Greymatter.ioGreymatter.io
Start for Free
Greymatter.ioGreymatter.io Why Greymatter.io?
Pricing Start for Free
Platform • Stoplight Measurement

Your security, at a glance.

Twelve controls. Measured live.

92%STOPLIGHTread 02:58:27 PM EST · every 3s92% of the zero-trust controls that apply are in place across apps, AI, and workloads11 of 12 Greymatter controls are in place everywhere they apply. A control counts only when it is in place everywhere it applies.Greymatter's controlsGreymatter checks them on the workloads it manages.10of 10 workloadshave every control that applies to them5of 7 edgeshave every control.Requirements impacted: 06 Every edge is protectedEvery controlCoverage, grouped by what it protectsIDENTITY01Every service has its own identity10/10 workloads · 7/7 edges02Certificates renew on their own10/10 workloads · 7/7 edgesTRANSPORT03Traffic between services is encrypted10/10 workloads04FIPS 140-310/10 workloads · 7/7 edges04Post-quantum encryption ready10/10 workloads · 7/7 edges04Post-quantum encryption active9/10 workloads · 5/7 edgesACCESS05Each service limits who may call it17 services13 mesh · 4 observeINSPECTION06Every edge is protected5 of 7 edges2 missing07Responsible AI guardrailsOn at 2 edges08Sensitive data is detectedOn at 2 edgesEVIDENCE09Forensic audit trail10/10 workloads · 7/7 edges11Every configuration change is loggedOn for the meshGOVERNANCE10Security policy reaches every service10/10 workloads · 7/7 edges12Console access is controlledOn for the mesh
Console view · sample data. We masked names and identifiers.
What other tools miss

Apps updated this morning. Did your reports?

Screenshots take a week and are stale on arrival. Stoplight reads your running platform instead and shows the real gaps today.

  • Engineers get their time back · the evidence is already there when someone asks
  • No hidden apps · apps nobody listed count as gaps until someone fixes them
  • A green score you can trust · the score comes from the platform that applies the controls. 100% means every control that applies is in place everywhere it should be.
IDENTITY01Identity02Certificate renewalTRANSPORT03Encryption04FIPS and post-quantumACCESS05Caller limitsINSPECTION06Edge protection07AI guardrails08Sensitive dataEVIDENCE09Audit trail11Change logGOVERNANCE10Policy reach12Console accessFRAMEWORKINTERNATIONAL STANDARDSISO/IEC 270019/11ISO/IEC 420014/4ZERO TRUSTDoD Zero Trust6/7CISA ZTMM6/7UNITED STATESFederal mandates5/5NIST SP 800-5310/12NIST CSF 2.04/6FedRAMP6/7HIPAA6/6CANADAITSG-338/10PIPEDA4/4AUSTRALIA AND NEW ZEALANDISM5/7
Console view · sample data.
What the Stoplight scorecard measures

Twelve security controls. One honest score.

A single score covers your entire defense. When a control slips, Stoplight pinpoints the failing app before attackers find it.

01
IdentityKnow which services touch your data.Everything proves who it is before it connects, and Greymatter flags strangers.
02
CertificatesNo surprise outages.Certificates renew on their own, with no one watching a calendar.
03
EncryptionTraffic stays private.If one connection still runs unencrypted, you see it and shut it.
04
FIPS and post-quantumEncryption that meets the U.S. government standard.FIPS 140-3 validated (CMVP #5191), with post-quantum key exchange.
05
Approved sourcesLimit how far a breach can spread.Requests reach your apps only from sources you approve.
06
FirewallThe firewall screens web attacks before they reach your apps.See which apps the firewall covers.
07
AI guardrailsAI agents stay within their role.Guardrails screen prompts, answers, and tools, and keep each exchange on record.
08
Sensitive dataPrivate data does not slip out unnoticed.Greymatter flags personal details, health records, and sensitive markings as they move.
09
Audit trailIncidents get answers fast.Trace any request across services and people.
10
Policy deliveryYour rules hold everywhere.Stoplight checks that your rules reached every app they should.
11
Change logNo silent changes.A tamper-evident log shows who changed what.
12
Console accessAccountability by name.People sign in through your existing identity groups, with roles.

The firewall, AI guardrails, sensitive data detection and approved sources switch on where your team chooses.

Mapped to your standards

Stop rebuilding proof for each new mandate.

Zero trust, federal, international, financial, privacy, and AI rules ask for many of the same protections. Stoplight lays one set of controls over all of them at once. You see which lines you already meet, and which control closes the rest. Turn off the frameworks you do not need, and they leave the page and the printed report.

CONTROL 01

Every service has its own identity

Helps meet requirements in 19 of 23 frameworks.

International standards
ISO/IEC 270012 requirementsISO/IEC 42001
Zero trust
DoD Zero Trust2 requirementsCISA ZTMM1 requirement
United States
Federal mandates2 requirementsNIST SP 800-532 requirementsNIST CSF 2.01 requirementFedRAMP1 requirementHIPAA2 requirements
Canada
ITSG-331 requirementPIPEDA1 requirement
Australia and New Zealand
ISM1 requirementNZISM1 requirement
Financial services
PCI DSS1 requirementSOC 21 requirementEU DORA1 requirementOSFI B-132 requirementsAPRA CPS 2341 requirement
European Union
GDPR1 requirementEU NIS21 requirementEU AI Act
AI oversight
Responsible AIOECD AI

Stoplight shows the evidence. Your assessor makes the call.

Measured, not attested

Evidence from the running system, not a binder.

Most compliance evidence is a snapshot. By the time an assessor reads it, a team has deployed a new service and a certificate is close to expiry. Stoplight reads the answer from the platform itself, for every workload, at any moment.

The questionSnapshot evidenceGreymatter
Does every service have its own identity?A diagram and a policyEvery service checked, with any that do not listed by name
Is traffic between services encrypted?A configuration screenshotEach service checked for mutual TLS and plaintext callers
Are certificates current?A renewal calendarNo certificate expired, expiring, or failing to rotate
Who may call each service?An architecture reviewAdmission narrowed to named callers, per service
Are AI prompts, answers, and tools checked?A usage policyGuardrails and DLP declared and running, per service
Is there an audit trail?A logging policyEach service checked for the audit filter on its listener
Was every configuration change recorded?A change ticketThe change ledger is on and answering
When was this true?The audit dateThe last read, refreshed continuously

Stoplight shows where Greymatter controls are in place. It does not certify a system against any framework. The mapping is guidance an assessor can check.

Print report

Hand your assessor a report, not a project.

One click turns the live view into a report you can print or save as a PDF. Nothing to gather by hand.

Read from the running platform, with the time of the read.
Every control with its coverage, and every framework line with the controls it rests on.
Names what it does not count, and why.

Know where your security stands. Today.

Try it free on your own systems.

Start for FreeMeet Our Security ExpertsBrowse How to Buy →
Download the Stoplight white paper
Keep digging

Additional resources

Use caseAccelerated ATOLearn More →PlatformForensic AuditingLearn More →One-pagerGreymatter.io NIST SP 800-207A MappingRead the One-Pager →
Swipe for more
Answered before you ask

Greymatter Stoplight FAQs

Greymatter Stoplight is a live scorecard in the Greymatter Console. It shows whether twelve security controls are in place across your apps, APIs, and AI agents. It names the apps with gaps and lays your security controls over DoD and CISA Zero Trust, federal mandates, GDPR, and responsible AI.

No. Greymatter Stoplight shows where Greymatter security controls are in place, with the evidence behind each count. Your assessor makes the call. Stoplight gives them live proof instead of screenshots.

If Greymatter Stoplight cannot read a control, the card says so. It never shows zero or green in its place. The score never reads 100% while a gap exists, and apps Greymatter does not manage show up as gaps.

Greymatter Stoplight maps its controls to 23 frameworks. The standards include ISO 27001, NIST SP 800-53, PCI DSS, HIPAA, SOC 2, GDPR, ITSG-33, and the Australian ISM. Zero Trust and AI frameworks include the DoD Zero Trust Strategy, the CISA Zero Trust Maturity Model, and the OWASP Top 10 for LLM Applications.

Yes. Greymatter Stoplight lets you download the rows behind any control as a file, listed app by app. You can also ask questions about your score in plain language with Ask Greymatter.