Virtum

Virtum Security

Findings that get fixed, not filed.

Finds what is exploitable in everything you run, gets it fixed, and proves it.

Become a design partner See all 101 features

Private development Design partners Q1 2027 · wider access Q2 2027 (targets)

Why it exists

Findings pile up. Fixes do not. Evidence goes missing.

Most security tools hand you findings and leave the fixing to someone else. Then the auditor asks for evidence nobody kept. Virtum Security ties every vulnerability to the real asset or code, ranks it by real-world exploitation, proposes the fix, has Deploy apply it after approval, re-checks it, and keeps the evidence for every framework you follow.

How it works

Find → Prioritise → Fix → Prove

  1. 01FindYour devices, code, clouds and identities, checked against live advisories.
  2. 02PrioritiseRanked by what attackers actually exploit, with owners and SLAs.
  3. 03FixA fix proposed from the finding, applied after approval.
  4. 04ProveRe-checked on the machine, with evidence mapped to your frameworks.

In practice

A critical CVE, closed with proof

  1. A new OpenSSL vulnerability is added to CISA's known-exploited list.

  2. Security finds it on nine of your servers and ranks it critical.

  3. A fix is proposed from the finding: a staged patch through Deploy.

  4. You approve it. The rollout runs ring by ring.

  5. Every server is rescanned. The finding closes as verified.

  6. The evidence is filed against ISO 27001 and Cyber Essentials.

Who it's for

Built for the people who run it.

  • Security leads

    Findings fixed, not filed.

  • Compliance owners

    Evidence for Cyber Essentials, ISO 27001, SOC 2 and more.

  • IT teams

    Prepare for audits without a dedicated security team.

How it connects

Connected to everything else.

Work passes between Virtum's services on its own. Nothing is retyped, and nothing falls between tools.

  • Security → Deploy · approved fixes

    Deploy

    Fixes run on real machines through Deploy, after approval.

  • Builder → Security · code to scan

    Builder

    Code and dependencies are scanned before release.

  • Security → Planner · failed fixes

    Planner

    Anything that did not hold becomes a tracked task.

  • Security → Docs · evidence

    Docs

    Evidence flows into monthly and board reports.

See it end to end →

What it does today

Everything in Security.

101 features across 11 areas. Search them, or open an area. The roadmap shows what comes next.

101 features
Exposure and attack paths See your risk the way an attacker would.7
  • Security overview with posture and next priorities
  • Exposure map of your connected estate
  • Attack paths from a public CVE to your infrastructure
  • Exposure score and critical counts
  • Asset inventory across clouds, on-premises, SaaS and repositories
  • Coverage gaps where protection evidence is missing
  • Estate-wide component search ("where do we run log4j?")
Vulnerabilities and threat intelligence Prioritised by real-world exploitation.8
  • Vulnerabilities with severity, CVSS, EPSS and priority
  • Affected components and fixed versions
  • Acknowledge, suppress, remediate or request a retest
  • Advisories from NVD, OSV, GitHub, CISA KEV and EPSS
  • Known-exploited vulnerabilities raised automatically
  • Patch availability from upstream
  • Threat indicators with confidence and TLP marking
  • Exports with your filters kept
Scanning Your scanners or ours, in one place.9
  • Scan history and results
  • Bring your own scanner with an upload token
  • Scanner results straight from CI/CD
  • Cloud storage misconfiguration checks
  • CIS-based Kubernetes checks
  • Infrastructure-as-code scanning
  • Dependency and licence checks on Builder projects
  • Domain discovery and DNS hygiene, including DNSSEC
  • Certificate inventory with expiry alerts
Findings Every finding owned until it is closed.8
  • Findings across vulnerabilities, configuration, identity, data, runtime and code
  • Triage with owner, status and notes
  • Full history and audit trail per finding
  • Bulk acknowledge and remediate
  • Accept risk, approve remediation, verify and close
  • Findings imported from third-party tools
  • AI triage summaries
  • Due dates updated as advisory data improves
Remediation and SLAs Fixed, verified and on time.8
  • Remediation plans
  • Patch a package, or every package, through the device agent
  • Security-only OS updates
  • Patch app dependencies in Builder projects
  • Dry runs before applying
  • SLA tracking with ages, due dates and breaches
  • Remediation metrics: time to fix and ageing
  • Patch campaigns with pilot, reboot and rollback decisions
Fix centre Microsoft 365 and AWS findings fixed from Virtum, with approval.8
  • Fixes for Microsoft 365 and AWS findings, each approved first
  • Triage Defender alerts and confirm or dismiss risky users
  • Revoke risky app consents and high-privilege app permissions
  • Secure Score decisions recorded and written back to Microsoft
  • Close internet-open ports, public S3 buckets and public databases in AWS
  • Turn on GuardDuty, CloudTrail and default encryption in AWS
  • Lock a compromised account down: block sign-in, end sessions, clear MFA methods
  • Rollback for reversible fixes, with the previous state saved
Compliance and audits Evidence collected for you, continuously.18
  • Built-in frameworks evaluated from live data
  • Cyber Essentials v3.3 and Cyber Essentials Plus readiness with automated evidence checks
  • Cyber Essentials evidence pack with draft answers for your assessment
  • ISO/IEC 27001:2022 mapping: clauses 4 to 10 and all 93 Annex A controls
  • SOC 2 mapping across the Trust Services Criteria
  • Framework scope set automatically or by you
  • Control status and owner attestation
  • Raise remediation straight from a failing control
  • One control mapped to many frameworks
  • Alerts when a framework changes version
  • Compliance calendar and reminders
  • Evidence locker with freshness tracking
  • SBOMs in CycloneDX and SPDX
  • Audit workspaces with auditor access and evidence requests
  • Downloadable audit packages
  • RMF/ATO board: SSP, assessment report and POA&M
  • A trust centre page for your customers
  • Starter control packs for Kubernetes, releases, AI and observability
Risk, exceptions and policy Decisions recorded, risks owned.6
  • Risk register with linked controls and residual risk
  • Automatic risk sweeps that propose risks to accept
  • Security exceptions with expiry
  • Security policies with enforcement
  • Baselines with drift tracking
  • Supplier and third-party risk
Release security and supply chain Nothing risky ships by accident.6
  • Release gates that block unresolved critical risk
  • "Can I ship?" readiness per release
  • Release decisions for your CI pipelines
  • Infrastructure-as-code verdicts on releases
  • SBOM generation and component inventory
  • Provenance and signed builds
Detection and response Detect, investigate and respond, with proof.10
  • Live detection signals from host and Windows logs
  • Collection coverage, so quiet is not mistaken for blind
  • Detection rules managed as code
  • Investigation cases with tasks, evidence and timelines
  • Response playbooks and rehearsals
  • Break-glass emergency access
  • Threat hunting and a detection inbox
  • MITRE ATT&CK coverage
  • Forensic evidence with chain of custody
  • Tabletop exercises
Identity, data, cloud and AI Beyond the endpoint.13
  • Data map: discover, classify and own data stores
  • Data residency rules
  • GDPR Article 30 records of processing, with export
  • Privacy impact assessments
  • Data exposure detection
  • Approval for AI agents' security actions
  • Cloud posture across AWS, Azure and GCP
  • Dormant admins and over-privileged roles
  • Privileged access with time-bound grants
  • SaaS and shadow IT, with OAuth consent review
  • AI guardrails for models, agents and MCP tools
  • Endpoint, mobile, USB and OT/IoT security
  • Security awareness and phishing campaigns

Connected today

Works with what you already run.

Every integration runs through the same approvals and audit trail, and new ones are added as data, so the list keeps growing. How integrations work →

Scanners

  • Trivy
  • Grype
  • OSV-Scanner
  • Semgrep
  • Gitleaks
  • Checkov
  • Kubescape
  • Lynis
  • Nikto
  • Nmap
  • Nuclei
  • Greenbone / OpenVAS
  • Any SARIF or generic scanner

Advisory feeds

  • NVD
  • OSV
  • GitHub Security Advisories
  • CISA KEV
  • FIRST EPSS

Compliance frameworks

  • Cyber Essentials
  • Cyber Essentials Plus
  • ISO/IEC 27001
  • SOC 2
  • CIS Controls v8
  • NIST CSF 2.0
  • NIST 800-53 (StateRAMP)
  • PCI DSS
  • HIPAA
  • UK GDPR
  • NCSC CAF
  • Essential Eight
  • CJIS
  • SOX ITGC / FFIEC / GLBA
  • NERC CIP
  • FCC CPNI
  • EU AI Act
  • ISO/IEC 42001
  • NIST AI RMF

Microsoft 365

  • Microsoft Defender
  • Microsoft Entra ID

Shared by every service

Plus the whole Virtum platform.

Put Security to work.

Design partners get early access and help shape what comes next. Or let Virtum run it for you as a managed service.

Become a design partner Prefer we run it for you?