AI Blueprint BuilderNo query writing required

You ask“Show me every employee with admin access in AWS who hasn’t completed security awareness training in the last 12 months.”

Compyl writes · blueprint.sqlSELECT u.full_name, iam.role, t.last_completed FROM identities u JOIN aws_iam_access iam ON iam.user_id = u.id LEFT JOIN training_records t ON t.user_id = u.id AND t.course = 'Security Awareness' WHERE iam.privilege_level = 'admin' AND (t.last_completed IS NULL OR t.last_completed < NOW() - INTERVAL '12 months');

Approve & activateEdit

Source: AWS IAM + training recordsTwo systems, correlated automatically · maps to CC6.1, A.6.3 · weekly

AI-built

No SQL. No data team. No tickets. You just approve.1,499+ more ready

Solution · Evidence Studio

Automated evidence collection. Just describe it.

Name: Compyl Evidence Studio
Brand: Compyl
Availability: InStock

Ask for the evidence you need in plain English. Compyl’s automated evidence collection builds the blueprint that collects it. 1,500+ ready out of the box; for everything else, no SQL, no data team, no tickets. You just approve.

Last reviewed September 2026 by the Compyl GRC team

Request a demo See how it works →

1,500+ blueprints125+ integrationsYou approve, AI builds

The problem

Evidence used to mean screenshots, spreadsheets, and someone who can write queries

Automating a control meant knowing the query language, each integration’s API, and the framework mapping, so collection bottlenecked on a handful of experts, and everything else stayed manual and stale.

Screenshots that expire

Static screenshots and CSV exports are stale the moment they’re taken, and prove nothing about your posture today.

Query-writing is specialist work

Turning a control into an automated check used to require engineers who know each system’s query syntax, a bottleneck on every new blueprint.

Coverage stalls

When only a few people can build automations, most controls stay manual and audit prep turns into a scramble every cycle.

How it works

From a plain-language request to live, approved evidence

Describe what you need, or start from 1,500+ prebuilt blueprints. Compyl AI writes the logic, you approve, and it runs on schedule.

Describe it

Type the evidence you need in plain language.

AI builds the blueprint

Compyl writes the query, conditions & mappings.

You approve

Review and activate; nothing runs until you say so.

It runs on schedule

Collects live evidence from your systems automatically.

Prove & monitor

Live, auditable proof mapped to every framework.

Out of the box

1,500+ prebuilt blueprints, value on day one

You don’t start from a blank page. Evidence Studio ships with 1,500+ blueprints mapped to SOC 2, ISO 27001, NIST, PCI DSS, HIPAA and more, across the systems you already run. Turn them on at onboarding and you’re collecting live, audit-ready evidence the same day.

1,500+ blueprints mapped to leading frameworks
Cover AWS, Azure, GCP, Okta, GitHub, CrowdStrike & 125+ integrations
Each runs on your schedule and links to risks, vendors & policies
A complete, traceable audit trail from day one

Blueprint library1,500+ prebuilt · 125+ integrations

AllAWSOktaGitHubCrowdStrike+120

MFA enforced for every Okta adminSOC 2 CC6.1 · ISO A.5.17 · NIST PR.AA-03 · daily

Active

S3 buckets encrypted at restSOC 2 CC6.7 · PCI 3.5 · HIPAA §164.312 · daily

Active

Branch protection on production reposSOC 2 CC8.1 · ISO A.8.32 · weekly

Active

EDR installed on every endpointISO A.8.7 · NIST PR.PS-05 · daily

Turn on

Turned on at onboarding · collecting the same day1,212 active

AI-native blueprint builder

Need something custom? Just describe it.

When you need evidence no template covers, you don’t open a query editor, you describe it in plain English. Compyl’s AI-native builder interprets your request, writes the query logic, maps it to the right controls and frameworks, and sets a schedule. The program is the expert; you review and approve.

Build any blueprint in plain language, no query syntax
AI writes the logic, conditions & framework mappings
You approve every blueprint before it runs
Turn a one-off audit ask into a reusable, scheduled automation

New blueprintCompyl AI · generated

Your requestVerify storage is encrypted at rest across Azure.

SourceAzure · Storage accounts

Query logicencryption.services.blob.enabled

Pass conditionAll accounts = true

FrameworksSOC 2 · ISO 27001 · PCI

ScheduleDaily · 02:00 UTC

On failureRaise task to Cloud team

Compyl AI wrote this blueprint. You approve it.Nothing runs until you say so

Approve & activate

Agentic AI, end to end

You describe and approve. Compyl does the engineering.

Evidence Studio puts the expertise in the platform. You stay in the decision seat, approving each blueprint, while Compyl AI writes the queries, runs collection, and keeps the proof current.

Describe: say it in plain language, no query syntax, no API knowledge
Build: Compyl assembles the query, pass conditions, and framework mappings
Approve: nothing runs until you approve, the human stays in control
Prove: it collects live evidence on schedule and maps it to every framework it satisfies

Agentic loopDescribe → build → approve → prove

DescribePlain language

BuildAI wrote the logic

ApproveYour decision

ProveRuns on schedule

Confirm branch protection on production repos in GitHubQuery, pass condition & mappings assembled in 6s

Ready to approve

Show endpoint protection covers every device in CrowdStrikeApproved by J. Alvarez · first run tonight

Scheduled

The platform is the expert. You stay in the decision seat.Humans in the loop

Live, auditable proof

Evidence that’s always current, not a screenshot from last quarter

Blueprints run on your schedule and pull straight from your live systems, so every control is tested continuously and your evidence reflects today’s posture. Each result links to the risks, vendors, policies and frameworks it supports, a complete, traceable audit trail.

Live data from your systems replaces screenshots & CSVs
Continuous testing, daily, weekly, or on your control’s cadence
Every result mapped to the frameworks it satisfies
A failed check raises a task automatically, nothing slips

Live evidenceLast run 02:00 UTC · today

MFA enforced for every Okta admin41 of 41 admins · SOC 2 CC6.1 · evidence attached

Pass

S3 buckets encrypted at rest212 of 212 buckets · PCI 3.5 · evidence attached

Pass

Branch protection on production repos3 of 58 repos unprotected · task raised to repo owners

Fail · task open

Admins without security training2 flagged · linked to risk R-031 · owner: People Ops

Fail · task open

Every result linked to its risks, vendors, policies & frameworksTraceable trail

Why Compyl is different

Built by CISOs, automation that augments your team, not another data silo

Evidence Studio is the automation core of the GRC platform that runs your whole program, so evidence flows straight into controls, risk, and audit. It shows up in five ways.

GRC that adapts to complexity

No-code configuration of dashboards, workflows, fields, and reports for every team, without an engineering ticket.

End-to-end, built to flex and scale

Governance, risk, compliance, and third-party risk as one connected source of truth, with no ceiling as your program matures.

No black box, all your data

125+ proprietary, in-house integrations ingest your full dataset and surface risks single-system checks miss.

Agentic AI that augments your team

The AI-native builder and 1,500+ blueprints write the queries and assemble evidence, with humans in the loop on every decision that matters.

Quantified risk in financial terms

FAIR models and Monte Carlo simulations put risk in dollars, so the board decides on business impact, not heat-map colors. New in 26.2.

Connected across your program

Evidence that powers your whole GRC platform

Evidence Studio feeds the rest of Compyl, so live proof becomes compliance status, risks, and questionnaire answers.

Comply

Compliance

Blueprints validate the controls behind every framework, so compliance status reflects live evidence, not a snapshot.

Explore Compliance →

Risk

Risk Management

A failed check becomes a risk in your register, scored and quantified alongside every other risk.

Explore Risk Management →

Agentic

Questionnaire Assist

Answer security questionnaires with citations backed by your live evidence, not best guesses.

Explore Questionnaire Assist →

Agentic

Compyl AI

The blueprint builder is one of many places AI does the busywork and you approve what matters.

Explore Compyl AI →

Framework coverage

One control library, mapped to every framework it satisfies

Compyl cross-maps controls so a single blueprint can satisfy requirements across multiple frameworks at once. Explore any framework below.

SOC 2 ISO 27001 ISO 42001 HIPAA GDPR PCI DSS NIST CSF NIST SP 800-53 MAS CCPA NIS2 70+ frameworks

SOC 2 PCI DSS NIST SP 800-53 Healthcare

Recognized by users on G2 · Rated a leader by the teams who use it G2 Momentum Leader, Summer 2026

1,500+

Prebuilt blueprints, live the day you onboard

Plain English

Build any blueprint, no query syntax

Live

Evidence collected continuously, not screenshots

You approve

AI builds; humans decide what runs

What is Compyl Evidence Studio?

Compyl Evidence Studio is the evidence-automation engine of the Compyl GRC platform. It collects live, auditable evidence directly from your connected systems using Evidence Blueprints, reusable, logic-based automations that test each control on a schedule. Evidence Studio ships with 1,500+ prebuilt blueprints mapped to leading frameworks, so you get value the moment you onboard. And with its AI-native blueprint builder, you describe the evidence you need in plain language and Compyl’s AI writes the query, maps the frameworks, and sets the schedule, then hands it to you to approve. You never write a query; the platform is the expert and you stay in control.

Audit prep

Does automated evidence collection reduce audit preparation time?

Audit preparation is mostly evidence gathering: screenshots, exports and answers to auditor requests. Automating collection changes what an audit week looks like.

Task	By hand	With Evidence Studio
Recurring evidence	Screenshot the same screens every quarter	Blueprints pull the record from the system on a schedule
New evidence requests	Ask engineering for a query	Describe what you need in plain language; Compyl writes the blueprint
Auditor requests	Email attachments	Auditor reads approved evidence in the platform
Cross-framework reuse	Collect again for each framework	One piece of evidence satisfies every framework it maps to
Exceptions	Found during fieldwork	Failed checks flagged when they happen

FAQ

Evidence Studio questions, answered

What is Compyl Evidence Studio?

Compyl Evidence Studio is the evidence-automation engine of the Compyl GRC platform. It collects live, auditable evidence directly from your connected systems using Evidence Blueprints, reusable, logic-based automations that test each control on a schedule. It ships with 1,500+ prebuilt blueprints mapped to leading frameworks, and an AI-native builder lets you describe the evidence you need in plain language while Compyl AI writes the query, maps the frameworks, and sets the schedule for you to approve.

What is an Evidence Blueprint?

A blueprint is a reusable, logic-based automation that defines how a control is tested, the source system, the query logic, the pass/fail condition, and the frameworks it maps to. Each blueprint runs on a schedule and produces live, auditable evidence with a traceable trail.

How does the AI-native blueprint builder work?

Describe the evidence you need in plain language. Compyl AI interprets the request, writes the query logic, maps it to the right controls and frameworks, and sets a schedule, then presents the blueprint for you to approve. You never write a query; the platform is the expert and you review and activate.

How many blueprints come out of the box?

Evidence Studio ships with 1,500+ prebuilt blueprints mapped to frameworks like SOC 2, ISO 27001, NIST CSF, PCI DSS, HIPAA and GDPR, across 125+ integrations, so you start collecting live evidence the day you onboard.

Do I need to know how to write queries?

No. The platform is the expert. Use a prebuilt blueprint, or describe what you need and let the AI builder write it. Your job is to review and approve. Compyl handles the query logic and framework mapping.

What systems can blueprints collect evidence from?

Evidence Studio connects to 125+ integrations including AWS, Azure, GCP, Okta, Auth0, GitHub, CrowdStrike, Salesforce, HubSpot and Workday, pulling live evidence directly from the systems you already run.

What evidence can’t be automated?

Evidence that lives outside connected systems, such as signed attestations or physical controls, still needs a person. For system evidence, blueprints query the source on a schedule, and where no prebuilt blueprint fits you describe the evidence in plain language and approve the query Compyl writes.

How often is automated evidence refreshed?

Each blueprint runs on its own schedule and is mapped to its controls, so evidence stays current rather than being a screenshot from last quarter. Stale or incomplete evidence is flagged by Evidence Health.

GRC your way

Describe your first blueprint, let Compyl’s AI build it

See Evidence Studio live: 1,500+ blueprints out of the box, plus an AI-native builder that turns plain language into approved, scheduled evidence.

Request a demo Take the platform tour →