI recommendation generator to create actionable guidance for each accepted finding.
7. Create Deliverables
   Generate the assessment report, executive briefing, and remediation roadmap from the assessment page.

Client Intake Process

The client intake process captures essential information needed to scope and conduct the assessment effectively.

Required Client Information

Using the Intake Form

Navigate to intake.html and share the link with the client. The form captures:

• Company demographics and industry classification
• Contact information (name, email, phone, role)
• Assessment trigger (compliance mandate, breach response, board requirement, etc.)
• Current security maturity self-assessment
• Budget range and timeline preference
• Top security concerns and priorities

Pipeline Integration

When a prospect submits the intake form:

1. Lead Created Automatically
   A new lead is created in the Sales Pipeline with all intake data, including trigger, maturity, budget, and concerns.
2. Package Recommended
   The system analyzes the intake data and recommends a service package (Standard, Plus, or Premium) with estimated value.
3. SOW Can Be Generated
   From the intake data, a Statement of Work can be generated immediately, customized to the prospect's needs.

Discovery Assessment

The Discovery Assessment is a 12-question self-assessment wizard that prospects can complete anonymously. It detects Lens signals and generates risk analysis to qualify leads.

Assessment Flow

How to Use

1. Share the Discovery Link
   Share discovery.html with prospects or embed it on the marketing site. No login required.
2. Prospect Selects Context
   The wizard asks whether the environment is cloud or datacenter, then adjusts terminology accordingly.
3. Answers Drive Signal Detection
   Each answer triggers real-time Lens signal calculations for Q1-Q5 (Investment Misalignment, Process Dependency, Assumption Decay, Silent Accumulation, Visibility Gaps).
4. Results Show Risk Profile
   After completing all questions, the prospect sees their risk profile with Q1-Q5 signal scores and an overall risk rating.
5. Lead Capture
   Optionally capture email, name, company, and role. Completed sessions appear in the Sales Pipeline for follow-up.
6. Convert to Client
   Use the convert endpoint to create a full client and assessment from the discovery data, preserving all signal analysis.

Lens Signals Detected

Environment Profiling

The Environment Profiling wizard is a comprehensive 29-question assessment organized into 6 sections. It produces a maturity score, engagement recommendation, and market intelligence tags for existing clients.

Assessment Sections

How to Use

1. Navigate to Environment Discovery
   Open environment.html from the platform dashboard or client engagement tools.
2. Select the Client
   Choose an existing client to profile. The profile is linked to the client record.
3. Complete 6-Section Wizard
   Work through each section. Answers are partially saved as you progress, so you can resume later.
4. Review Maturity Score
   The system calculates a 0-100 maturity score with four levels: Nascent (0-25), Developing (26-50), Established (51-75), Optimized (76-100).
5. Get Engagement Recommendation
   Based on maturity score and profile data, the system recommends the most appropriate service package (Security Advisory, Technology Strategy, Leadership Clarity, or Systems Diagnosis).

Outputs

ROI Calculator

The ROI Calculator generates three-scenario financial projections demonstrating the value of security investment, using industry-specific benchmarks.

How to Use

1. Navigate to ROI Calculator
   Open roi-calculator.html from the client engagement tools section of the dashboard.
2. Select Industry
   Choose from 9 industries: Healthcare, Financial Services, Technology, Manufacturing, Retail, Government, Education, Energy, or Other. Each has industry-specific benchmarks.
3. Enter Company Size and Maturity
   Input employee count and current security maturity level. These factors adjust the calculation model.
4. Review Three Scenarios
   The calculator generates Conservative, Expected, and Optimistic projections with year-over-year savings breakdown.

Projection Components

Case Studies

Reference case studies from past engagements, filterable by Lens question, context, and industry. Use them during client conversations to illustrate the value of the Lens approach.

How to Use

1. Navigate to Case Studies
   Open case-studies.html from the client engagement tools section.
2. Filter by Lens Question
   Select Q1-Q5 to find case studies relevant to specific systemic issues you're discussing with a client.
3. Filter by Context
   Filter by cloud, datacenter, or hybrid to match the client's environment.
4. View Outcomes
   Each case study includes quantified outcomes (cost savings, time reduction, risk improvement) and engagement timeline.

Case Study Content

• Context: Industry, organization size, environment type
• Lens Questions: Which Q1-Q5 questions the engagement addressed
• Challenge: What systemic issues were identified
• Approach: How the Lens framework guided the engagement
• Outcomes: Quantified results with metrics
• Timeline: Engagement duration and key milestones

Sales Pipeline

The Sales Pipeline tracks leads from initial discovery through conversion to client. It integrates with Discovery sessions and the Intake Form to automatically create and qualify leads.

Pipeline Stages

How to Use

1. Navigate to Pipeline
   Open pipeline.html from the dashboard. The pipeline shows all leads with filtering by stage, source, and search.
2. Create Leads
   Leads are created automatically from Discovery sessions, Intake Form submissions, or manually via the "New Lead" button. Sources include: discovery, intake_form, referral, website, and other.
3. Review Lead Details
   Click a lead to see contact info, company details, Discovery signals (if applicable), recommended package, and estimated value.
4. Update Stage
   Use the stage selector to move leads through the pipeline. Stage changes are timestamped for tracking.
5. Generate SOW
   From the lead detail, generate a Statement of Work with signal-customized scope based on Discovery data.
6. Convert to Client
   When a lead is won, click "Convert" to create a Client record and optionally an Assessment, preserving all lead data.

Pipeline Statistics

The pipeline dashboard shows key metrics:

• Total Pipeline Value: Sum of estimated values for active leads
• Conversion Rate: Percentage of leads that became clients
• Stage Distribution: Count of leads at each stage
• Average Deal Size: Mean estimated value of won deals

SOW Management

Generate, edit, and manage Statements of Work (SOWs) with automated content based on Discovery signals and package selection.

Available Packages

How to Use

1. Navigate to SOW Management
   Open sow.html from the dashboard or from a lead's detail page.
2. Generate New SOW
   Click "Generate SOW" and select a lead and package. The system generates content based on Discovery signals, company profile, and package features.
3. Signal Customization
   If the lead has Discovery data, the SOW automatically includes signal-specific scope items. For example, a strong Q4 signal adds patch velocity analysis to the scope.
4. Edit SOW Content
   Edit individual sections (executive summary, scope, deliverables, timeline, pricing, terms) directly in the platform.
5. Update Status
   Track SOW through the workflow: Draft, Sent, Approved, Rejected, or Superseded.
6. Download PDF
   Download the SOW as a branded PDF for sending to the client.

SOW Sections

• Executive Summary: High-level engagement overview tailored to the prospect
• Scope of Work: Detailed scope items, adjusted by Discovery signals
• Deliverables: List of deliverables by package tier
• Timeline: Week-by-week execution plan
• Pricing: Package pricing with optional add-ons
• Terms & Conditions: Standard engagement terms

Scoping & Planning

Proper scoping ensures the assessment delivers maximum value within the engagement parameters.

Assessment Types

Scoping Checklist

• Define in-scope systems, networks, and applications
• Identify out-of-scope areas and document exclusions
• Confirm testing windows and change freeze periods
• Establish communication channels and escalation paths
• Request API credentials for security tool integrations
• Schedule stakeholder interviews
• Define deliverable expectations and timeline

Conducting Interviews

Stakeholder interviews are essential for understanding context that automated scans cannot capture. Each Lens question should inform your interview approach.

Interview Preparation

1. Review Intake Form Responses
   Understand the organization's stated security posture, tools, and concerns before interviews.
2. Identify Key Stakeholders
   CISO/Security Lead, IT Operations, Development Lead, Business Unit Owners, Compliance/Risk Manager.
3. Prepare Role-Specific Questions
   Tailor questions based on each stakeholder's domain and the Lens questions you need to explore.
4. Schedule 45-60 Minute Sessions
   Allow time for follow-up questions and note-taking. Record sessions with permission.

Lens-Aligned Interview Questions

Documenting Interview Findings

After each interview:

• Create findings in the platform for each identified issue
• Tag findings with the relevant Lens question (Q1-Q5)
• Note direct quotes that illustrate systemic issues
• Identify follow-up items requiring documentation or technical validation

Performing Security Scans

The Lens Platform integrates with multiple security scanning tools and supports importing results from 19+ scanner formats.

Supported Scanner Formats

Scan Coordination Best Practices

1. Coordinate Timing with Client
   Schedule scans during low-traffic periods. Avoid change freeze windows and critical business operations.
2. Document Scan Configuration
   Record scan policies, credentials used, and excluded targets. This ensures reproducibility and audit trail.
3. Run Authenticated Scans
   Credentialed scans provide deeper visibility. Coordinate with IT to obtain appropriate service accounts.
4. Export Results Promptly
   Export scan results in supported formats (JSON, CSV, native) immediately after completion for import.

API Connector Setup

Connect directly to client security tools to automatically pull findings into your assessment.

Adding a Connector

1. Navigate to Assessment Settings
   Open the assessment and click the Settings icon or navigate to the Connectors tab.
2. Select Connector Type
   Choose from available integrations: Snyk, Wiz, or custom API connectors.
3. Enter API Credentials
   Provide the API key, organization ID, and any required configuration. Credentials are encrypted at rest.
4. Test Connection
   Click "Test Connection" to verify the credentials work before saving.
5. Configure Sync Settings
   Set filters for which projects/resources to sync and the sync frequency.

Snyk Integration

Pull application security findings directly from the client's Snyk organization.

Obtaining Snyk API Credentials

The client needs to provide:

• API Token: Found in Snyk Account Settings > General > Auth Token
• Organization ID: Found in Organization Settings > General (UUID format)

What Gets Imported

Wiz Integration

Import cloud security findings from Wiz's Cloud Security Posture Management (CSPM) platform.

Obtaining Wiz API Credentials

The client needs to generate a Service Account:

1. Create Service Account in Wiz
   Navigate to Settings > Service Accounts > Create Service Account. Assign "Read" permissions.
2. Copy Client ID and Client Secret
   Save both values securely - the secret is only shown once during creation.
3. Note the API Endpoint URL
   Wiz has regional endpoints. Confirm which endpoint the client's tenant uses.

What Gets Imported

Importing Scan Data

For tools without direct API integration, import scan results using file uploads.

Import Process

1. Navigate to Import Page
   From the assessment, click "Import Scan" or navigate to import-scan.html
2. Select Scanner Type
   Choose the source scanner from the dropdown. This determines parsing logic.
3. Upload File
   Drag and drop or click to select the export file. Supported: JSON, CSV, XML (scanner-specific)
4. Map Fields (CSV only)
   For generic CSV imports, map columns to vulnerability fields: title, severity, description, CVE, etc.
5. Review and Confirm
   Preview imported findings, check for parsing issues, then confirm import.

Finding Review Workflow

The review workflow ensures every finding is validated, contextualized, and actionable before inclusion in deliverables.

Finding States

Review Process

1. Open Review Page
   Navigate to review.html from the assessment. Findings are listed by severity.
2. Select a Finding
   Click on a finding to view details, evidence, and scanner output in the right panel.
3. Validate the Finding
   Confirm the vulnerability exists, assess actual severity in context, identify affected assets.
4. Map to Lens Question
   Assign the finding to Q1-Q5 based on the systemic issue it represents. This enables pattern detection.
5. Set Status
   Accept, modify, or reject the finding. Add comments explaining any modifications.
6. Add Evidence
   Attach screenshots, logs, or documentation supporting the finding.

Cybersecurist Lens™ Framework

The Lens framework identifies systemic security issues through five strategic questions. Mapping findings to these questions enables pattern detection and strategic recommendations.

AI-Powered Recommendations

The platform uses Claude AI to generate comprehensive, context-aware recommendations for each finding.

Recommendation Dimensions

Generating Recommendations

1. Accept the Finding
   Only accepted findings can have recommendations generated. Review and set status first.
2. Click "Generate Recommendation"
   In the finding detail panel, click the generate button. The AI analyzes the finding with assessment context.
3. Review Generated Content
   Review all four dimensions, implementation steps, success metrics, and effort estimate.
4. Edit as Needed
   Modify any section to add client-specific context or adjust recommendations based on your expertise.
5. Mark as Reviewed
   Set "Analyst Reviewed" flag to indicate human validation of the AI-generated content.

Vulnerability Prioritization

The platform uses a sophisticated algorithm to prioritize vulnerabilities beyond just CVSS scores.

Prioritization Factors

Using the Vulnerabilities Page

Navigate to vulnerabilities.html to access the prioritized vulnerability view:

• Filter by severity: Focus on Critical/High first
• Sort by priority score: Combined algorithm score
• Group by asset: See which systems need most attention
• Track remediation status: Open, In Progress, Resolved, Risk Accepted

Assessment Reports

Generate comprehensive Word document reports containing all findings, recommendations, and remediation guidance.

Report Contents

• Executive Summary with key metrics and risk overview
• Findings organized by Lens question with systemic analysis
• Detailed recommendations with implementation steps
• Vulnerability inventory with prioritization scores
• Remediation roadmap with effort estimates
• Appendices with technical details and evidence

Generating Reports

1. Complete Finding Review
   Ensure all findings have been reviewed and have status set. Generate recommendations for accepted findings.
2. Navigate to Assessment
   Open the assessment from the Dashboard and click "Generate Report" in the actions menu.
3. Select Report Options
   Choose which sections to include, level of detail, and any custom branding requirements.
4. Generate and Download
   Click Generate. The report is created as a .docx file and downloaded automatically.

Executive Briefings

Create board-ready presentations summarizing assessment findings for executive audiences.

Briefing Format

Executive briefings are designed for 15-20 minute presentations covering:

• Overall security posture assessment (risk rating)
• Top 3-5 systemic risks requiring attention
• Business impact analysis in financial terms
• Recommended immediate actions
• 90-day remediation priorities

Using the Briefing Generator

1. Navigate to Briefings
   From the assessment, click "Executive Briefing" or go to briefing/index.html
2. Select Findings to Highlight
   Choose 3-5 critical findings that represent systemic issues for executive attention.
3. Customize Messaging
   Adjust the business context, industry comparisons, and recommended actions.
4. Generate Briefing
   The AI generates executive-appropriate language and talking points.
5. Export
   Download as PDF or copy to your presentation tool of choice.

Security Roadmaps

Generate comprehensive multi-year security roadmaps with phased execution plans, NIST CSF and CIS Controls alignment, and four-dimensional action items.

Roadmap Phases

How to Use

1. Navigate to Roadmap Tool
   Open roadmap.html from the dashboard deliverables section.
2. Generate Roadmap
   Select a client and assessment. The generator uses organization size, industry, maturity level, and Lens signals to create a tailored multi-year plan.
3. Review Phases and Actions
   Each phase contains categorized actions (Technical, Organizational, Operational, Strategic) with effort estimates, NIST/CIS mappings, and Lens alignment.
4. Track Execution
   Update action status (Not Started, In Progress, Completed, Blocked, Deferred) to track progress. Use bulk status update for efficiency.
5. Analyst Review
   Mark the roadmap as analyst-reviewed to indicate human validation of the AI-generated plan.

Action Categories

Framework Alignment

Each action is mapped to relevant frameworks:

• NIST CSF 2.0: Govern, Identify, Protect, Detect, Respond, Recover
• CIS Controls v8.1: Mapped to specific control numbers
• Lens Framework: Q1-Q5 alignment and signal addressed

GRC Documents

Generate, manage, and export governance, risk, and compliance documents from a library of templates covering 7+ compliance frameworks.

Document Types

Supported Frameworks

How to Use

1. Navigate to GRC Documents
   Open grc-documents.html from the dashboard. The page has four tabs: Documents, Templates, Packages, and Compliance Matrix.
2. Browse Templates
   Filter templates by document type, category, or framework. Each template shows applicable frameworks, estimated pages, and review frequency.
3. Generate Single Document
   Select a template and generate a document for a client. The generator uses client context (industry, maturity, applicable frameworks) to customize content.
4. Generate Document Package
   Use pre-defined packages (e.g., "SOC 2 Essential", "ISO 27001 Core") to generate multiple related documents at once.
5. Edit Sections
   Each generated document has editable sections. Update content to reflect client-specific details and requirements.
6. Approve and Export
   Route through the approval workflow (Draft, Review, Approved, Active, Archived). Export as PDF or Markdown.

Compliance Tools

• Compliance Matrix: View framework coverage across all documents for a client, identifying which controls are addressed
• Gap Analysis: Identify missing documents and unaddressed framework requirements
• Version History: Track all changes to documents with version snapshots and change summaries
• Recommended Packages: AI-driven package recommendations based on client context and compliance gaps

Document Workflow

SLA Management

Define and enforce remediation deadlines with policy-based SLA tracking and automated escalation alerts.

Creating SLA Policies

SLA policies define remediation timeframes based on vulnerability severity and asset criticality:

Escalation Workflow

1. Warning Alert (75% of SLA)
   Notification sent to assigned owner when 75% of remediation time has elapsed.
2. Breach Alert (100% of SLA)
   SLA violation recorded, escalation notification sent to management channels.
3. Critical Escalation (125% of SLA)
   Executive notification triggered for unresolved critical/high severity items.

Ticket Integration

Automatically create and synchronize remediation tickets with Jira and ServiceNow for streamlined vulnerability management.

Supported Platforms

Configuration

1. Navigate to Ticket Integrations
   Go to Client Settings > Integrations > Ticket Systems.
2. Add Integration
   Select Jira or ServiceNow, enter base URL, and provide API credentials.
3. Configure Mapping
   Map Lens priority scores to ticket priorities and select default project/queue.
4. Enable Auto-Create (Optional)
   Automatically create tickets for new vulnerabilities above a severity threshold.

Bidirectional Sync

Ticket status changes are synchronized back to Lens via webhooks:

• Ticket closed → Triggers patch verification
• Verification passes → Vulnerability marked remediated
• Verification fails → Ticket reopened with comment

Threat Intelligence

Enrich vulnerability data with real-time threat intelligence from CISA KEV and EPSS for improved prioritization.

Intelligence Sources

Enrichment Process

1. Automatic Enrichment
   New vulnerabilities are automatically enriched with KEV/EPSS data on import.
2. Manual Bulk Enrichment
   Re-enrich existing vulnerabilities via Assessment Actions > Enrich Threat Intel.
3. Priority Score Update
   Priority scores are recalculated incorporating KEV (+10 boost) and EPSS factors.

Notification Channels

Configure multi-channel notifications for SLA alerts, verification results, and security updates.

Supported Channels

Alert Levels

Channel Configuration

1. Navigate to Notifications
   Go to Client Settings > Notification Channels.
2. Add Channel
   Select channel type and provide configuration (webhook URL, SMTP settings, etc.).
3. Set Minimum Alert Level
   Configure which alert levels trigger notifications on this channel.
4. Test Channel
   Send a test notification to verify configuration is correct.

Executive Dashboard

Real-time strategic visibility into security posture with Lens scores, remediation velocity, and compliance metrics.

Dashboard Components

Top Risks View

Prioritized list of the most critical vulnerabilities based on:

• CISA KEV status (known exploited)
• EPSS score (exploitation probability)
• Asset criticality and business context
• Dwell time (days since detection)
• SLA violation status

Snapshot History

Daily snapshots capture metrics for historical trend analysis. Snapshots are automatically captured at midnight UTC and include all dashboard metrics for point-in-time comparison.

Early Warning System

Proactive detection of security posture degradation through pattern analysis and anomaly detection.

Detection Patterns

Alert Workflow

1. Detection
   Scheduled analysis runs every 4 hours scanning for patterns across all active assessments.
2. Alert Creation
   Detected patterns create early warning alerts with severity, details, and recommendations.
3. Notification
   Alerts trigger notifications via configured channels based on severity.
4. Resolution
   Alerts can be dismissed with reason or automatically resolve when condition clears.

Patch Verification

Validate that remediation actions are effective by comparing scan results before and after patching.

Verification Triggers

• Ticket Webhook: Automatically triggered when Jira/ServiceNow ticket is closed
• Manual: Consultant-initiated verification from vulnerability details
• Scheduled: Periodic verification of recently remediated items

Verification Process

1. Trigger Verification
   Verification is triggered via webhook, manual action, or schedule.
2. Compare Scan Results
   System compares latest scan data against the vulnerability's original detection.
3. Determine Outcome
   If vulnerability no longer detected → Remediated. If still present → Failed.
4. Take Action
   Success: Mark as remediated. Failure: Reopen ticket, send notification.

Verification History

All verification attempts are logged for audit purposes with:

• Timestamp and trigger source
• Verification outcome (remediated/still present)
• Scan source used for verification
• Actions taken (ticket reopened, notification sent)

AI Security Platform

The AI Security Platform provides comprehensive AI/ML security assessment capabilities integrating 7 major frameworks for identifying and mitigating AI-specific risks.

Tiered Offering

Integrated Frameworks

AI Discovery (Free Tier)

The AI Discovery tool provides anonymous prospects with a quick AI security assessment, detecting framework signals and capturing leads for conversion.

Assessment Flow

Framework Signal Detection

Each answer triggers signal calculations for:

• OWASP LLM Signals - Maps to specific LLM01-LLM10 vulnerabilities
• MITRE ATLAS Signals - Identifies relevant tactics and techniques
• EU AI Act Risk Level - Classifies as unacceptable, high, limited, or minimal
• Governance Signals - Detects policy, oversight, and documentation gaps

API Endpoints

AI Assessment (Standard Tier)

The AI Security Assessment provides comprehensive 50-question evaluation across all 7 frameworks, generating maturity scores and detailed compliance readiness metrics.

Assessment Sections

Maturity Scoring

The assessment calculates a 0-100 maturity score with four levels:

• Nascent (0-25) - Ad-hoc AI usage with minimal security controls
• Developing (26-50) - Basic governance and emerging technical controls
• Established (51-75) - Formal AI security program with framework alignment
• Optimized (76-100) - Continuous improvement with advanced threat detection

Framework Scores

Individual scores calculated for each framework:

• OWASP LLM Score - Coverage against LLM Top 10 vulnerabilities
• OWASP Agentic Score - Coverage for agentic AI risks
• MITRE ATLAS Coverage - Percentage of tactics with controls
• NIST AI RMF Alignment - Govern, Map, Measure, Manage scores
• EU AI Act Readiness - Compliance percentage with deadline tracking
• ISO 42001 Readiness - Management system alignment
• Gartner MCP Score - Position on 5-step maturity journey

API Endpoints

AI Dashboard (Premium Tier)

The AI Security Dashboard provides continuous monitoring, historical trending, and red team result tracking for enterprise clients.

Dashboard Features

Metric Snapshots

Periodic snapshots capture point-in-time metrics for trending analysis:

• Overall maturity score and level
• Framework scores (OWASP, ATLAS, NIST, EU AI Act)
• Control implementation count and coverage percentage
• Days remaining to EU AI Act compliance deadline

Red Team Integration

Track AI-specific security testing results:

API Endpoints

Framework Reference

Quick reference for the 7 AI security frameworks integrated into the platform.

OWASP LLM Top 10 2025

Gartner CISO MCP 2026 Journey

1. Step 1: Reactive
   Ad-hoc AI usage with no formal security controls or governance.
2. Step 2: Aware
   Recognition of AI risks with initial policy development.
3. Step 3: Proactive
   Formal AI security program with defined controls and processes.
4. Step 4: Managed
   Comprehensive governance with continuous monitoring and metrics.
5. Step 5: Optimizing
   Continuous improvement with advanced threat detection and response.

EU AI Act Risk Classification

NIST AI RMF Functions

Client Portal

The Client Portal provides a self-service interface for clients to view their engagement status, deliverables, findings, and remediation progress. Clients access the portal via invite-only authentication with their own dedicated login.

Portal Pages

Client Invite Flow

Consultants generate invite links from the Pipeline or Client detail views. Clients receive the link (shared manually), accept the invitation, set their password, and are automatically logged into the portal.

1. Generate Invite
   From Pipeline or Dashboard, click "Invite to Portal" on a converted lead/client. Enter the client's email address.
2. Share Link
   Copy the generated invite URL and share it with the client via email or secure messaging. Links expire after 7 days.
3. Client Accepts
   Client opens the link, sees the invitation details (client name, email), enters their full name, and sets a password meeting the security policy.
4. Portal Access
   On acceptance, the client is automatically logged into the portal. The Executive tab loads by default showing their security posture.

Portal Tabs

The portal provides five tabs, each lazy-loaded on first access for performance. The Executive tab is the default view.

Consultant Actions

Consultants can interact with the client portal from the main platform:

• View client comments on findings and deliverables from the Review and SOW pages
• Reply to comments via the consultant reply endpoint (can mark as internal-only)
• Monitor approvals — see when clients approve or request revisions on deliverables
• Manage invitations — view, resend, or revoke portal invitations from the client detail view

User Management

Manage consultant and administrator access to the platform.

User Roles

Adding Users

1. Navigate to Admin Panel
   Click on your user avatar and select "Admin" or navigate to the administration section.
2. Click "Add User"
   Enter email, name, and select the appropriate role.
3. Set Initial Password
   The system generates a temporary password. User must change on first login.

Platform Settings

Configure global platform settings and integration defaults.

Available Settings

• AI Provider Configuration: Anthropic API key for recommendations
• Default Connector Settings: Pre-configured integration parameters
• Report Templates: Customizable report headers, footers, branding
• Notification Preferences: Email alerts for assessment milestones