What CyRAACS does

CyRAACS (legal entity CYRAAC Services Private Limited) is a Bengaluru-headquartered cybersecurity and risk management consulting firm founded in 2017 by Suresh Iyer (CEO) and Murari Shanker (COO). The company offers a portfolio spanning Governance, Risk and Compliance (GRC) services, technical security services such as Vulnerability Assessment and Penetration Testing (VAPT), specialized and niche services including Red Team and AI Security Assessment, and platform-led services (Compliance Management Services, Third-Party Risk Management, and Managed VAPT) delivered on its proprietary COMPASS platform.

The company's underlying technology is the COMPASS platform, a cloud-native, AI-enabled GRC platform that combines a unified control framework covering 45+ standards with AI-driven automation for evidence collection, evidence evaluation, control testing, and risk prioritization, augmented by expert human validation. Notable components include an AI & Context Engine that correlates signals across audits, risk, and security data, a configurable Workflow & Automation Engine, and a Common Data & Analytics Layer for cross-service reporting and executive dashboards.

CyRAACS generates revenue through a mix of professional services engagements, managed services, and recurring platform subscriptions, with CERT-In empanelled Information Security Audit and CREST-accredited VAPT credentials supporting premium pricing in regulated Indian sectors. Go-to-market is enterprise field sales led, with regional offices in Mumbai and Dubai targeting BFSI, FinTech, IT/ITES, healthcare, SaaS and emerging AI-product customers across India and international markets. Engagement pricing is quote-based and not publicly disclosed.

Name

CyRAACS

Legal name

CYRAAC Services Private Limited

Website

https://cyraacs.com

Company type

Private

Founded year

2017

Operating status

Operating

Headcount range

11–50 employees

Short description

CyRAACS is a Bengaluru-headquartered cybersecurity and risk management consulting firm that delivers GRC advisory, technical security, and platform-led compliance services through its proprietary AI-enabled COMPASS platform, primarily serving BFSI, FinTech, and other regulated enterprises across India and international markets.

Ownership category

akta.pro rank

Product category

Cybersecurity Consulting and Risk Management Services

NAICS

Computer Systems Design and Related Services (54151), Software Publishers (5132), Security Systems Services (56162)

SIC

Services-Prepackaged Software (7372)

akta.pro primary industry

IT Governance, Risk & Compliance (IT GRC) Platforms (HDAEALAK)

akta.pro secondary industries

Cloud Compliance, Audit & Continuous Controls Monitoring (CCM/GRC) (HDABAHAI), Model Governance, Risk & Compliance (GRC) Platforms (HDAAAKAA), Enterprise AI Governance, Risk & Compliance Platforms (Model Risk, Audit, Policies) (HDAEANAE), App Security, Compliance & Review Automation Platforms (BPAMADAJ)

Keywords

• Cybersecurity consulting
• Compliance management services
• Vulnerability assessment testing
• Third-party risk management
• Information security auditing

Headquarters

HQ city

Bangalore

HQ country

India

HQ region

Asia

Offices3 records

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales, Infrastructure

Revenue model

1. GRC Consulting Services: Governance, Risk & Compliance consulting including compliance readiness, audit services, risk assessments, and advisory services delivered by certified professionals.
2. Technical Security Services: Vulnerability Assessment and Penetration Testing (VAPT), specialized security assessments, and niche services including red team assessments and threat modelling.
3. Platform Services (CMS, TPRM, Managed VAPT): AI-powered platform-led services providing continuous compliance, third-party risk management, and managed vulnerability assessments with automated evidence collection and reporting.
4. Compliance Management Services (CMS): Continuous compliance management across 45+ standards and regulatory frameworks through the COMPASS platform with AI-driven automation and human validation.

Go-to-market motion2 records

Distribution channels3 records

Marketing channels12 records

Core offering

CyRAACS is an AI-enabled cybersecurity consulting firm that sells Governance, Risk, and Compliance (GRC) advisory, CERT-In empanelled audit services, and CREST-accredited technical security testing (VAPT, red team, threat modelling), all powered by its proprietary COMPASS platform. The platform unifies Compliance Management Services (CMS), Third-Party Risk Management (TPRM), and Managed VAPT into a single AI-driven, cloud-native offering that supports continuous compliance monitoring across 45+ standards. The firm targets regulated enterprises in BFSI, FinTech, and adjacent industries across India, the Middle East, and global markets.

Product overview

CyRAACS is an AI-enabled cybersecurity consulting company offering a platform-plus-services model. The core offering is the COMPASS platform, a unified technology platform that powers all services including Compliance Management Services (CMS), Third-Party Risk Management (TPRM), and Managed VAPT. Supporting these platform services are GRC Services (Audit Services, Consulting Services), Technical Services (VAPT, Specialized Services, Niche Services including AI Risk Assessment and AI Security Assessment), and industry-specific BFSI/FinTech Services and Cloud Security Services. The platform leverages AI-driven automation for evidence collection, control evaluation, and risk prioritization, while expert human validation ensures accuracy and contextual alignment with business requirements.

Differentiator

Problem solved

Functional benefit

Brands

• COMPASS: CyRAACS' unified technology platform that combines AI-driven automation with deep security and compliance expertise. COMPASS helps organizations manage audits, risk, compliance, and security programs through a single, integrated platform supporting 45+ global and industry-specific standards.

Products and services

• COMPASS Platform Unified AI-driven technology platform that powers CyRAACS' platform services, combining a proprietary knowledge base of regulations and security standards with AI-based evidence evaluation, unified control framework, workflow automation, AI and context engine, and a centralized analytics layer, delivered as a cloud-native, highly available architecture.
• Compliance Management Services (CMS) Subscription-based, AI-powered compliance management service enabling continuous compliance assurance across 45+ standards and regulatory frameworks through automated evidence collection, AI-based evidence evaluation with expert validation, and real-time compliance dashboards.
• Third-Party Risk Management (TPRM) Platform-led service providing continuous visibility into vendor and partner risk through risk-based vendor tiering, centralized assessments, continuous monitoring, AI-based evaluation and compliance marking, and real-time dashboards for enterprise third-party risk programs.
• Managed VAPT Continuous vulnerability assessment and penetration testing service providing ongoing visibility into vulnerabilities across web, mobile, API, and infrastructure environments, with expert-validated findings, risk-based prioritization, and centralized remediation tracking.
• Vulnerability Assessment and Penetration Testing (VAPT) Security testing service from a CREST-accredited team that identifies, validates, and exploits real-world vulnerabilities across applications, APIs, infrastructure, and cloud environments, covering Web Application, Mobile Application, API Security, and Infrastructure Security testing.
• Audit Services CERT-In empanelled information security auditing services including regulatory audits (RBI, SEBI, IRDAI, UIDAI) and internal audits, validating compliance against ISO 27001, SOC 2, PCI DSS, GDPR, NIST CSF, and other frameworks.
• Consulting Services Outcome-driven advisory services for GRC program building and strengthening including Compliance Readiness, Data Flow Analysis, Maturity Model Assessment, Risk Assessment, and Business Continuity planning for enterprise clients.
• Specialized Security Services Targeted security services including Secure Code Review, Secure Configuration Review, Cloud Configuration Review (AWS, Azure, Google Cloud, Oracle Cloud), and Phishing Assessment for organizational resilience testing.
• Niche Security Services Advanced security assessments including Red Team Assessment, Application Threat Modelling, Secure SDLC Review, AI Risk Assessment, and AI Security Assessment for sophisticated threat scenarios.
• AI Risk Assessment Structured evaluation of business, regulatory, and technical risks associated with AI/ML systems, assessing model behavior, data sensitivity, regulatory exposure, and potential misuse scenarios, aligned with NIST AI RMF, ISO, and EU AI Act.
• AI Security Assessment Security validation for AI/ML systems including AI/ML Penetration Testing and AI Red Teaming to identify prompt injection, model manipulation, and data leakage vulnerabilities, aligned with OWASP LLM Top 10, MITRE ATLAS, and NIST AI RMF.
• Cloud Security Services Cloud security assessment services including Cloud Security Assessments, Cloud Configuration Review, External and Internal Infrastructure VAPT, and Container Security for AWS, Azure, Google Cloud, and Oracle Cloud environments.

Quantifiable outcome

• 92% of critical vulnerabilities identified before exploitation
• +4 more outcomes

Named customers10 records

Segments11 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

AI capability5 records

Feature7 records

Scale indicators10 records

Recent moves4 records

Expansion highlights6 records

Direct peers

• Sprinto: India-based compliance automation platform that helps SaaS and tech companies achieve SOC 2, ISO 27001, HIPAA and other certifications. Direct competitor to CyRAACS' COMPASS-driven Compliance Management Services for SaaS and cloud-native buyers.
• Scrut Automation: Mumbai-headquartered GRC and compliance automation platform serving SaaS and regulated enterprises. Competes head-on with CyRAACS' platform-led CMS and TPRM offerings for India and global mid-market clients.
• Vanta: San Francisco-based automated compliance and GRC platform used widely by SaaS companies for SOC 2, ISO 27001, HIPAA and more. Competes directly with CyRAACS' COMPASS platform in the SaaS-compliance buyer segment globally.
• Drata: Automated compliance platform targeting SOC 2, ISO 27001, HIPAA, PCI DSS and other frameworks with continuous control monitoring. Direct platform competitor to COMPASS for SaaS and tech customers.
• Secureframe: Compliance automation platform delivering SOC 2, ISO 27001, HIPAA, PCI and more with continuous monitoring. Direct peer to CyRAACS' COMPASS in the multi-framework automated compliance category.
• TAC Security: India-headquartered cybersecurity services and risk-based vulnerability management firm offering VAPT, consulting and platform services. Direct peer to CyRAACS' Technical Services, Managed VAPT and consulting offerings for enterprise and BFSI clients.

Emerging players

• Scytale: AI-driven compliance automation platform focused on SOC 2, ISO 27001, HIPAA, GDPR and PCI DSS, often paired with fractional CISO services. Closely comparable to CyRAACS' blend of AI-enabled platform and advisory services.

Broad incumbents

• AuditBoard: Enterprise-grade connected risk platform for SOX, IT GRC, internal audit and operational compliance. Comparable as a broader IT GRC platform incumbent competing for CyRAACS' enterprise and BFSI customers at larger deal sizes.
• Deloitte India (Cyber & GRC practice): The Big 4 firm's Indian cybersecurity and GRC advisory practice delivers CERT-In empanelled audits, RBI/SEBI/IRDAI regulatory work and large transformation engagements. Comparable to CyRAACS' BFSI audit and consulting work targeting the same regulated enterprises.
• KPMG India (Cyber Security Services): KPMG India's cyber and IT GRC practice provides regulatory audits, third-party risk and cybersecurity advisory for BFSI clients. Directly comparable incumbent competing for the same CERT-In, RBI and SEBI engagements CyRAACS pursues.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

• Xx.com/CyRAACS
• YouTubeyoutube.com/channel/UC32ejlTv2f1kB_u_LVCQxYg
• Facebookfacebook.com/Cyraacs-102782839046840
• LinkedInlinkedin.com/company/cyraacs
• Instagraminstagram.com/cyraacs

Compliance2 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles2 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about CyRAACS