FAQ
Frequently asked questions
Straight answers about Tricognita's services and ARIA, our product for cloud control remediation and verification: what they cover, how changes are authorised, and how engagements are priced and run.
Tricognita
What does Tricognita do?
Do you provide services, software, or both?
Both. Services are engineering work done by people: assessment, testing, remediation, readiness and engineering. ARIA is software that evaluates cloud controls, applies approved, bounded fixes where supported, verifies them and keeps a record. Every available service can be bought on its own, and you do not need services to use ARIA.
Who do you work with?
Teams running cloud environments, with industry pages for SaaS and Fintech teams. We work with companies in India and the United Arab Emirates.
ARIA
What is ARIA?
ARIA is Tricognita's product for cloud control remediation and verification. It follows one model: Evaluate → Fix → Verify → Keep secure → Evidence. ARIA is currently launching; each capability shows its current state on the product page.
Does ARIA replace security engineers?
No. ARIA handles repeatable cloud-control work: checking controls, applying approved, bounded fixes where supported, re-checking and keeping records. Scope, priorities, risk decisions and the approval of every change stay with people.
Does ARIA make changes automatically?
Not without your authorization. Each kind of automated fix is off by default. It is switched on per organisation. Nothing changes in your cloud until someone with approval rights approves it. A fix changes one setting on the one resource that failed. It cannot be pointed at anything else.
How does ARIA verify a fix?
After a fix is applied, the control is checked again straight away. Only a passing check marks the control remediated. Each fix ends in one of three outcomes: Fixed, Did not fix it, or Unconfirmed.
What evidence does ARIA produce?
Every check is saved as an evidence record: the control, the resources, the time and the result. Each evidence record is signed and linked to the one before it. When a record is opened, the product checks it still matches what was written. A closure record brings it together: what failed, what changed, who approved it, whether the fix worked and whether it stayed fixed.
Clouds
Which clouds do you support?
AWS: services available, ARIA launching. Microsoft Azure: services available, ARIA launching. Google Cloud: services launching, ARIA launching. Capabilities differ by cloud, and each cloud page shows its current state.
What does Tricognita cover on Google Cloud?
Google Cloud support is being expanded. The services that cover Google Cloud are Cloud Security Assessment, Remediation & Hardening and Security Retainer, currently launching there. ARIA evaluation on Google Cloud is launching. Other services do not cover Google Cloud yet.
Do you cover Kubernetes?
Kubernetes Security is launching. It covers managed clusters on EKS and AKS. Other distributions, and Google Cloud's GKE, are not currently in scope.
Services
What services do you offer?
Core services: Cloud Security Assessment, Penetration Testing (VAPT), Remediation & Hardening and Security Retainer. Supporting services: DevSecOps & CI/CD Security, Certification Technical Readiness, Secure Cloud Engineering, Resilience Review and Cost & Security Review. Specialist services: Kubernetes Security. Each service shows its current state.
All services Cloud Security Assessment Penetration Testing (VAPT) Remediation & Hardening Security Retainer
Can I book a service that is launching?
Not yet. Penetration Testing (VAPT) and Kubernetes Security are launching: you can register interest, and they are priced at launch.
Are there services you do not offer yet?
AI / LLM Application Security Testing, PCI DSS Technical Support and ISO 42001 Technical Security are planned: on our roadmap, and not yet offered.
Remediation and verification
What does an assessment look at?
Cloud Security Assessment reviews identity and access management, network controls, logging and monitoring, storage, encryption, account configuration and resilience-related controls. Each control is checked by a defined rule. AI does not decide whether a control passes. If a control cannot be checked, we say so. It is never counted as passing.
What can be fixed automatically?
Customer-authorised fixes on Azure (currently launching): Supported automated fixes are available by enablement for supported controls, subject to customer authorization. Customer-authorised fixes on AWS (currently launching): The same bounded, approved fix model on AWS, for a narrow set of supported actions. Not every control has an automated fix; everything else is changed by people and verified the same way.
What happens if a fix does not work?
Each fix ends in one of three outcomes: Fixed, Did not fix it, or Unconfirmed. If the re-check fails, the control stays open, and the fix can be planned again.
What happens if a control breaks again later?
Controls are re-checked on a schedule, and a control that passed and now fails is flagged. It can then be fixed and verified again the same way. This is currently launching.
Pricing and engagement
How are services priced?
Each engagement is scoped to the problem, then priced in writing. Available services have a fixed price after scoping; launching services are priced at launch. No price list is published.
Is ARIA included in the Security Retainer?
Platform access is included with the Security Retainer as its capabilities launch.
Can I use ARIA on its own?
Standalone access is launching. Standalone packaging and pricing will be set with early pilot customers. No standalone price is published yet.
What does an engagement look like?
Scoping → Written scope → Engagement → Findings and priorities → Approved remediation → Verification → Ongoing support. Timelines are agreed per engagement.
How do I start?
With a scoping call. We reply by email to arrange it, and you receive a written scope before any work starts.
Trust and security
What access do you need?
Checking your controls needs read-only access. Applying a fix needs an additional, narrowly scoped permission for that one kind of change. You grant it only if you want Tricognita to apply fixes.
Who authorizes changes?
Your organisation. Nothing changes in your cloud until someone with approval rights approves it. An approval is valid for a limited time. After that, it must be approved again.
What stays under my control?
Access uses read-only roles you create and can revoke at any time. Each kind of automated fix is off by default. It is switched on per organisation.
Where is my data stored?
Where data is stored and processed is set out in writing for each engagement.
Certification and readiness
Can you certify us for ISO 27001 or SOC 2?
No. Tricognita does not issue certifications or provide accreditation. Certification is issued by independent auditors. Certification Technical Readiness implements and evidences the technical controls your auditor will test, alongside your compliance consultant.
Does Tricognita hold a SOC 2 or ISO 27001 certification?
Tricognita does not yet hold a SOC 2 or ISO 27001 certification.
Is a closure record an audit opinion?
No. It is a record of what happened: what was checked, what changed, who approved it and what the check returned. It is not an audit opinion, an attestation or a certification.
Do you support PCI DSS?
PCI DSS Technical Support is planned. It is on our roadmap and not yet offered.
Still have a question?
A scoping call is the quickest way to get an answer for your environment. You receive a written scope before any work starts.