A fair question, and one worth answering precisely rather than defensively.
A capable language model will read a firewall configuration and describe, quite accurately, much of what is wrong with it. That is genuinely useful. It is also not what an audit, a regulator, or an incident review requires.
Group information security policy at most regulated organisations prohibits network-device configuration data from being sent to any third party, and increasingly names AI and large-language-model services directly. Before the question of quality arises, there is the question of whether the configuration may be uploaded at all. Frequently it may not.
Our analysis runs where the configuration already lives. That is the first reason, and for many organisations it ends the discussion.
Ask a model the same question twice and you may receive two different answers. Ask it next quarter, after the model has been updated, and you will receive a third. An auditor asking how a conclusion was reached cannot be told that a model produced it and the reasoning is unavailable.
Every finding we report comes from a specific, numbered control with a unit test behind it. The same configuration produces the same findings today, next quarter, and in front of a regulator.
What a bank, an NBFC or a listed company ultimately purchases is not analysis. It is a report that a qualified person has signed, backed by professional indemnity cover, from an organisation that can be called upon to explain it. “An AI assistant reviewed our firewall” is not an answer to a regulator, however good the analysis was.
We are not against the technology; we are precise about where it belongs. A model never decides whether a finding exists. Detection is performed by deterministic controls, because a fabricated finding, or a quietly missed one, in a report carrying our name is not a recoverable error.
parsers + rule engine → findings (deterministic, tested)
↓
language model → explanation, prioritisation, report prose
Models assist with narrative and remediation guidance, downstream of findings that were established without them.
| Requirement | SecureXcel | General-purpose AI |
|---|---|---|
| Same configuration, same answer, every time | Required. An auditor must be able to reproduce the result. | No. Output varies between runs and between model versions. |
| Traceable to a written control | Every finding maps to a check with a test behind it. | No. The reasoning is not inspectable or repeatable. |
| Configuration stays on your machine | Analysis is local. Nothing is transmitted. | No. The configuration is uploaded to a third party. |
| A named signatory, accountable for the conclusion | Yes, on countersigned reports. | No. There is nobody to hold responsible. |
| Professional indemnity cover behind the finding | Yes. | No. |
| Will not invent a finding, or quietly miss one | Detection is deterministic. A missed case is a failing test. | No guarantee either way. |
Download the tool and run it against a configuration you already understand. Compare what it reports with what you know to be true. It costs nothing and requires no conversation with us.