Audits per year
The plan covers what the team can staff. The rest of the audit universe waits for next year's cycle, and often the one after.
For internal audit
Test the whole population. Not a sample.
Atorian is the AI operating system for internal audit. It does the audit work itself: it interviews auditees, reads every document, tests full populations of data, and drafts findings that trace back to their evidence. Your team covers more of the audit universe, more often, without growing in proportion.
- Built by a former chief IT auditor
- Already at work inside bank internal audit functions
Control AC-04Leaver accounts are disabled within one business day
412leavers tested
37exceptions
9used after termination
Enough to fix it: every account, by name.
- Tested, no exception
- Exception
- Used after termination
01The constraint
Your audit plan was never limited by risk. It was limited by people.
How many audits fit in a year. How many transactions a test can sample. How long fieldwork can run. The traditional audit model was built on the limits of human labor, which makes a risk-based plan, in practice, a capacity-based one.
Items per test
A sample of 25 stands in for a population of thousands. It can tell you something is wrong. It can't tell you where.
Hours per audit
Fieldwork ends when the budget does, not when the questions do. The areas that deserved a second look rarely get one.
02What's different
Most AI in audit handles the work around the audit. Atorian does the audit.
Audit management software now uses AI to draft the plan, tag issues and chase follow-ups. That makes the paperwork faster. The fieldwork itself (the interviews, the evidence, the testing and the judgment about what it all means) is still done by hand. That is the part Atorian does.
AI around the audit
- Drafts the audit plan
- Tags and categorizes issues
- Chases management action plans
- Formats the report
Atorian, inside the audit
- Interviews process owners, and follows up on what they say
- Reads every policy, procedure and set of minutes in full
- Tests full populations from the data exports you already have
- Finds where what people say and what the evidence shows disagree
- Drafts findings that trace back to the evidence they rest on
Keep your audit management system. Atorian does the fieldwork it was never built to do.
03How it works
From planning memo to audit committee report, on one platform.
Atorian follows an engagement the way your team runs one. Your auditors set the scope, review the work and own every conclusion. The platform does the legwork, at a scale no team can staff.
-
01
Planning
Understand the auditee
Atorian builds a profile of the audited unit from its own documents and public sources, and names the source of every fact. It proposes the fieldwork plan and the standards that apply, and shows why each one does.
Your teamapproves the scope and the standards -
02
Walkthroughs
Interview the people who run the process
Process owners answer in a guided workspace instead of a long questionnaire. They can talk instead of typing, or hand over a document and let it answer the questions it covers. Atorian asks follow-up questions based on what they say.
Your teamchooses who is interviewed, and reads every answer -
03
Evidence
Read everything, not a selection
Policies, procedures, committee minutes, prior reports, system exports and logs. Every document is read in full, every quote is checked against its source text, and every claim records who made it.
Your teamadds anything the auditee didn't send -
04
Testing
Test the whole population
Audit apps run full-population tests on the data you already export: every leaver against active accounts, every loan approval against credit policy, every patch against its deadline. You get the exceptions, not ten thousand rows.
Your teamdefines the test and the threshold -
05
Findings
Connect what people say to what the evidence shows
Observations become candidate findings, each traced to the quotes and documents it rests on. Where an interview and the evidence disagree, Atorian flags it, and the finding can't be confirmed until the contradiction is resolved. Every observation is either part of a finding or listed with the reason it isn't.
Your teamconfirms, challenges or rejects each finding -
06
Reporting
Report to the audit committee
A draft report is ready before the full analysis has run. Recommendations carry timeframes, and every finding opens to its evidence, so the report holds up when management pushes back.
Your teamsigns the report
"Which of these findings rests on a single interview?"
The AI Advisor reads the whole engagement, interviews and attachments included, and answers questions about it while the work is still underway.
04Evidence
A finding management can't argue with, because every line traces back.
Select a source to see what it says and which part of the finding it supports.
Leavers kept active access after the quarterly review certified it removed
- Criteria
- Access Management Policy v3.2, §4.3: accounts of leavers are disabled within one business day of the termination date, and user access is reviewed and certified every quarter.
- Condition
- All 412 leavers from January to June were tested against the directory. 37 accounts were still active more than one business day after termination, and 9 were used after the termination date, 3 of them on the core banking system. The Q2 access review was certified 100% complete.
- Cause
- Offboarding tickets close when the service desk acts on the HR request, not when the account is disabled. The quarterly review runs on each application's user list, which does not show directory accounts.
- Effect
- Former employees kept access to customer data, and the control attestation reported to the audit committee overstated the control's effectiveness.
- Recommendation
- Close offboarding tickets only on confirmed account disablement, and reconcile the HR leavers file to the directory every month. Owner: head of IT operations. Target: 60 days.
Illustrative finding. The organization, figures and quotes are fictional, written to show the format.
05The audits
One platform for every audit in your plan, not a tool for one of them.
Atorian is an operating system for audit. We started with technology audits, where the evidence is densest and the specialists are hardest to hire. The library keeps growing, and any audit in your plan can be built on it with us.
Technology and cyber
- Cybersecurity risk
- Cloud security
- Identity and access management
- Network security
- Application security
Governance and compliance
- IT general controls (ITGC)
- SOX IT controls
- IT governance
- PCI DSS
- ISO 27001 gap assessment
Risk and resilience
- Data privacy
- Business continuity
- Third-party and vendor risk
- Responsible AI
Your audit programs
Bring an audit from your plan, whether it covers procurement, credit, operations or anything else, and we build it into the platform with you, against your own policies and methodology.
Audit apps: the tests you've only ever sampled.
Some tests are too large to do by hand. An audit app automates one of them on the data you already export, and returns the exceptions straight into the audit.
5,000,000
login records, with 100,000 exceptions in them
One line in the report
2% of logins without MFA. 7% from risky devices, none of them blocked.
Leavers who still have access
Every leaver, against every account that is still active.
HR leavers file × directory export
Loans approved outside policy
Every approval, checked against your own credit policy.
Loan approvals × credit policy
Patch discipline
Every critical vulnerability, against the deadline it was given.
Scan exports × patching SLAs
Vendors nobody assessed
Every supplier you pay, against the third-party risk register.
Vendor master × risk register
06The outcome
Not the same audit, faster. Audits you couldn't run before.
Coverage
Whole populations instead of samples, so a finding names every exception rather than estimating them.
Frequency
Test key controls more often, and move from point-in-time audit toward continuous assurance.
Depth
Go further wherever the evidence points to risk, without reopening the budget to do it.
Capacity
Cover more of the audit universe without growing the team in proportion.
Less disruption
The business and technology teams answer in their own time and hand over documents instead of sitting through meetings.
A clearer picture
Management and the audit committee get a current, evidence-based view of risk, not last year's.
Auditors working alongside AI agents, covering far more of the organization's risk, and spending their time on judgment, complexity, and the questions that truly need human expertise. That is the function we are building for.
Menny Barzilay, co-founder and CEO, former chief IT auditor07Security
Built to pass your own audit.
You'll be trusting the platform with policies, evidence and interview records. Your CISO will want to review it, and should. Here is what they'll find.
Isolation
Your own instance
Each customer runs in its own instance, with its own database, its own storage and its own users.
Deployment
In your environment, if you prefer
A dedicated cloud instance, or an installation on premises in your own environment, with AI calls routed through your own gateway.
Traceability
Conclusions you can reconstruct
Every finding traces to the quotes it rests on, and every quote to its source document and to the person who said it.
Testing
Independently tested
An independent penetration test in July 2026 found no critical or high-severity issues. SOC 2 Type I, with Type II in progress.
Access
Secure sign-in
Two-factor authentication, single sign-on with Google, and protection against brute-force attempts.
Before approval
Start before the security review ends
Security approval usually takes longer than the decision. The first stage can run in Atorian's own environment, so your team sees the platform before your process has to approve anything.
08Getting started
Start with one audit from your plan.
A fixed-scope pilot on a real audit, with your own data and your own auditors. Scope, sources, deliverables and success measures are agreed before it starts.
Route A
A whole audit, end to end
Pick an audit from this year's plan. Atorian runs it from planning to report, with your auditors working in the platform alongside it.
- Tests the full lifecycle, on a real engagement
- Your auditors learn the platform by using it
Route B
One test you've never had the people for
Pick a single use case, usually a full-population test you have only ever sampled, and we build the audit app for it.
- Results on one question you already care about
- A narrow scope for a fast security review
The pilot is credited toward a license if you continue
One license, sized by the scope of your audit work
No per-user or per-seat fees
09The team
Built by people who have sat on both sides of the audit committee table.
Menny Barzilay
Co-founder and CEO
Former chief IT auditor and former CISO. Has chaired the audit committees of two nonprofits, and lectures in IIA Israel's auditor training. CTO of the Blavatnik Interdisciplinary Cyber Research Center at Tel Aviv University.
Shay Zandani
Chief Services Officer
Former partner at PwC and KPMG. Founded a company that was acquired by Mastercard.
Daniel Finchelstein
Co-founder and CTO
Fifteen years at Check Point, building some of its most successful products.
Meet the whole team
Advised by Mark McLaughlin, chairman of the board at Qualcomm, Steve Zalewski, former CISO at Levi's, and Prof. Isaac Ben Israel, director of the Blavatnik Interdisciplinary Cyber Research Center.
Book a walkthrough
Bring us the audit you've never had the people for.
Thirty minutes with the people who built the platform. Walkthroughs are run by practitioners, not a sales script, so bring your hardest questions.
- A finding traced live, from report to source
- An audit from your own plan, mapped onto the platform
- What a pilot would look like for your function