What CyberCyko covers: identity, access and laptop management
Know what works today.
Every identity, governance and device category you might compare us on, what it means in plain English, and what CyberCyko does about it.
- Ships today
- Partly, with limits
- In development
- Not shipping
Identity and access (IAM)
| Category | What it means | Status | What CyberCyko does |
|---|---|---|---|
| Identity and access management (IAM) | Who your people are, how they prove it and what they can open. | Ships today | The core of the product: passwordless sign-in, single sign-on, per-person and per-app access, active sessions and step-up approval. |
| Identity provider | The system that signs a user in and vouches for them to apps. | Ships today | We are one. Apps accept sign-in from CyberCyko, and people prove who they are with their phone and a fingerprint. |
| Single sign-on (SSO) | Sign in once, open all your apps. | Ships today | Ready-made setup for Microsoft 365, Google Workspace, Slack, GitHub, GitLab, Mattermost and Redmine. Any other app that supports standard single sign-on is added through a guided wizard with a test-connection button. |
| Microsoft 365 domain sign-in | Handing sign-in for a whole domain over to an identity provider. | Partly, with limits | Microsoft 365 only, with a guided setup and our help. We do not promise the same for every other federation standard. |
| Passwordless sign-in | Signing in with no password anywhere in the flow. | Ships today | Both laptop sign-in and app sign-in. Windows, with Mac lock-screen sign-in. |
| Multi-factor authentication (MFA) | A second proof on top of a password. | Ships today | Stronger than password plus MFA, because there is no password at all. The fingerprint on a key held in the phone is the sign-in. |
| Phishing resistance | A credential that cannot be handed to an attacker who asks nicely. | Ships today | The key is generated and kept on the device, inside its security chip where it has one, and the phone asks for a live fingerprint or face before using it. |
| Step-up approval | Asking for extra proof before something sensitive. | Ships today | Per-app approval on the phone, with a remember-this-device window. |
| Access based on conditions | Access decided by device, health or location. | Partly, with limits | Access is tied to the specific device the person enrolled, and granted per person and per app. We do not offer a rules engine that blocks app access based on laptop health. |
| Directory | The central store of users and their credentials. | Partly, with limits | Deliberately no password or secret store. We keep your user list (name and work email, drawn from invitations and enrolled devices) and public keys; the keys that sign people in stay on their own devices. |
| Customer sign-in for your own app | Sign-in for your customers inside your product. | Not shipping | Different market. We are workforce sign-in for your team. |
Governance (IGA)
| Category | What it means | Status | What CyberCyko does |
|---|---|---|---|
| Identity governance (IGA) | The full lifecycle and paperwork of access: joiners, movers and leavers, access requests, periodic reviews and evidence for auditors. | Partly, with limits | We cover the governance basics, not the whole category: who has access to what, granted and revoked in one place, with an audit trail you can hand to an auditor. |
| Joiners and leavers | Access follows someone joining, changing role or leaving. | Partly, with limits | Joiners and leavers work: enrol a device and grant apps; remove the device and access ends within seconds. A change of role is handled by hand. |
| Revoking access | Turning off someone’s access to apps. | Ships today | Remove someone’s access through CyberCyko in one click. The action is logged. |
| Creating and deleting accounts inside other apps | Automatically making or removing a user’s account in each downstream app. | Not shipping | We grant and revoke access through CyberCyko. We do not create or delete accounts inside third-party apps. |
| Access requests and periodic access reviews | Workflows to ask for access, and managers re-approving who has it. | Not shipping | Not built. |
| Rules against conflicting access | Preventing one person from holding two access rights that should be separate. | Not shipping | Not built. |
| Least privilege | People get only the access they need. | Partly, with limits | Access is granted per person and per app rather than to everyone by default. |
| Admin credential locking and session recording | Locking away admin passwords and recording what admins do on servers. | Not shipping | Not what we do. Adjacent things we do: employees never use a password, but each laptop keeps a local Windows account for IT’s break-glass and legacy use, so we enforce that account’s password policy, reset its password from the console and log every admin action. |
| Tamper-evident audit trail | Proof of who did what, where any later edit shows up. | Ships today | Every record is linked to the one before it, per organisation. A one-click check names the first record that does not match. |
Devices
| Category | What it means | Status | What CyberCyko does |
|---|---|---|---|
| One console for every laptop | Managing every laptop and desktop from a single screen. | Partly, with limits | Full management for Windows laptops today. Every other platform is under “Other platforms” below. |
| Phone management | Enrolling and controlling phones and tablets. | In development | Android and iOS management is in development. Today CyberCyko Authenticator approves sign-in on the phone; it does not manage the phone. |
| Device enrolment | Bringing a machine under management. | Ships today | Email invitation, install, enrolled. Also suspend, re-enable and offboard. |
| Device inventory | Knowing what hardware you have and who has it. | Ships today | Hardware detail, telemetry, local users and activity for each Windows laptop. |
| Device-bound identity | Access tied to a known machine. | Ships today | The identity is written into the device’s own security chip at enrolment. |
| Security checks | Is each laptop actually set up safely, and can you prove it? | Ships today | Twelve Windows checks: firewall, disk encryption, antivirus real-time protection, Secure Boot, Windows updates, account lockout, screen lock, Remote Desktop policy, SMB1 disabled, guest account disabled, Credential Guard and audit policy. |
| Security settings | Push a setting and have it stick. | Ships today | Seven categories on Windows: BitLocker, firewall, USB storage, the antivirus built into Windows, screen lock, Windows updates and printing. Assign to one device or the whole organisation. |
| Remote assistance | Take over a user’s screen to fix something. | Ships today | Live session with keyboard and mouse control. The session is logged. |
| Erasing a lost laptop | Deleting everything on a device from a distance. | Not shipping | Not available. Remote lock locks the screen; it does not erase the laptop. |
| Installing software updates for you | Keeping installed software current and knowing what is installed. | Not shipping | Not available. A Windows updates policy can be enforced; managing individual updates and software lists cannot. |
| Out-of-the-box device setup | New devices that configure themselves when first switched on. | Not shipping | Not available. Devices are enrolled by email invitation. |
| Antivirus | Detecting and stopping malware. | Not shipping | We are not an antivirus product. We make sure the antivirus built into Windows is on and configured; we do not replace it. |
Other platforms
| Category | What it means | Status | What CyberCyko does |
|---|---|---|---|
| Mac, Ubuntu, Android and iOS | Managing and protecting devices beyond Windows. | In development | Today: Windows laptops are fully managed, and passwordless sign-in works on Windows and at the Mac lock screen. Management for Mac, Ubuntu, Android and iOS is in development. CyberCyko Authenticator, the iPhone and Android app that approves sign-in, works today. |
Security and compliance
| Category | What it means | Status | What CyberCyko does |
|---|---|---|---|
| Checking every sign-in | Sign-in is verified, with no remembered passwords. | Ships today | Sign-in through CyberCyko is checked against the enrolled device and the employee’s phone. A full sign-in asks for a live fingerprint or face on the phone. |
| CIS Controls | A widely used set of security safeguards. | Ships today | 17 controls mapped for your own reporting. |
| NIST SP 800-171 | A US standard for protecting sensitive information. | Ships today | 14 controls mapped for your own reporting. |
| ISO/IEC 27001:2022 | An international standard for information security. | Ships today | 12 controls mapped for your own reporting. CyberCyko itself is ISO/IEC 27001:2022 certified (certificate 09115388E). |
| SOC 2 Type II | An independent audit of a service provider’s controls. | Audit in progress | 11 controls mapped for your own reporting. Our own SOC 2 Type II audit is in progress; we do not hold a SOC 2 report yet. |
| DPDP Act 2023 and IT Act 2000 | India’s data-protection and IT laws. | Partly, with limits | Built for Indian data-protection obligations. We are one control in your programme, not a certification, and not a consent manager. |
Check your exact setup
A short conversation with an engineer confirms whether your laptops, work apps and evidence needs fit the product as it ships today.
Contact usSee the productRead the security page