Not chatbots.
A team.
Seven AI specialists that share context, adapt to your personality, and know your organisation inside out.
Traditional AI gives generic answers. Our Virtual Agents pull from your live risk posture, policies, incident history, and compliance status — then deliver guidance in the communication style that works for you.
Part of the BCyber GRACE platform · Australian-built · Tenant-isolated
The problem with siloed AI
Most organisations bolt on separate AI tools for compliance, risk, training, and strategy. Each tool sees one slice. None of them talk to each other. Your security gaps live in the spaces between them.
The siloed reality
Compliance team tracks frameworks, but never tells training why staff keep failing.
With Virtual Agents
Shield detects a compliance gap → Spark automatically adjusts phishing simulations and awareness content to target the exact weakness.
The siloed reality
Incident responders contain threats, but no one updates the policies that let it happen.
With Virtual Agents
Pulse closes an incident → Forge drafts revised policies and playbooks → Shield verifies the update meets regulatory requirements.
The siloed reality
Board reports are generic because the CISO doesn't see operational reality.
With Virtual Agents
Sentinel builds board packs using live data from Pulse (risk posture), Shield (compliance status), and Spark (culture metrics) — automatically.
The siloed reality
Due diligence reports arrive too late and never integrate with governance planning.
With Virtual Agents
Scout completes a cyber due diligence → Compass integrates findings into the strategic roadmap → Forge builds the post-acquisition governance framework.
Meet the seven
Each agent is a specialist. Together, they cover every pillar of the GRACE framework — and share intelligence across all of them.
Sentinel
Virtual Chief Information Security Officer
“I'm your virtual chief information security officer — I watch over your entire cyber programme and explain the big picture to your board in language they understand.”
The lookout in your crow's nest — always scanning the horizon so you're never caught off guard.
What I help with
- Preparing board-level cyber briefings and risk summaries
- Setting and monitoring your organisation's risk appetite
- Scanning the regulatory horizon for changes that affect you
- Planning your maturity roadmap and investment priorities
- Positioning your cyber insurance and strategic risk profile
Best for
When to call me
- Board meeting coming up and you need a cyber briefing
- New regulation announced and you need to understand the impact
- Annual strategy review — what should cyber investment look like?
Works with
- Shield — Shield tracks the compliance gaps I identify in strategic reviews
- Pulse — Pulse feeds me live risk posture data for board briefings
- Forge — Forge builds the policies and processes I recommend
- Compass — Compass and I co-produce executive-level strategy
Transparency
- I always cite the specific regulation or framework behind my advice
- If data is insufficient, I say so and tell you what to gather
- I never fabricate compliance status or risk scores
Shield
Compliance & Assurance Agent
“I'm your compliance co-pilot — I track every framework your business must follow and make sure nothing falls through the cracks before the auditor arrives.”
Your compass through the compliance maze — I know every turn so you never hit a dead end.
What I help with
- Identifying and prioritising compliance gaps across frameworks
- Assembling evidence packs for audits and assessments
- Managing compliance deadlines and certification calendars
- Mapping your policies against regulatory requirements
- Preparing audit-ready documentation and checklists
Best for
When to call me
- Audit or assessment is scheduled and you need to prepare
- New framework requirement announced — what does it mean for us?
- You need to understand your gap against Essential Eight or ISO 27001
Works with
- Sentinel — Sentinel identifies strategic compliance gaps I need to track in detail
- Forge — Forge converts my gap findings into remediation policies and processes
- Scout — Scout uses my compliance status when assessing due diligence targets
- Spark — Spark adjusts training when my gap analysis reveals staff-related weaknesses
Transparency
- I reference specific framework controls (e.g., "CPS 234 paragraph 36"), never vague citations
- I distinguish between compliant, partially compliant, and non-compliant — nuance matters
- I never mark something as compliant without evidence to back it up
Pulse
Risk & Resilience Agent
“I'm your risk radar — I watch your security posture around the clock, spot when something changes, and help you respond fast when incidents happen.”
The heartbeat of your security — always monitoring, always ready, never sleeping.
What I help with
- Monitoring your risk posture and alerting you to changes
- Triaging and analysing security incidents in real time
- Designing and reviewing incident response playbooks
- Creating tabletop exercise scenarios tailored to your industry
- Tracking resilience metrics like MTTR and containment speed
Best for
When to call me
- Security incident detected — need help triaging and responding
- Risk posture score dropped — what happened and what to do
- Planning a tabletop exercise for the team or the board
Works with
- Sentinel — I feed Sentinel live risk data for board briefings and strategic assessments
- Forge — Forge revises playbooks and processes based on my post-incident analysis
- Spark — Spark updates training when my incident patterns reveal human-factor gaps
- Shield — Shield uses my incident data to validate compliance with notification obligations
Transparency
- I reference specific MITRE ATT&CK tactics and techniques when discussing threats
- I quantify risk in business terms — financial impact, operational disruption, regulatory exposure
- If severity is critical, I say critical — I never downplay
Forge
Policy & Process Agent
“I'm your policy architect — I take what the team recommends and turn it into actual policies, processes, and playbooks your people can follow.”
The builder in the team — I take blueprints and turn them into structures your people can live in.
What I help with
- Drafting policies aligned with regulatory requirements
- Designing operational processes and SOPs
- Building incident response and recovery playbooks
- Reviewing existing documentation for gaps and conflicts
- Creating control implementation plans from strategic recommendations
Best for
When to call me
- You need a new policy drafted (acceptable use, data handling, incident response, etc.)
- Audit finding identified a policy gap that needs closing
- Strategic recommendation from Sentinel needs turning into action
Works with
- Sentinel — Sentinel sets the strategic direction I turn into implementation plans
- Shield — Shield validates my policies against compliance frameworks
- Pulse — Pulse's post-incident findings trigger my playbook revisions
- Compass — Compass provides the business context I weave into governance documentation
Transparency
- Every policy I draft includes purpose, scope, responsibilities, procedures, and review schedule
- I cite the specific regulatory obligation driving each policy requirement
- I adapt formality to your industry — finance gets formal, startups get pragmatic
Spark
Education & Awareness Agent
“I'm your training strategist — I design learning experiences matched to each person's personality so the lessons actually stick.”
The teacher who knows every student — I adapt the lesson so the learning lands.
What I help with
- Designing personalised training paths based on personality archetypes
- Creating phishing simulation campaigns that target real vulnerabilities
- Building security awareness programmes for staff and boards
- Measuring training effectiveness in behaviour change, not just completion
- Identifying which team members need priority attention
Best for
When to call me
- Annual security awareness programme needs refreshing
- Phishing test results came back — what should we do differently?
- New starters joining — need onboarding security training
Works with
- Pulse — Pulse's incident patterns tell me where human-factor training is falling short
- Shield — Shield's compliance gaps feed my curriculum priorities
- Sentinel — I provide culture and training metrics for Sentinel's board reporting
- Compass — Compass aligns my training programmes with business objectives
Transparency
- I always link training recommendations to the individual's archetype profile
- I measure effectiveness in behaviour change, not just completion rates
- I never shame individuals for phishing susceptibility — it's a development opportunity
Scout
Due Diligence & M&A Agent
“I'm your forensic analyst — before you buy a business or partner with a vendor, I dig into their cyber posture and tell you exactly what you're getting into.”
The investigator — I look under every rock so you know exactly what you're stepping into.
What I help with
- Conducting pre-acquisition cyber due diligence across 10 workstreams
- Profiling vendor risk and third-party security posture
- Quantifying deal risk in dollar terms
- Managing evidence chains and audit trails for due diligence
- Building post-acquisition integration risk roadmaps
Best for
When to call me
- Acquisition or merger is on the table — need a cyber risk assessment
- New vendor being onboarded — need to profile their security posture
- Due diligence findings need to be turned into a go/no-go recommendation
Works with
- Shield — Shield provides our compliance posture context for due diligence assessments
- Sentinel — Sentinel integrates deal risk into strategic board briefings
- Forge — Forge builds the integration governance documentation after my assessment
- Compass — Compass shapes the strategic roadmap based on my findings
Transparency
- I present findings factually — the evidence speaks for itself
- I quantify risk in dollar terms wherever data allows
- I distinguish between deal-breakers, material risks, and acceptable risks with remediation
Compass
Business Strategy & AI Governance Agent
“I'm your strategic navigator — I connect cybersecurity to business outcomes so every security dollar has a commercial justification.”
The navigator who reads both the stars and the sea charts — strategy meets reality.
What I help with
- Building business cases for security investment with ROI modelling
- Assessing AI governance readiness against Australian and global frameworks
- Aligning security initiatives to business OKRs and strategic goals
- Competitive positioning analysis — how you compare to peers
- Cross-pillar coordination — connecting the dots across all GRACE domains
Best for
When to call me
- Budget cycle — need to justify security investment to the CFO
- AI governance obligations approaching (Dec 2026 ADM deadline)
- Board strategy day — how does cyber fit into the business plan?
Works with
- Sentinel — Sentinel and I co-produce executive-level strategy and board-ready recommendations
- Forge — Forge implements the governance frameworks I design
- Spark — Spark aligns training programmes with the business objectives I define
- Scout — Scout's M&A findings shape the strategic roadmap I build
Transparency
- I frame every recommendation in business terms — ROI, NPV, payback period, risk-adjusted returns
- I reference specific regulatory deadlines (especially Dec 2026 ADM)
- I challenge the assumption "we don't use AI" — most businesses do without realising
The intelligence mesh
Every agent feeds every other agent. Not through scheduled syncs or manual handoffs — through shared, real-time access to your organisation's GRACE data layer. This is what makes a team, not a toolbox.
Risk posture & incident trends feed strategic board briefings
Compliance gaps trigger automatic policy remediation
Incident patterns trigger targeted training updates
Strategic recommendations become implementation plans
M&A risk findings shape the strategic roadmap
Compliance posture informs deal risk assessment
Business context and strategic priorities shared across the team
Culture & training metrics enrich governance reporting
18 data sources feed the mesh: risk posture, policies, incidents, compliance status, evidence packs, playbooks, GRACE AI Index, training records, profiler archetypes, and more.
Built different
Not another wrapper on a language model. Purpose-built infrastructure for cybersecurity intelligence.
Psychometric Calibration
28 archetypes mapped to 5 communication styles. Every agent adapts to the individual — structured, strategic, direct, collaborative, or innovative.
Live Context Awareness
18 real-time data sources: risk posture, policies, incidents, compliance, evidence packs, GRACE AI Index, and more — all within your tenancy.
Regulatory Intelligence
SOCI Act, APRA CPS 234, Privacy Act 2024, Essential Eight, ASIC REP 798, AICD Cyber Governance Principles — all built in.
Tenant Isolation
Every conversation scoped to your organisation. No cross-client data access. Full audit trail on every interaction.
Role-Based Access
Available through client portal, staff interface, and admin console. Each access point shows contextually appropriate agents.
Cross-Pillar Intelligence
Agents share context through the GRACE data layer. Sentinel's strategy informs Forge's implementation. Shield's gaps trigger Spark's training.
Conversational Depth
Multi-turn conversations with persistent memory. Follow up, challenge, drill down — agents maintain context across entire sessions.
Audit-Ready Logging
Every conversation logged with timestamps, user identity, and agent identity. Exportable for compliance evidence and regulatory reporting.
Take one agent — or take the team
Start with what you need today. Every tier is additive — new agents inherit existing context instantly.
Foundations
1–50 seats
Strategic governance and compliance coverage. Your vCISO and compliance manager, available on demand.
Momentum
50–250 seats
Full operational capability. Add risk monitoring, incident analysis, and implementation firepower.
Enterprise
250+ seats
The complete virtual team. All seven agents with cross-pillar intelligence, M&A capability, and AI governance.
Embedded in the GRACE ecosystem
Every agent operates within BCyber's five-pillar framework. No pillar left uncovered.
Compass operates across all five pillars as the strategic connector.
Frequently asked questions
What makes these agents different from ChatGPT or generic AI?
Every agent is purpose-built for Australian cybersecurity and knows your specific organisation — your policies, risk posture, incident history, compliance status, and GRACE AI Index. They access 18 live data sources within your tenancy, adapt communication to your personality archetype, and generate outputs grounded in real regulatory obligations (SOCI Act, APRA CPS 234, Privacy Act 2024, Essential Eight). Generic AI gives generic answers. Virtual Agents give your answers.
How do the agents work together as a team?
Every agent shares context through BCyber's GRACE framework. When Pulse detects an incident, Shield checks regulatory obligations, Forge updates playbooks, and Spark adjusts training — automatically. Sentinel aggregates insights from all agents for board reporting. This means the output from any single agent is enriched by the intelligence of the entire team.
How does psychometric calibration work?
BCyber's Profiler platform maps users to 22 cybersecurity personality archetypes based on Big Five traits. Each agent automatically adjusts its communication style — structured for Guardians, strategic for Strategists, direct for Hunters, collaborative for Diplomats, innovative for Architects. Your team receives guidance in the language that resonates with them.
Can I start with one or two agents and add more later?
Absolutely. The Foundations tier gives you Sentinel (vCISO) and Shield (Compliance) — the two agents most businesses need immediately. As your programme matures, upgrade to Momentum for Pulse and Forge, or Enterprise for the full team. Agents share context, so adding new ones accelerates value immediately.
Do the agents replace human cybersecurity professionals?
No — they augment them. Think of the Virtual Team as force multipliers. Sentinel handles the board pack so your CISO focuses on strategy. Shield tracks compliance deadlines so your GRC team focuses on remediation. Pulse triages incidents so analysts focus on containment. Every agent handles the repetitive, data-intensive work so humans can focus on judgment and relationships.
What data do the agents access?
Agents access data through BCyber's GRACE portal — your risk posture, policies, incident history, compliance status, evidence packs, playbooks, training records, and GRACE AI Index scores. All data stays within your tenancy. Agents never access data across client boundaries, and every conversation is logged for audit.
Is there a free way to experience BCyber?
Yes. Head to bcyber.com.au/get-started to activate your free portal — the onboarding wizard benchmarks your posture and gives the agents context. You can then explore the full Virtual Team as part of any BCyber GRACE subscription.
How is the Virtual Team priced?
The Virtual Team is part of BCyber's GRACE platform subscription, available in three tiers: Foundations (1–50 seats), Momentum (50–250 seats), and Enterprise (250+ seats). Contact us for tailored pricing options.