DyDox is an AI-enabled cyber security assessment and continuous assurance platform developed by OpnLabs Pty Ltd, an Australian cyber security and AI company.

It helps organisations accelerate assessment readiness, generate security documentation, evaluate security controls and maintain visibility of assessed cyber security risks as ICT environments evolve.

DyDox combines domain-specific AI models, intelligent automation and human oversight to support cyber security professionals in making informed risk management decisions.

Learn more: Explore DyDox

DyDox has been designed and developed by a team with experience in cyber security, cloud architecture, artificial intelligence and enterprise technology transformation.

The team includes AGSVA security-cleared professionals and ASD-endorsed IRAP Assessors, with more than 25 years of industry experience spanning Australia, New Zealand, the United States, the United Kingdom and Europe.

Their experience includes working with Australian Federal Government agencies and major enterprises to design, assess and secure complex ICT environments.

DyDox has also undergone product testing and evaluation, including trials involving cyber security practitioners and assessors.

Learn more: Meet the OpnLabs team 

Yes. DyDox has been tested with Australian Sovereign AI technologies, including Agentaus from Trellis Data and Australian-specific fine-tuned language models associated with SCX.

These evaluations support DyDox's ability to operate with different AI model configurations and sovereign deployment architectures.

DyDox also includes OpnLabs-developed, cyber security fine-tuned language models and does not depend on Agentaus or SCX models to complete assessments.

Learn more: Explore DyDox Sovereign AI capabilities

DyDox is designed for Australian Government agencies, regulated enterprises, critical infrastructure organisations and cyber security service providers.

It supports CISOs, CIOs, cyber security managers, system owners, solution architects, GRC teams, IRAP Assessors and consultants who need to reduce assessment backlogs, maintain security documentation and demonstrate security assurance.

Learn more: Explore DyDox

Traditional Governance, Risk and Compliance (GRC) platforms commonly focus on recording, tracking and reporting compliance activities.

DyDox focuses on preparing for and conducting cyber security assessments. It uses AI to analyse system information, assess security controls, identify potential risks and generate assessment artefacts.

DyDox can complement an organisation's existing GRC processes without requiring the replacement of established governance systems.

Learn more: How DyDox works

DyDox supports cyber security assessment workflows aligned with Australian Government and industry frameworks, including:

• Australian Government Information Security Manual (ASD ISM)
• Protective Security Policy Framework (PSPF)
• Essential Eight/Essential for enterprise IT and relevant ASD cyber security guidance for enterprise ICT environments
• ISO/IEC 27001
• NIST Cybersecurity Framework (CSF)
• NIST SP 800-53 and SP 800-171
• AESCSF
• CIS Controls
• Other applicable industry-specific security frameworks

The availability of particular frameworks depends on the DyDox plan, model configuration and assessment scope.

DyDox supports assessment and compliance activities but does not independently certify an organisation as compliant.

Learn more: Explore DyDox assessment capabilities

Depending on the selected plan, assessment scope and available system information, DyDox can generate or assist in preparing:

• SSP — System Security Plan
• SoA — Statement of Applicability
• CAR — Cyber Security Assessment Report
• SRMP — Security Risk Management Plan
• IRP — Incident Response Plan
• CMP — Continuous Monitoring Plan
• BCP — Business Continuity Plan
• DRP — Disaster Recovery Plan
• ALP — Audit Logging Plan
• Executive security assurance reports
• Risk meeting minutes
• Control assessment findings and supporting evidence
• Executive security assurance dashboards

Outputs are intended to support professional review, validation and approval. Availability of individual artefacts may vary by plan and deployment scope.

Learn more: Explore DyDox capabilities

DyDox uses relevant organisational and system documentation to establish the assessment context.

Typical inputs include organisational security policies, system architecture and design documents, network diagrams, configuration information, operating procedures, engineering documentation, security control evidence and operational support information.

Existing security assessment reports, vulnerability reports, monitoring outputs and other relevant evidence can also be provided.

The completeness and quality of these inputs directly influence assessment accuracy and the quality of generated artefacts.

Learn more: Explore DyDox

DyDox supports common document and information formats, including Microsoft Word documents, Excel spreadsheets, Google Docs and Sheets content, PDFs, plain text files and supported image formats such as PNG and JPEG.

Where required, documents from external repositories may be exported or made available through approved integrations.

Processing capability depends on file structure, content quality, deployment configuration and supported ingestion methods. For example, scanned documents may require additional processing before their contents can be assessed.

Learn more: Discuss document compatibility

Yes. DyDox can provide assessment artefacts in editable formats, including Microsoft Word and spreadsheet-compatible formats, as well as PDF.

Depending on the configured workflow, outputs can also be prepared for use with Google Docs and Google Sheets.

This allows cyber security professionals to review findings, update content and incorporate generated artefacts into existing organisational approval processes.

Learn more: Explore assessment outputs

Yes. DyDox Enterprise deployments can be configured to use organisation-specific document templates, branding, logos, formatting requirements and terminology. 

For example, an agency may require assessment reports to follow its approved security documentation templates, heading structures and reporting conventions. 

The onboarding and configuration of customer-specific templates form part of the agreed Enterprise deployment scope. 

Learn more: Discuss Enterprise configuration

Yes. DyDox can generate English-language outputs using terminology, tone and documentation conventions appropriate to the organisation's industry and operating environment.

The default assessment language follows Australian English and Australian Government cyber security terminology, aligned with the ASD ISM and PSPF.

Enterprise configurations can incorporate organisation-specific terminology, reporting conventions and domain requirements where included in the deployment scope.

Learn more: Explore Enterprise options

DyDox On-Demand uses standardised assessment templates, including relevant ASD IRAP reporting formats and control assessment spreadsheets where applicable.

Enterprise deployments can incorporate customer-specific templates and documentation standards as part of the agreed configuration.

This helps organisations maintain consistency between AI-generated artefacts and their established security governance processes.

Learn more: Explore DyDox plans

Yes. DyDox can support third-party cyber security risk assessments by analysing relevant supplier documentation, security policies, control evidence and other information supplied for review.

Assessment scope and reporting requirements can be configured to address relevant organisational policies, contractual obligations and applicable security frameworks.

The resulting findings support supplier risk evaluation and professional review; they do not constitute independent certification of the supplier.

Learn more: Discuss third-party risk assessments

Yes. DyDox can help prepare for an IRAP assessment by analysing system documentation, drafting security artefacts, identifying potential control gaps and organising assessment information.

This can reduce the preparation effort for system owners, cyber security teams and IRAP Assessors.

DyDox does not replace an ASD-endorsed IRAP Assessor or constitute a formal IRAP assessment in its own right.

Learn more: Explore assessment readiness

No. DyDox is designed to assist cyber security professionals by automating repetitive and labour-intensive assessment activities.

Assessors remain responsible for reviewing evidence, validating findings, applying professional judgement and approving assessment deliverables.

For formal IRAP engagements, the relevant assessor and authorising authority retain their established responsibilities.

Learn more: DyDox for assessors

The time required depends on system complexity, the quality and completeness of the input documentation, and the assessment scope.

Based on OpnLabs' experience, DyDox can typically prepare draft assessment artefacts for suitable systems within approximately 6–9 hours of processing and assessment activity.

Additional time may be required for evidence collection, iterative assessment, human review, remediation and formal approval.

Explore further: Try DyDox for Free to evaluate sample inputs and outputs

The quality of DyDox outputs depends on the completeness, accuracy and relevance of the supplied system information.

Some assessments may require more than one iteration, particularly when additional evidence, clarification or missing documentation is needed.

For specialised industries or complex environments, Enterprise deployments may require domain-specific model configuration or fine-tuning. Such work is subject to the agreed deployment scope.

All generated assessment findings and documentation should be reviewed by suitably qualified cyber security professionals.

Explore further: Try DyDox for Free to evaluate sample inputs and outputs

Yes. DyDox can reduce the manual effort associated with document analysis, control assessment, report preparation and risk management documentation.

This allows cyber security teams to spend more time validating evidence, managing security risks and addressing identified control weaknesses.

Actual savings depend on system complexity, input quality, assessment scope and human review requirements.

Learn more: Explore DyDox

No. DyDox generates advisory assessment outputs that can support an organisation's security risk management and authorisation processes.

Formal authorisation to operate remains the responsibility of the organisation's designated authorising authority, based on applicable policies, assessment evidence and risk acceptance requirements.

Learn more: Explore assessment capabilities

DyDox supports deployment architectures that enable organisations to retain control over their AI infrastructure, models and security assessment information.

Depending on the selected configuration, this can include Australian-hosted infrastructure, sovereign AI models, self-hosted language models and isolated environments.

The appropriate deployment depends on the organisation's information classification, data-handling requirements and security policies.

Learn more: Explore DyDox Sovereign AI capabilities

No. DyDox includes OpnLabs-developed cyber security fine-tuned language models that can operate without external AI services.

These models can support assessment processing on appropriately configured local or dedicated infrastructure, including environments disconnected from Wi-Fi, external networks and the internet.

Agentaus from Trellis Data and SCX-associated model options are optional deployment choices rather than mandatory dependencies.

Learn more: Discuss Sovereign AI deployment

Yes. DyDox supports offline deployment configurations that do not require internet connectivity for local assessment processing.

Depending on the selected infrastructure and configuration, DyDox can operate on a dedicated device or isolated environment with external network connectivity disabled.

Offline operation requires the necessary models, software dependencies and assessment information to be available locally.

Learn more: Discuss offline deployment

Yes. DyDox can be configured to access the internet or specified external websites where required and authorised by the customer.

By default, isolated deployment configurations do not require external internet access for assessment processing.

Where internet access is enabled, connectivity should be restricted to approved destinations and governed by the organisation's network security, information-handling and data protection policies.

Learn more: Discuss offline deployment

DyDox supports deployment configurations that do not require external commercial AI APIs.

For these configurations, assessment processing can be performed using locally hosted or dedicated language models.

The exact data flows, hosting arrangements and external connectivity requirements depend on the selected plan and deployment architecture.

Organisations should confirm the applicable configuration before submitting sensitive information.

Learn more: Explore DyDox deployment options