Questions
What people ask before they start
Something else on your mind? Ask us or write to [email protected].
Do we need a security team to use this?
No. Each item is written in everyday language and says what to do. Tick it when it is done, or mark it partly done and come back. VAPT's findings come with the same plain-language treatment, plus a prompt for your AI coding tool.
Which frameworks and laws are included?
19 frameworks, including ISO/IEC 27001, SOC 2, CIS Controls, NIST CSF, HIPAA, PCI DSS, CMMC, Essential Eight, India's DPDP Act, and the AI frameworks ISO/IEC 42001 and NIST AI RMF, plus 93 laws and regulations such as GDPR, GLBA and U.S. state data protection statutes.
What does VAPT actually scan?
Your pasted code (SQLi, secrets, XSS, weak crypto, AI/LLM-specific risks like prompt injection, and more) and a website's headers, cookies, TLS and exposed paths. Findings map to OWASP Top 10, CWE, and — on request — a PCI DSS or HIPAA-perspective report.
Are GRC and VAPT data really kept apart?
Yes. They are two separate products with no shared data. VAPT keeps its own risk register and evidence vault; GRC's shows only what GRC's own users entered. You can buy either one on its own, or both at a lower combined price.
How is progress calculated?
Done counts as one, partly done counts as half, and not started counts as zero. Items marked not applicable are left out, so the number reflects what is relevant to you.
Can suppliers answer an assessment without an account?
Yes. You send a link. The person opens it, answers, and the response appears in your account. They see that one assessment only.
Is our data kept separate from other companies?
Yes. Each company has its own private workspace, and people only see what their role allows.
Can we see it before we buy?
Yes. Ask for a guided walkthrough and our team will show you around with your own company in mind. Write to [email protected] and we will show you around.
Do you cover AI and LLM security?
Yes. GRC includes ISO/IEC 42001 and NIST AI RMF checklists plus AI governance and AI risk policies and assessments. VAPT checks code for LLM risks such as prompt injection and unsafe handling of model output, and its library covers the OWASP Top 10 for LLM Applications.