Most people who look at a security platform do not hesitate because they doubt the product. They hesitate because they cannot picture the first hour.
What do I have to prepare? How long before I see anything useful? Will I be halfway through setup before discovering I need something I do not have?
This is a walkthrough of exactly that first hour. No product promise, just the sequence of steps and what each one produces.
Who Cyfora Free is for
Cyfora Free is built for the person who already has material to work with. A self-assessment in the CCB spreadsheet for CyFun, the Belgian interpretation of NIS2, a security policy document, or a technology stack they want measured against best practice.
If you are responsible for a CyFun assessment and you currently manage it manually, the free tier is designed to show you what the same work looks like when the platform does the mapping.
If you have not started your assessment at all, the free tier still works, but you will get less out of the first session. The import is what makes the first minute worthwhile, and the import needs a file.
The fastest start: import your existing spreadsheet
When your tenant is created, the framework is empty. The spider chart shows nothing and maturity defaults to a level of one, which simply reflects that no data has been entered yet.
The fastest route out of that empty state is the file you already maintain.
Go to Frameworks, then CyFun, then Import. Select your CCB spreadsheet and start the import. The platform reads every data point in the file and maps it to the correct control in the framework, which means you skip the part where somebody types one hundred to two hundred controls by hand.
"Under a minute, using the file you already maintain."
What the import carries across
Three things come over, and the third is the one people do not expect.
Documentation scores for every control in the file
Implementation scores, kept separate from documentation, the way CyFun prescribes
The comments you already wrote, attached to the controls they belong to
That third point matters more than it sounds. The comments in a CCB spreadsheet usually hold the reasoning behind a score: why a control was rated the way it was, what the exception is, what still needs doing. That context normally gets lost in a migration. Here it travels with the data.
Before anything is applied, a validation screen shows you the imported data. You can review it entry by entry, or apply the changes and move on.
What you see immediately after
Applying the changes fills the framework.
The spider chart that was empty a minute ago now shows every domain scored. You can switch between a high level function view, which is the one to put in front of a management team, and a detailed view carrying every individual requirement.
Three things are visible right away:
Your overall framework score against the target for your tier
Which domains are strong and which are weak, side by side rather than buried in rows
The Attention Required view, which highlights the domains scoring lowest, so you know where effort produces the largest movement
Click into any category and the underlying data appears, comments included. Nothing is hidden behind a paywall at this stage: the assessment you brought with you is fully visible.
Adding your first technology and your first policy
The import shows you what you already knew, organised better. The next two steps show you something new.
One technology best practice check. Connect a component of your stack and the platform benchmarks how its capabilities are actually being used against best practice, taking your licence tier into account. You get a maturity score, a trend direction, and the detailed report behind the number rather than the number alone.
One security policy analysis. Upload a policy document and an AI agent classifies it, then tests it against the framework at sub-requirement level. The analysis takes around an hour depending on the size and complexity of the document. What comes back per requirement is fully covered, partially covered, or not found, with the reasoning and the exact paragraph the analysis read.
Run both and you will have the three views that matter side by side for the first time: what your assessment says, what your technology does, and what your policy describes.
What you can do after your first assessment
Set priorities: Attention Required tells you which domain drags the overall score down hardest. Start there.
Add evidence: Where you can substantiate a score, attach the proof and record the reasoning in a comment. Future you, sitting across from an auditor, will appreciate it.
Track progress: The history overview retains the data behind every score change. Fix something, re-run, and the movement is recorded rather than overwritten.
That last one is the habit worth building early. A score is a snapshot. A history is an argument.
When upgrading makes sense
The free tier covers one technology and one policy. That is enough to see how the analysis works and whether the output is useful in your context.
The moment it stops being enough is usually predictable: you want the rest of the stack measured, not one component, and you want every policy document analysed rather than your best one. At that point the conversation is worth having properly, because what you need depends on which technologies you run and which CyFun tier applies to you.
A short checklist to start today
Your CCB or CyFun spreadsheet, in its current state. It does not need cleaning up first
One policy document you would like tested against the framework
One technology component you are willing to connect read only
About an hour, most of which is the policy analysis running in the background
From a first look to a working baseline
The first session will not make your organisation more secure. What it will do is replace an assumption with a measurement, in three places at once.
Cyfora Free exists so you can make that comparison with your own data rather than a demo dataset. Bring the spreadsheet you already maintain and see what the platform tells you about it.
The import takes a minute.
