What does PolicyCortex actually do that a CSPM doesn't?

CSPMs and CNAPPs are architecturally read-only — they detect risk and hand it to a human. PolicyCortex is a write-safe substrate underneath governance: every cloud action ships with a matched capture-state and restore-state pair. Rollback is a contract, not a feature flag. The platform refuses to execute any action whose rollback path is undefined.

Did the Department of War cancel CMMC?

No. On July 13, 2026, the Department suspended the Phase II transition and future implementation milestones while it conducts a 60-day reform review. Phase I self-assessment requirements remain in force, and DFARS 252.204-7012 still requires contractors to safeguard covered defense information.

What does PolicyCortex validate during the pause?

PolicyCortex maps your live cloud environment against the 110 NIST SP 800-171 Rev. 2 requirements, identifies and remediates technical gaps, and assembles the evidence behind your SPRS self-assessment. The same evidence remains useful for government reviews and any future CMMC assessment model.

What clearances does the founder hold?

Leonard Esere holds an active DoD Secret clearance and a DoE Q clearance. PolicyCortex is built on 11+ years of regulated-infrastructure work across federal R&D, financial services, and aviation. 4 U.S. patent applications filed.

What does the $15K pilot include?

NIST SP 800-171 Rev. 2 baseline assessment, defensible SPRS score review, automated gap closure, System Security Plan, POA&M, assessment-ready evidence bundle (OSCAL + ZIP), CUI boundary analysis, 30-day platform access, and a final review with the founder. $15,000 flat — no hourly billing, no overages.

SPRS ASSURANCE // COMMAND CENTER

Make the SPRS score you affirm real.

STATUS OK · LIVE│BUILD 0aed52

POLICY UPDATE // JUL 13, 2026

CMMC Phase II is suspended. The security baseline is not.

The Department of War paused the November Phase II transition while it runs a 60-day reform review. Phase I self-assessments remain in force, and contractors handling covered defense information still have to meet their DFARS safeguarding obligations.

What changed and what to do Official release

PHASE II: SUSPENDED; Transition and future milestones paused
PHASE I: ACTIVE; Self-assessment requirements remain
CONTRACT DUTY: DFARS 7012; Covered defense information still protected
INTERIM BASELINE: NIST REV. 2; 110 requirements · government checks continue

The November Phase II deadline is suspended. Your Phase I self-assessment and DFARS duty to protect covered defense information are not. PolicyCortex fixes cloud gaps across all 110 NIST SP 800-171 Rev. 2 requirements, then packages the evidence behind the SPRS score you affirm.

Book 30-min demo See handoff package

FIND

SC-7 drift

CUI subnet exposed

FIX

NSG tightened

rollback contract attached

PROVE

AC / SC evidence

SPRS score backed by current state

PolicyCortex Command Center — compliance posture, remediation feed, cost optimization, and ATO collections — actual product surface · fix to evidence packageOpen product tour

NIST 800-171 BASELINE

110 / 110

Rev. 2 requirements mapped to live cloud state

AUTONOMOUS REMEDIATION

85.5%

of drift fixed automatically, in gated mode

MEDIAN MTTR

~30s

detect → fix → evidence, end to end

THESIS // 02 · EXECUTION SAFETY

The moat isn't the AI. It's the execution-safety substrate underneath it.

Detection is solved. Every CSPM finds the violation. The hard part — and the part nobody ships — is taking an autonomous action on a production cloud account and being able to prove it can be undone.

PolicyCortex is the first platform where every action is type-checked against its inverse. The runtime refuses to execute any remediation whose restoreState path is undefined.

That's why we can run autonomously in regulated environments where CSPMs only watch. The auditor doesn't need to trust the model — they read the contract.

APPLICATION VIEW // COMMAND CENTER

LIVE│5 FRAMEWORKS · 14K RESOURCES

PolicyCortex Command Center — 82% compliance posture, 425 open POA&Ms, 13 active alerts, 1536 auto-fixes landed, framework coverage strip across CIS / PCI DSS / HIPAA / HITRUST / NIST 800-53 / MCSB, cost optimization with $125.4K potential savings, live action feed, ATO collections — /command-center · continuous authorization across connected accountsModule detail

THESIS // 02 · PROOF — RUN IT YOURSELF

Don't trust the text. Run the contract.

Pick a remediation. Watch the runtime refuse the one it can't prove it can undo — and roll back the ones it can. The system is more careful than you are, on purpose.

The Rollback Contract

Reference run · Synthetic payload · Not a live connection

AC-3stprodeastus01 / telemetry·Container telemetry has public blob read enabled.

00 DRIFT
01 CAPTURE
02 PROPOSE
03 INVERSE
04 GATES
05 EXECUTE
06 EVIDENCE

00 DRIFT
01 CAPTURE
02 PROPOSE
03 INVERSE
04 GATES
05 EXECUTE
06 EVIDENCE

Contract trace

Idle. Press RUN CONTRACT to execute the Public storage scenario.

PLATFORM // MODULES

View all

M-01

Governance & Compliance

Continuous monitoring across 110 CMMC L2 requirements + 95 NIST 800-53 controls. Drift detection in real time.

AI Observability

Every model in your environment — governed, secured, mapped to MITRE ATLAS. Built for the AI EO.

Autonomous Remediation

Every action ships a matched captureState/restoreState pair. Rollback is a contract, not a feature flag.

ATO & Authorization

7-stage pipeline outputs SSP, POA&M, OSCAL bundle, and auditor ZIP for the C3PAO handoff — content-hashed.

AUTONOMOUS OPS // LIVE EVENTSSTREAM

Auto-remediated storage/blob-acct-x

AC-3 · 1.4s