When a consultancy can’t find the tool it needs, it has two options: adapt or build it.
We built it.
Gjallarhorn, Skuld GRC, Heimdall, Gungnir and Kvasir didn’t come from a product brief, they were born from years of fieldwork where available tools simply weren’t enough.
Today they are the platforms we operate alongside our clients. Not generic demos: production systems, with real data, in organizations that cannot afford to fail.
Why build instead of adapt?
Precision over generality
Generic tools are designed for everyone, and that’s exactly why they’re perfect for no one. Ours were built to solve specific cybersecurity problems in Argentina’s regulatory, organizational, and technological context.
Speed without losing depth
An analyst who switches between six tools to investigate one IOC loses time and context. An organization managing ISO 27001 in spreadsheets loses traceability. Our platforms eliminate that friction without cutting technical rigor.
Ecosystem, not silos
The four platforms are not independent products, they are platforms that integrate with each organization’s security ecosystem: existing tools, processes, and internal team.
Four platforms. One complete security ecosystem.
Each platform covers a critical dimension of organizational security. Together, they form the technological core AllSafe uses with its clients.
Gjallarhorn
The SOC platform born because investigating threats across 10 different tools is not a strategy, it’s a problem.
Gjallarhorn centralizes IOC investigation against 20+ threat intelligence sources, static malware analysis, email forensics, and case management in a single interface. Natively integrated with TheHive, Wazuh, Velociraptor, OpenVAS/GVM and Nessus, with no additional agents and no complex configurations.
When Wazuh or Suricata detect an event, Gjallarhorn investigates the involved indicators and opens the enriched case. The response is built with visual playbooks that notify, block the IP, isolate the compromised host, or launch a scan, with no intervention. And from the same panel it manages the servers’ WAF (ModSecurity), without logging in over SSH.
The current version adds a dynamic analysis sandbox running against CAPE, a Sigma and YARA rule editor, STIX 2.1 export, and a multi-client layer that isolates each organization’s information inside the same installation.
Static malware analysis
Email forensics
Case management
Automatic correlation
Dynamic sandbox · CAPE
Sigma/YARA rule editor
STIX 2.1 export
Multi-client
JWT Auth + 2FA + RBAC
Skuld GRC
The platform that replaces Drive folders with “v1_final_definitive” files with a real management system.
Skuld GRC covers the full implementation and maintenance cycle: asset inventory, risk analysis with RAM matrix and residual risk, the 93 Annex A controls, statement of applicability, gap analysis with CMM maturity, internal audits, policies and procedures, and an executive dashboard with PDF export.
It takes ISO 27001 as its backbone and from there assesses fifteen standards and frameworks on the same management system, among them 27017, 27018, 27701, 42001 and 22301, with derived coverage of CIS Controls v8 and NIST CSF 2.0. One implementation answers for all of them.
It is licensed on its own, for the internal team to run, or together with an AllSafe engagement. In that second arrangement consultants and the client’s team work on the same platform, so when the auditor arrives everything is organized, traceable and ready.
Risk analysis · RAM matrix
93 ISO 27001:2022 controls
15 standards and frameworks
Statement of applicability
Gap analysis · CMM maturity
Inherent and residual risk
Internal audits
Document management
Executive dashboard
Gungnir RT
The platform that runs the full lifecycle of a pentesting engagement, from client onboarding to the delivered PDF report.
Gungnir covers the whole offensive workflow: clients, engagements with structured phases (Planning, Reconnaissance, Scanning, Exploitation, Post-Exploitation, Reporting), timestamped operation logs, scope management, evidence upload and MITRE ATT&CK mapping.
The findings editor includes a visual CVSS 3.1 calculator, CWE and OWASP classification, CVE auto-populate from the NVD API, and professional PDF report generation. An arsenal of 2,300+ pentesting commands and an OSINT module with Shodan, VirusTotal, Censys, crt.sh and DNS round out the platform.
Engagements are exported and imported whole as a portable file, with findings, phases, evidence and attack map included, and the team works on the same engagement in real time, seeing what everyone else is loading without stepping on each other.
The cycle continues after delivery, with remediation and retest of every finding, time tracking and a WSTG/PTES methodology checklist, and the Purple bridge that crosses the engagement’s techniques against the SOC’s detection.
Visual CVSS 3.1 calculator
CVE auto-populate (NVD)
XML import · Nessus/Burp/OpenVAS/Nmap
Arsenal · 2,300+ commands
Attack Map · Interactive topology
OSINT · Shodan/VT/Censys
Portable engagements · export/import
Real-time team work
Remediation & retest
WSTG / PTES coverage
Purple bridge with the SOC
Professional PDF report
Kvasir SAT
The platform that measures and reduces human risk: it simulates the attacks your employees will receive and trains whoever falls on the spot.
Two pillars on the same engine. Realistic phishing campaigns, with our own email, landing page and tracking and passwords masked for ethics, and full training that lives inside the platform, not in a PDF nobody opens.
The adaptive loop closes the circle: whoever falls in a simulation is automatically assigned the remediation training and notified by email. On passing, a certificate with your brand, signed and verifiable by a third party.
Multi-company at its core, each organization sees only its own, with a supervisor role that audits its metrics and certificates. Live instructor-led classes, a didactic simulator and white label complete the platform.
Training inside the platform
Adaptive loop, fall and get trained
Verifiable certificates with your brand
Course · phishing, credentials, ransomware, ISO 27001
Didactic simulator by difficulty
Live instructor-led classes
Metrics per company and per person
Supervisor role · the client audits its own
White label · logo per client
pillars, phishing simulation and training, in one platform
whoever falls in a simulation gets trained automatically
verifiable certificates with your brand
Heimdall Honeypot
The decoy system that spots the attacker before they find anything real in your infrastructure.
Heimdall deploys convincing honeypots (fake login pages, trap TCP ports, and interactive FTP, SMTP and SSH traps that record what the attacker tries without executing anything). Any IP that touches them is logged, classified and analyzed in real time. There are no false positives: if something touches the decoy, it is an attacker. No exceptions.
The real-time dashboard shows every event with geolocation, attack type and threat score, plus a world attack map and a behavioural score per IP that tells the curious apart from the persistent. Captured IPs are investigated straight from Gjallarhorn against 20+ threat intelligence sources, from decoy to full investigation in seconds without switching tools.
The current version emails an alert when something crosses the threshold, publishes a feed of IPs to block for the firewall to consume on its own, and supports an allowlist so your own traffic does not pollute the record.
Trap TCP ports
Real-time dashboard
Threat score per IP
7 attack types classified
Interactive FTP/SMTP/SSH traps
World attack map
Email alerts · block feed
Gjallarhorn integration
When someone says they implement ISO 27001, ask if they have a system to manage it.
When they offer a SOC, ask what platform they operate it with.
Most don’t have an answer. AllSafe does.
Built in production
Not demos or prototypes. Systems we operate with real clients, in critical environments, where mistakes have real consequences.
Improved with every project
Each implementation generates feedback that becomes improvements. Organizations that choose us today benefit from everything we learned before.
No third-party dependency
We don’t depend on an external vendor to update their platform or change their licensing model. We control the roadmap and evolution of our tools.
Backed by the team that built them
When we implement any of our platforms, we do it with the same team that built them. No gap between who built it and who supports it.
Want to see the platforms in action?
We show you Gjallarhorn and Skuld GRC in production with real data. No generic demos, no PowerPoints, the system as we actually use it.