From one-off assessments to a repeatable security service: what's new in Acuity Essentials for MSSPs
Most MSSPs know the assessment problem well. Every new client means a fresh spreadsheet, a stack of policy PDFs, interviews that take weeks to schedule, and a report that is out of date by the time it is delivered. The findings rarely turn into a plan the client acts on, and next year the whole exercise starts again from scratch.
Acuity Essentials was built to fix that. The latest release adds the pieces that turn a one-off assessment into a repeatable, evidence-backed service you can run across your whole client base.
Start from the documents your clients already have
Clients rarely have time to answer hundreds of control questions, but they do have policies, standards, procedures and evidence. With documents-first assessments, you upload what the client already has. Acuity’s AI drafts the self-assessment for every NIST CSF 2.0 control, and leaves a control blank when the documents don’t cover it rather than guessing.
Your team reviews and adjusts the draft instead of starting from a blank page. Onboarding a new client moves from weeks of interviews to a working first draft.
Answers that are checked against the evidence
Self-reported maturity is only as good as the honesty and memory of whoever filled it in. Acuity checks each control’s answers and narrative against the client’s uploaded documents. It flags unsupported claims, contradictions, outdated or missing evidence and vague narratives. Then it asks up to three targeted follow-up questions per control, each citing the evidence it came from.
The result is an assessment you can defend. Every maturity score comes with a written rationale and how close the client is to the next level.
Show clients what they’re actually protected against
Maturity scores alone don’t tell a client whether they are protected against the attacks that matter to them. Acuity now shows threat coverage: how well the client’s controls and tools cover the MITRE ATT&CK techniques used by the threat groups that target their industry. Coverage is laid out across the attack lifecycle, from getting in to moving through to getting out, and adjusted to the client’s threat sensitivity.
That gives you a conversation about real-world risk, not just compliance.
Gaps your clients can act on, in three views
- Tools: the missing tool types that would add the most threat coverage, ranked. For an MSSP, this shows exactly where a managed service closes a measurable gap.
- Maturity: the controls below the client’s targets. Targets are pre-filled from benchmarks for the client’s industry.
- Policies: an AI review of the client’s documents against a 36-item evidence checklist, with each item marked covered, partial or missing.
A roadmap, not just a report
Tell Acuity the client’s goals, budget, delivery model, owners, timeframe and the threats they most want to prevent. It returns policy, maturity and tool recommendations in an ordered executive summary, each linked back to the gap it closes. The roadmap is what turns an assessment into the next phase of the engagement, and gives every quarterly review a clear agenda.
Acuity can also build the client’s tool inventory for you, finding the security tools in their assessment evidence and recording each one’s type and configuration level.
Built to run across many clients
Essentials is designed for teams that serve many organizations:
- Manage every client from one platform, with each client’s data isolated.
- Give clients their own portal access, with roles for client admins and users.
- Assess against NIST CSF 2.0 and CIS Controls v8.1, with guiding questions for every control.
- Export per-control scores, gaps, rationale and narratives to CSV.
The numbers behind scores, coverage and gaps are computed the same way every time. AI writes the narrative and does the reading. Your results are repeatable and explainable, from one client to the next.
See it with your own clients in mind
If your team is still running assessments from spreadsheets, we’d like to show you what Acuity Essentials can do with a real client’s documents.