AI Companion
Meet Aegis. The AI team that knows the way.
A virtual compliance team in software. Aegis translates framework jargon into actionable guidance, drafts SSP narratives, runs gap analysis, and walks non-experts through FedRAMP and CMMC step by step — replacing the $100K+ consultancy floor.
How Aegis builds an answer
Three layers of grounding. Zero hallucinations on what matters.
Aegis isn't a generic chatbot wrapped around a foundation model. Every answer is grounded in three layers — your live package state, your curated knowledge base, and the canonical framework catalogs — with source citations on every claim.
Your live package state
What controls are implemented vs. open. What evidence is attached. What POA&Ms are aging. Your readiness score and assessor-walkthrough risk. Aegis sees your work in flight, not a static export.
Your knowledge base
Uploaded policies, prior assessor findings, internal SOPs, architecture diagrams. The more your admin curates, the sharper Aegis gets — every team's KB compounds into an organization-specific expert over time.
The canonical corpus
FedRAMP Rev 5 catalog. NIST 800-53, 800-171, 800-160. CMMC Level 2 practices. OSCAL spec. FedRAMP 20x KSI definitions. Aegis has read every page of the entire framework universe — so you don't have to.
What you can ask
Real questions. Grounded answers. Source citations on every claim.
A sampling of what Aegis handles every day — for SaaS founders pursuing their first ATO, defense subs preparing for C3PAO, and consultants managing a dozen engagements at once.
Catalog interpretation
"What does AC-2 require for FedRAMP Moderate?"
Grounded in: NIST 800-53 Rev 5 catalog + FedRAMP baseline parameters
Contextual package question
"What evidence do I need for AC-2 in this package?"
Grounded in: Your live package state + control implementation gaps
Workflow walkthrough
"How do I generate the SSP PDF?"
Grounded in: TekRamp KB + deep links to the right screens
Diagnostics
"Why is my readiness score 72%? What's blocking the C3PAO assessment?"
Grounded in: Readiness score breakdown + POA&M blocker analysis
CMMC scoping
"Where does CUI live in my environment, and how can I reduce scope?"
Grounded in: Your uploaded diagrams + NIST 800-171 scope rules
SSP drafting
"Draft the AC-2 control implementation narrative for my system."
Grounded in: Your architecture + organization profile + catalog requirements
Capabilities
Everything you'd hire a $100K consultant to do — and a few things you couldn't.
Plain-English Q&A with citations
Ask anything about FedRAMP, CMMC, NIST 800-53, NIST 800-171, OSCAL, or your live package. Every answer comes with source citations and deep links to the controls, evidence, or POA&Ms it referenced.
AI-drafted SSP narratives
Generate FedRAMP-compliant control implementation narratives from your architecture, organization profile, and catalog requirements. "Insert into SSP" puts the draft directly in your package — you keep editorial control.
Gap analysis & readiness scoring
Aegis scores your package against your target framework, surfaces the controls most likely to fail an assessor walkthrough, and prioritizes remediation by impact — for both FedRAMP and CMMC.
AI CUI scoping for CMMC
Upload your network diagrams. Aegis identifies CUI touchpoints, recommends scope reductions ("move CUI to an enclave, drop from 110 practices to 17"), and catches the silent killers — forgotten backups, shared infrastructure, overlooked data flows.
Workflow walkthroughs
Step-by-step guidance through the action you need to take — with deep links into the right screens. Aegis turns "what do I do next?" into a clickable answer.
Knowledge-base aware
Aegis grounds answers in your knowledge base — uploaded policies, prior assessor findings, internal SOPs. The more your admin curates, the sharper Aegis gets for your organization.
In the product
Anchored to every page. Always one click away.
Aegis lives in the bottom-right of every page in TekRamp. Pop it out into the full /aegis workspace when you need room to think — package-aware multi-turn chat, source drawer, and "Insert into SSP" all included.
A note on what Aegis isn't
Aegis is for the 80% that's repeatable.
The 20% that's situational still needs human expertise — and we're explicit about where that line sits. We'd rather you trust Aegis on what it's great at than discover the cliff in the middle of an assessment.
Aegis does not handle
- Novel agency-specific control interpretations
- Judging whether a specific document satisfies a specific assessor
- Final-form narratives for high-stakes controls without human review
- Custom remediation plans involving organizational change
- Edge-case OSCAL constructs
- Contractual or legal questions — Aegis is not a lawyer
For these, Aegis routes you to a vetted human via the partner marketplace — or surfaces the right question for your consultant or 3PAO.
See Aegis on your package.
Request a demo and we'll walk you through how Aegis handles your controls, your evidence, and the questions your assessor is about to ask.