Exsol Solfield LTD began in 2015 as a digital products innovator. In 2020 the company evolved into a cybersecurity digital product company through its Software as a Service platform, and everything we have built since addresses one question: how does an organisation know its defences truly work?
The first answer was ENLISEC, a security learning management and phishing simulation platform. It now supports threat awareness and workforce readiness across more than 25 corporate enterprises, more than 30 SMEs, and federal and state government ministries, departments and agencies.
Security assurance is often stitched together from disconnected products. Awareness and training sit in one place, supplier questionnaires in another, control evidence in a third, and none of them align. The gaps between them are where risk hides.
So VASSURE and CONFICIENT were built as components of one system rather than separate purchases. VASSURE handles third‑party risk: vendor onboarding, risk assessment, evidence collection and remediation tracking. CONFICIENT handles control assurance: control libraries, adequacy and effectiveness testing, attestation workflows and audit readiness. Together with ENLISEC they cover people, suppliers and controls, which is most of what an auditor will focus on.
Why we automate it?
Assurance activities are still largely manual, periodic, and outdated before they are reviewed. Automation shifts the entire model: vulnerabilities are tracked in real time, emerging risks are identified before they escalate, regulatory alignment is maintained continuously, and leadership gains live visibility across the digital estate instead of a once‑a‑year snapshot.
That is the difference between a compliance exercise and genuine cyber resilience.
Standards, not our own scoring
Our platforms align with recognised global frameworks including: NCC Cyber Resilience Framework for the Nigeria Communications Sector (CRF‑NCS), ISO 27001, ISO 42001, ISO 22301, NDPA Compliance, PCI-DSS, NIST CSF, DORA, NDPA, GDPR, Cyber Essentials, OWASP MASVS and CSA CAIQ. We avoid proprietary scoring because results that only exist inside a product cannot be used by an auditor, a regulator or a customer.
How we choose what to build?
We choose what to build by focusing on the real, repetitive tasks that make up security assurance: educating users, testing phishing readiness, assessing suppliers, validating controls, preparing evidence and reporting posture to stakeholders. We build only where the work is frequent, manual and high‑impact, and each product turns one of those tasks into a repeatable, reliable process.
