See Basirah In Action

No. Basirah complements your existing stack. It sits between your scanners and ticketing tools as the system of action — and the system of record for verified remediation. It ingests findings from 55+ sources, creates owned remediation work, dispatches to Jira, ServiceNow, or Azure DevOps, and verifies fixes independently. Your existing tools stay exactly where they are — Basirah closes the gap between detection and proven resolution.

When a remediation owner marks work as done, Basirah does not trust the claim. It triggers an independent verification — a passive rescan (waiting for the next scheduled scan), an active on-demand rescan, an API probe, or a manual check with evidence upload. The result is a concrete PASS or FAIL, not a status update. If verification fails, the work item reopens automatically and the SLA clock keeps running.

Dispatch uses an outbox queue with idempotency so retries don't create duplicates. Each Basirah work item stores the linked external ticket reference (Jira key or ServiceNow sys_id) and syncs status changes back through webhooks or polling. When a ticket moves to Done, Basirah shifts the work item to Pending Verification and waits for a verification PASS before crediting the fix.

No. FAIR quantification is available but entirely optional. Basirah works with severity-based prioritization (Critical, High, Medium, Low) out of the box. Teams that want board-ready financial metrics can enable FAIR Monte Carlo simulations to express risk as dollar ranges (P50/P95) — but verification, SLA enforcement, and evidence generation work independently of any risk model.

Bassistant is Basirah's execution intelligence layer, connected to findings, SLA clocks, verification outcomes, and evidence history. It recommends next actions with preview-confirm controls, and sensitive actions can route through approval workflows. Ask "What's driving the P95 spike?" to get evidence-linked answers, then use the same flow to draft audit narratives and prioritize triage by annualized loss.

Each evidence package includes the findings snapshot at time of closure, the full work-item timeline (created, assigned, verified, closed), verification results with method and PASS/FAIL outcome, SLA clock history, and any uploaded artifacts (screenshots, scan results, attestations). Every file is cryptographically hashed into a checksums manifest for tamper-evident auditability.

Basirah includes pre-built control mappings for ISO 27001, SOC 2, NIST CSF, NIST 800-53, PCI DSS, NCA ECC, DORA, and NIS2. Evidence is collected continuously (not point-in-time snapshots), with per-control drill-down and gap analysis. Cross-framework deduplication prevents redundant work when you are audited against multiple standards.