Introducing CybrOak: audit-ready compliance evidence, straight from Intune

If you run Microsoft Intune, you already have most of the data an auditor asks for. Which devices are encrypted. Whether Defender and the firewall are on. When each machine last checked in. Which ones are running an operating system Microsoft stopped patching. The problem is that none of it looks like evidence. It is spread across half a dozen Intune blades, it has no history, and the night before an audit someone ends up taking screenshots.

CybrOak is the layer that turns that data into evidence. You sign in with Microsoft, grant read-only Graph consent, and about sixty seconds later every Intune-managed Windows device is mapped to CIS Controls v8, SOC 2 and ISO 27001 controls, with a fleet score, a ranked list of what to fix first, and a one-click evidence pack.

What it does

• Findings engine. Built-in rules for BitLocker, Defender and firewall disabled, stale devices, Intune non-compliance, end-of-life operating systems, active threats, devices that never synced, and missing security patches with CVE exposure. Each rule maps to the controls it evidences.
• Framework coverage. A pass/fail view per control for CIS v8, SOC 2 and ISO 27001, so you can see exactly which controls your fleet satisfies today and which ones a handful of devices are holding back.
• Evidence packs you can verify. Every PDF is registered with an Evidence ID and a SHA-256 fingerprint. An auditor pastes the ID into cybroak.com/verify and confirms the pack is genuine and unaltered, without an account. Here is what that looks like.
• Drift history. Daily posture snapshots, so when a control silently flips off you know when, and you can show it held every day across an audit period.
• Built for MSPs. One console across client tenants, white-label evidence packs, per-client billing. Clients connect through an invite link that their own Global Administrator approves in Microsoft; we never bypass consent.

What it is not

CybrOak is not an agent. Nothing is installed on an endpoint. It is not a deployment or app packaging tool, and it does not replace Intune. It reads what Intune already knows and makes it make sense. Remediation features that write back to Intune exist, but they are off by default, each one requires its own admin consent in Microsoft, and every action lands in your audit log. The security page lists every scope we ask for.

Pricing

Free covers up to 25 devices with no card and no time limit. Starter ($79/mo, 100 devices), Growth ($249/mo, 500 devices) and Business ($599/mo, 1,500 devices) each start with a 14-day trial, also with no card. MSPs running several client tenants get per-device pricing across all of them. Details are on the pricing section.

Where we are

We are early. The product is live, the free tier is real, and we talk to every customer directly. We do not have a long list of logos to show you, and we would rather earn one than invent one. If you manage Intune for yourself or for clients and you are tired of audit-week screenshots, connect a tenant and see your own fleet scored. If something is missing, tell us at hello@cybroak.com. Everything we ship is listed on the changelog.