Violet Security
Five modules. One case file.
All five share the asset inventory, the document repository and the activity log. They switch on separately, but they never contradict each other: when a finding hits a control, both sides know.
From tender to close, in eight phases
Every audit runs the same cycle and leaves its record behind. The client follows progress from their own portal.
- More than 100 scanner parsers with deduplication
- Fix First: priority by real exploitability (EPSS)
- Remediation with SLAs, verified by retest
Controls, risks and policies in one place
Thirteen frameworks out of the box, statement of applicability and attestation campaigns. Every control keeps its evidence and who approved it.
- Control-to-control mapping assisted by AI
- Risk register measured against a stated appetite
- Exceptions approved, with an expiry date
Your cloud configuration, checked every day
Misconfigurations across AWS, Azure and GCP are found continuously and enter as findings, with their resource, their owner and their date.
- Ports left open, public storage and encryption switched off
- Continuous checks against CIS, ISO 27001 and PCI DSS
- Posture measured over resources actually checked
From triage to post-incident, fully on the record
Every status change is timestamped and attributed, so the incident can be reconstructed when a regulator asks.
- Command centre and playbooks built in
- Use cases and MITRE ATT&CK coverage
- Threat landscape and IOC feeds
What the supplier declares, checked against what you can see
Questionnaires, document review and analysis of the exposed surface. The score combines both sides.
- Violet Score 0–1000 per supplier
- External attack surface analysis
- Continuous monitoring and orderly offboarding
The shared foundation
What the five modules share
A standalone module forces you to reconcile inventories. Five modules on one foundation do not: the asset, the document and the log are the same objects, read from different disciplines.
-
One asset inventory
The server that shows up in a technical finding is the one carrying an ENS control and the one a supplier administers. One entry, three readings.
-
One evidence repository
Screenshots, exports, certificates and minutes live in one place, with a version, a date and an owner. They are referenced wherever needed without being duplicated.
-
One activity log
Every status change is timestamped and attributed. When a regulator asks, the file reconstructs itself.
-
Violet AI across all five
Drafting, mapping between frameworks, document review and remediation guidance. It proposes; approval stays human and stays on the record.
Client portal
One portal per client, segregated by module, with electronic signature, finding disputes and scope corrections. Natively multi-tenant and white-label for MSSPs.
- One portal per client, segregated by module
- Electronic signature built in
- Disputes and scope corrections
- White-label: your brand, your domain
The modules
Each discipline, with its own cycle
All five modules follow the same logic — an eight-phase cycle that leaves a verifiable artefact at every step — but each answers a different obligation.
-
Audit Lifecycle
From tender to close, in eight phases
Every audit runs the same cycle and leaves its record behind. The client follows progress from their own portal.
See the module- More than 100 scanner parsers with deduplication
- Fix First: priority by real exploitability (EPSS)
- Remediation with SLAs, verified by retest
-
GRC
Controls, risks and policies in one place
Thirteen frameworks out of the box, statement of applicability and attestation campaigns. Every control keeps its evidence and who approved it.
See the module- Control-to-control mapping assisted by AI
- Risk register measured against a stated appetite
- Exceptions approved, with an expiry date
-
CSPM
Your cloud configuration, checked every day
Misconfigurations across AWS, Azure and GCP are found continuously and enter as findings, with their resource, their owner and their date.
See the module- Ports left open, public storage and encryption switched off
- Continuous checks against CIS, ISO 27001 and PCI DSS
- Posture measured over resources actually checked
-
Incident Response
From triage to post-incident, fully on the record
Every status change is timestamped and attributed, so the incident can be reconstructed when a regulator asks.
See the module- Command centre and playbooks built in
- Use cases and MITRE ATT&CK coverage
- Threat landscape and IOC feeds
-
Third-Party Risk
What the supplier declares, checked against what you can see
Questionnaires, document review and analysis of the exposed surface. The score combines both sides.
See the module- Violet Score 0–1000 per supplier
- External attack surface analysis
- Continuous monitoring and orderly offboarding
Proof of concept
Try it on your own audits
We stand up an environment with your real scope, your findings and your frameworks. No cost, no card, no commitment to continue.
- Dedicated, isolated environment, ready in 48 hours
- We import your scanner results and your history
- Technical support for the whole trial