GATEKEEPER AI AGENTS
Security Certification Check Agent.
A security certificate only counts if it is current, properly issued and held by the right company.
The Security Certification Check Agent checks every certificate as it arrives, so your team follows up only on the ones that fall short.
See it in action.
HOW IT WORKS
How the Security Certification Check Agent works.
Certificates submitted.
A vendor uploads one or more certificates, such as ISO 27001, ISO 22301, Cyber Essentials or a PCI DSS Attestation of Compliance, to the card in Gatekeeper’s workflow.
Standard identified.
The agent records each standard and version, and flags a different certificate from the one your form asks for, or an ISO/IEC 27001:2013 certificate.
Holder and scope checked.
The certified organisation is compared with the vendor on the card, flagging a different legal entity, parent or affiliate, or a scope too narrow to cover the service you are buying.
Dates checked.
Issue and expiry dates are checked against today’s date, flagging certificates that have expired or will expire within 60 days. Where the card holds a different expiry date, the agent quotes both and uses the earlier.
Issuer checked.
The agent records the certification body and any accreditation body, such as UKAS or ANAB, and flags marketing badges, self-issued letters and certificates still in progress.
Structured output.
Findings are summarised with a verdict, a table of all certificates reviewed, and a list of issues to raise with the vendor.
FAQ
Frequently asked questions.
What does the Security Certification Check Agent review?
The Security Certification Check Agent reviews the security and management system certificates a vendor uploads, checking that each one is a recognised standard, held by the right company and currently valid.
It covers:
-
ISO/IEC 27001, ISO 22301, ISO/IEC 27701, ISO 9001 and ISO 14001 certificates.
-
Cyber Essentials and Cyber Essentials Plus
-
PCI DSS Attestations of Compliance, including whether a QSA company signed or the vendor self-assessed.
-
The certificate holder and scope statement.
-
Issue and expiry dates The certification and accreditation bodies.
Which documents does it treat as invalid?
The Security Certification Check Agent marks a document as not a valid certificate when it has no identifiable issuer, is a marketing badge, is a letter from the vendor itself or describes a certificate still in progress. Any of these returns a verdict of Needs attention, so your team can ask the vendor for the real certificate.
How does it handle certificate expiry?
The Security Certification Check Agent checks every expiry date against today’s date. A certificate past its expiry date is marked Expired, and one expiring within 60 days is marked Expiring. Cyber Essentials certificates are treated as valid for 12 months from issue. Where the card records a different expiry date, the agent quotes both and works from the earlier one.
Does it check the certificate covers the service we are buying?
Yes, where the card describes the service. The Security Certification Check Agent reads the scope statement on each certificate and flags a scope limited to one site or one product, or one that leaves out the service being bought. Without a service description, it reports the scope as written.
What happens with an ISO 27001:2013 certificate?
The Security Certification Check Agent flags any ISO/IEC 27001:2013 certificate, because certificates issued against the 2013 version stopped being valid on 31 October 2025.
Does it replace the security team’s review?
No. The Security Certification Check Agent handles the first-pass review and structures the findings. Your security team reviews the output and decides whether the vendor’s certification meets your requirements as part of your vendor risk and compliance process.
What are the configuration options?
Tailor the Agent to your organisation’s certification requirements rather than a generic checklist, including:
-
Required standards and versions.
-
Expiry warning period.
-
Accepted certification and accreditation bodies.
-
Scope requirements.
-
Review outputs.
How does Agent automation compare with a manual process?
Without Agent automation, teams open each certificate and check the holder, scope, dates and issuer by hand.
-
Certificates are checked one at a time against the vendor record.
-
Expiry dates and superseded versions are easy to miss.
-
Badges and self-issued letters can pass as certificates.
With Agent automation, certificates are checked automatically as soon as they reach the card.
-
Holder, scope and dates are checked immediately.
-
Invalid documents are flagged before review.
-
Teams follow up only on certificates that need attention.
With Gatekeeper’s Agentic AI, routine tasks are completed up to 95% faster.
Is there an audit trail?
Every Agent action is recorded in Gatekeeper with a timestamp, including the criteria applied, decision made, supporting evidence and reasoning where applicable.
This creates a searchable record of how each outcome was reached, supporting compliance verification, internal review and audit requirements.
How is my data kept secure and compliant?
Your data stays within Gatekeeper while the Agent performs its work. Actions, decisions and supporting evidence are logged, creating a clear audit trail.
The Agent operates within the permissions, playbooks and authority controls you configure.
Data handling follows Gatekeeper’s enterprise security standards, including SOC 2 Type II compliance and GDPR requirements.
one unified record
Every capability, unified.
One system of truth.
Customer and vendor contracts, obligations, and renewals in one record.
See spend against contract.
Contract value sits next to what is actually being spent.
No single point of failure.
Contract knowledge lives in the platform, so nothing is lost when someone changes role or leaves.
Draft from approved templates.
Every agreement starts from language Legal already trusts.
Keep control of the clause library.
Guard-railed templates keep off-policy wording from going out.
Nothing renews unnoticed.
Every renewal date tracked, with owners and reminders set automatically.
Expert insight & opinion
Related AI agents.
Gatekeeper's agents work as a single, connected team, handing off to one another across the lifecycle rather than running in isolation like bolted-on point tools.
