Trustivum:
Find out whether your security actually holds.
Penetration testing and security validation, delivered four ways: a one-time engagement, a scheduled program that keeps testing throughout the year, or an appliance inside your network for internal scanning at two levels. Every finding is verified by an analyst, mapped to your controls, given a deadline, tracked to a fix and retested.
Built for small regulated teams. Healthcare practices, their vendors, and any growing company whose auditor or customer just asked for a penetration test.
- ✓Automated detectionscanner
- ✓Analyst verification and severitysec@
- ●Remediation ticket opened in ComplianceDeskauto
- Retest and closescanner
The point is not to pass an audit. The point is to be secure.
A policy says what should be true. A test shows what is true. ComplianceVector checks your systems the way an attacker would, then makes sure what it finds actually gets fixed: a verified finding, a severity, a deadline, a ticket and a retest. Do that on a schedule and the report your auditor wants is simply the record of a business that keeps itself secure.
An annual test sees one day. Attackers get the other 364.
Most small companies buy a penetration test because someone asked for one. It arrives as a PDF, gets filed, and nobody looks at the inside of the network at all. The findings are real, but nothing makes sure they get fixed.
One day of coverage
The test reflects the day it ran. A new server, a new vendor or a missed patch the following week is invisible until next year.
The inside is never tested
External tests stop at the firewall. Shared drives, printers, old servers and the workstation that still runs an unsupported system are where real incidents start.
Findings that die in a PDF
A report lists twelve issues. Six months later nobody can say which were fixed, who fixed them, or whether anyone checked. The next audit asks exactly that.
Test, verify, fix, retest. The evidence shows up where the auditor looks.
Trustivum:Compliance tells you which controls need proof. ComplianceVector produces the proof by testing them. Connect the two and every verified finding, fix and retest lands on the right control automatically. Add Trustivum:ComplianceDesk and each finding becomes a remediation ticket with a deadline and an owner.
Something is checked
An external engagement runs. A scheduled scan fires. An appliance sweeps the inside of the network. A retest confirms a fix.
A verified finding
An analyst confirms it is real, sets severity and a fix deadline, and maps it to the controls it affects. Repeats are de-duplicated. Fixes are retested.
- Analyst-verified, not just scanner output
- Mapped to SOC 2, HIPAA, ISO 27001
- Branded report with an integrity hash
Evidence and a ticket
The report attaches to the matching controls in your compliance program. Each finding opens a remediation ticket in ComplianceDesk, so the fix is tracked, approved and closed on time.
One test, a year of tests, or an appliance on your network.
Start with what was asked of you. Most teams begin with the one-time engagement, then move to the scheduled program once they remember the year has 364 more days in it. The two appliances add the inside of the network at the depth you need.
A single external penetration test with a report built for the evidence package. The thing your auditor or customer circled.
- Up to 3 external assets: web apps, APIs, domains
- Automated testing plus manual analyst verification
- Branded PDF report, control-mapped, integrity-hashed
- One free retest within 30 days
- Report in 7 business days
External testing that repeats at the interval you choose, so a change in March does not wait until next January to be found. Most teams pick quarterly.
- Baseline engagement, then scans at your interval
- Quarterly recommended; any interval you choose, including on-demand runs
- Findings portal with new, changed and resolved
- Retests on request, de-duplicated findings
- Quarterly trend report for board and audit
A compact appliance you plug into your network. It runs scheduled internal scans and streams findings to your portal. Nothing to install, nothing to open on the firewall.
- Ships ready to run; outbound encrypted connection only
- Device discovery and inventory changes
- Known-vulnerability and exposed-share checks
- Weekly or monthly scan windows you control
- Sized for small offices and clinics
A higher-capacity appliance with a full authenticated scanner on board, for the credentialed, insider-view assessment larger networks and stricter audits require.
- Everything Sentry does
- Tens of thousands of checks, run on-site
- Credentialed scans of your servers and workstations
- Authenticated web-application testing
- Your data stays inside; only finding details leave
| What you get | Engagement | Scheduled program | Sentry | Sentry Pro |
|---|---|---|---|---|
| External testing | Once | At your interval | Add program | Add program |
| Internal network | — | — | Scheduled | Scheduled, credentialed |
| Analyst verification | Yes | Yes | Yes | Yes |
| Retest | 1 free, 30 days | On request | Next scan | Next scan |
| Report | PDF + portal | Portal + quarterly | Portal + quarterly | |
| Term | One-time | Ongoing, cancel any time | 12 months, returned on cancel | 12 months, returned on cancel |
The appliances are provided for the length of the subscription and returned when it ends. Both can be combined with the scheduled program for outside-and-inside coverage all year.
Built so the finding gets fixed and the record holds up.
- Analyst-verified findings. Automated testing finds candidates. A person confirms each one is real and exploitable before it reaches your report, so you are not chasing false alarms.
- Severity with a clock. Every finding carries a severity and a fix window. Critical and high issues are flagged the day they are verified, not in a report weeks later.
- Control mapping on every item. SOC 2, HIPAA and ISO 27001 references ship with each finding, so an auditor can sample by control instead of reading the whole report.
- Reports that carry their own proof. Branded PDF with a confidentiality stamp and an integrity hash. Anyone with the hash can confirm the report has not been altered.
- Scope and authorization, on record. Targets, excluded hosts, scan windows and a signed authorization are captured before anything runs. Nothing is tested that you did not approve.
- De-duplicated over time. The same issue seen again is added to the open finding, not filed as a new one. You see new, changed and resolved, not a pile.
- Appliances with two locks. Each appliance must be on the private mesh and present its own credential before it accepts a job. No inbound firewall rules, ever.
- Your data stays home. Sentry Pro runs its full scanner inside your network. Only finding details leave; customer and patient data do not.
- Findings become tickets. Connect Trustivum:ComplianceDesk and each verified finding opens a vulnerability-remediation ticket with an owner, approvals and a deadline.
- Yours to export. Reports, findings history and retest results for any date range, as a single archive with a manifest.
A report your auditor accepts, and your team can act on.
Auditors ask three things about a penetration test: was the scope right, were the findings real, and were they fixed. ComplianceVector answers all three in the report and in a read-only link that shows the retest.
- Scope, methodology, authorization and dates stated up front
- Every finding with severity, evidence, control references and a fix status
- Retest results attached, so "remediated" is demonstrated, not claimed
- An integrity hash on the report that the auditor can check themselves
One compliance program. Companion tools that fit into daily work.
Trustivum:Compliance is the program of record. The companions are standalone tools that make your team more secure in daily work. They happen to put evidence into the program automatically.
Governance, risk and compliance. Guided SOC 2 and HIPAA readiness, evidence vault, policies, auditor portal.
Core productService desk and evidence collection. Security work as tracked workflows; every closed ticket is control-mapped evidence.
Add-on · standaloneAsset management. The auditable record of every device, system and data store, and how your sensitive data moves.
Add-on · standalonePenetration testing and security validation. Verified findings that flow straight into ComplianceDesk.
Add-on · standaloneStraight answers.
Do I need Trustivum:Compliance to use ComplianceVector?
No. ComplianceVector works fully on its own. Connecting it to Trustivum:Compliance adds automatic evidence delivery to your controls, and connecting it to Trustivum:ComplianceDesk turns findings into tracked remediation tickets. Neither becomes a dependency.
Which of the four models should we start with?
If an auditor or customer has asked for a penetration test, start with the one-time engagement. If you want coverage for the rest of the year, the scheduled program repeats external testing at the interval you choose. We recommend quarterly, and on-demand runs are always available. If the inside of your network has never been tested, add Sentry. If you need credentialed, insider-view assessment or have a larger network, add Sentry Pro.
Do the appliances need anything installed or opened on our firewall?
No. Both appliances ship ready to run. Plug in power and network, and they make an outbound encrypted connection only. There are no inbound firewall rules, no agents on your machines and no software for your team to maintain. When the subscription ends, the appliance goes back in its box with a prepaid label.
Does our data leave the network?
Sentry sends finding details to your portal. Sentry Pro runs its full scanner inside your network, so even credentialed scan results are processed on-site and only finding details leave. Customer and patient data do not.
Is this just an automated scan?
No. Automated tools find candidates. An analyst verifies each finding before it reaches your report, confirms it is real, sets severity and writes the fix guidance. You get fewer items, and every one of them matters.
Does using ComplianceVector mean we will pass our audit?
No tool can promise an audit outcome, and passing is not the goal. The goal is to be secure. A test shows whether your controls actually hold, the fixes get tracked and retested, and the report is the record of that work. A team that runs this way has what auditors ask for because they are secure, not because they prepared for the audit.
Get the test your auditor is asking for. Then keep testing.
Tell us your assets and we will scope a fixed-price engagement, or talk through scheduled testing and the appliances. Report in seven business days, free retest included.