A free AI-guided conversation that gives you an honest, expert-quality picture of your digital resilience and compliance — no forms, no jargon, no waiting. Full management portal included.
Take a free assessment
A 10-minute AI-guided conversation. No forms, no jargon — Alex asks the right questions.
Get your report
Automated PDF with a personalised findings summary and prioritised action plan, emailed instantly.
Manage it in the portal
Import your results. Track findings, build policies, manage incidents — everything in one place.
Choose your assessment below. A natural AI-guided conversation — no forms, no jargon. Personalised PDF report with findings and action plan delivered to your inbox.
Find out how your business performs across digital maturity, operational resilience, cloud security, and more — with a personalised action plan delivered to your inbox.
Free · No sign up required
A structured GDPR assessment that tells you exactly where you stand on data protection — from a quick free check to a full compliance programme ready for investor due diligence.
Free · No sign up required
Which regulations and certifications apply to your business?
Map your compliance obligations across UK, EU, and US in minutes. Covers GDPR, NIS2, EU AI Act, HIPAA, SOC 2, ISO 27001, and 50+ more — instant results, no account needed.
Expert-quality security and compliance — without the waiting list, the day rates, or the jargon.
No lengthy questionnaires. Alex has a natural conversation with you, asks follow-up questions, and builds up an accurate picture of where you really stand.
Every question and recommendation was shaped by Jason Gillan — a practitioner with hands-on security experience from the Ministry of Defence and NATO to UK SMEs. Not a generic template.
Every report comes with a prioritised action plan. Not just a score and a list of risks — clear next steps you can act on today.
Your data, your reports, your roadmap — all yours to keep. Fortify doesn't create artificial dependency. Cancel anytime, export everything.
“After 15 years watching what actually goes wrong, I built Fortify so any SME can benefit from that experience — without the consultant's day rate.”
Jason · Founder
Read the full story →CE+ is mandatory for central government contracts, NHS supplier access, and an increasing number of sector procurement frameworks. Fortify maps your readiness across all five control areas for free — then guides you through the full audit with AI.
5 control areas
Included in portal plans
Essential and above
5 sections · 26 controls
Your assessment results import automatically. From there, the portal gives you the tools to actually fix what you found — not just know about it.
Findings & Roadmap
Every gap from your assessment lands here. Build a prioritised 30/60/90-day action plan and track completion over time.
Policy Editor
Draft, maintain, and version your policy library. AI fills templates from your org profile — 8 policy types ready to go.
Incident Management
Log security incidents, run structured playbooks, assign follow-up actions, and build an audit-ready incident history.
Evidence Vault
Attach evidence files to findings, policies, and audit controls. Every claim is traceable, every control is defensible.
Ask Alex
AI follow-up questions specific to your organisation's findings and context — not generic answers, but answers about your situation.
Quarterly Reviews
Auto-generated PDF showing score movement, roadmap completion, and an AI narrative — shareable with your board or investors.
Action Plan
Gantt-style timeline with topological dependency scheduling and per-person resource allocation. Annual tier.
Team Collaboration
Invite your team, assign findings and actions to individuals, track accountability — with full role-based access control.
Vendor Management
Maintain a full supplier register with criticality ratings, DPA status, contract dates, and CVE monitoring — so third-party risk never falls through the cracks.
Portal plans
Foundation
Free forever
Essential — from £149/mo
DR + GDPR + 1 audit bundled
Strategic — from £349/mo
DR + GDPR + 2 audits bundled
Advanced — from £649/mo
DR + GDPR + all 4 audits bundled
Go beyond the assessment. Audit your controls against recognised frameworks — guided by AI, with evidence tracking built into your portal. Included in Essential and above.
Cyber Essentials Plus
Work through all 5 Cyber Essentials Plus technical control areas with AI-guided conversation, per-control evidence capture, and a full results summary.
DORA Readiness
Assess your ICT risk management posture against the Digital Operational Resilience Act (DORA) — scoped to your entity type.
Explore Fortify
By compliance framework
NIS2 and UK SMEs: building the plan, not just reading the regulation
NIS2 is an EU directive, but UK businesses selling into the EU — or supplying an in-scope EU entity — can still inherit its obligations. The harder part isn't understanding the regulation, it's turning it into an evidenced security programme.
CertificationWhy more contracts and insurers are asking for Cyber Essentials Plus
Cyber Essentials used to be enough to tick the compliance box in most tenders. Increasingly, procurement teams and cyber insurers are asking for the technically verified version — CE+ — instead. Here's why, and what actually changes in the assessment.
Data protectionICO enforcement trends: what recent activity tells SMEs about GDPR evidence
ICO enforcement makes headlines when it hits a household name, but the pattern behind most action against SMEs is far more mundane — and far more fixable. Here's what it means for how you keep your GDPR paperwork.
GDPR Privacy Policy template
A generic UK GDPR-compliant privacy policy you can adapt for your business.
Incident Response Plan template
The document assessors and auditors ask to see first — detect, contain, report.
Cyber Essentials policy templates
Starting-point policies for all five Cyber Essentials control areas.
You should know exactly how your information is handled before you start an assessment.
Fortify uses the Anthropic Claude API. Anthropic does not use API data to train its models. Your responses are used solely to generate your report.
Your assessment responses and contact details are never sold to third parties or shared with any external organisation. Full stop.
Assessments ask about your processes and practices — not individuals. Please avoid sharing personal data such as customer or staff details during the conversation.