Projects and managed programs

Explore VioletX service scopes and choose a starting point for your engagement.

• Compliance readiness & implementation: Build or strengthen SOC 2, ISO 27001, NIST CSF, and other framework programs through scoped controls, gap identification, remediation, and evidence.
• Audit preparation & support: Organize evidence, track control testing and findings, coordinate with auditors, and produce readiness reports.
• ISO 9001 quality-system build & audit readiness: Build a practical quality management system, document processes and ownership, organize records, and prepare evidence for an independent certification audit.
• Vendor & third-party risk assessments: Evaluate vendors, manage assessment programs, track approval decisions, and follow up on remediation.
• M&A cybersecurity due diligence: Run buy-side or sell-side cybersecurity assessments, document security risks, track remediation, and organize a due-diligence package.
• NYDFS cybersecurity examination support: Coordinate reviews, test procedures, evidence, findings, and resolution for Part 500 engagements. Scope and applicability are confirmed with the client.
• Risk assessments & security roadmaps: Maintain risk registers, prioritize remediation, and organize practical security improvement initiatives.
• Policy development & AI governance: Create and revise policies, map them to controls, and organize approved AI tools and their reviews.
• Security & compliance advisory: Coordinate recurring reviews, compliance checklists, reporting, and remediation follow-through alongside your internal team.
• Web application testing: Test agreed websites and applications, including login, permissions, sessions, and data exposure.
• API testing: Test agreed API endpoints, authentication, authorization, input handling, and access to data.
• Mobile application testing: Assess iOS and Android applications, local storage, communications, and backend interactions.
• Internal infrastructure testing: Assess internal networks and systems for agreed privilege-escalation and lateral-movement scenarios.
• Cloud security testing: Assess agreed cloud environments, permissions, configurations, and exposed resources.
• AI / ML security testing: Assess agreed AI-powered applications for prompt injection, sensitive-data leakage, and unsafe tool access.
• OT / IoT security testing: Assess operational technology and connected devices within explicitly agreed safety and availability requirements.
• Physical security testing: Assess whether an authorized tester can bypass agreed physical access controls or reach restricted areas.
• Social engineering testing: Run authorized impersonation, phishing, call, or message scenarios within agreed boundaries and configured channels.
• Employee awareness & human-risk programs: Build training, onboarding, policy acknowledgments, phishing simulations, targeted coaching, and improvement reporting into one practical program.
• vCISO / security team as a service: Provide experienced leadership and an agreed security delivery team to manage priorities, ownership, reporting, and program follow-through.
• Managed security & compliance operations: Keep evidence, reviews, compliance checklists, access reviews, and remediation moving through an agreed recurring program.
• Managed TPRM: Operate vendor intake, assessments, approvals, exceptions, and remediation follow-up over time.
• Managed penetration & product testing: Coordinate recurring scoped testing, assigned security professionals, findings, remediation tracking, and agreed retesting.
• Managed human risk: Run recurring training, simulations, targeted coaching, policy acknowledgments, and risk-trend reporting.
• Ongoing security questionnaire support: Coordinate customer security questionnaires, approved answers, evidence requests, internal reviews, and response follow-through.