VitalSec enforcement modalities
Find exposure. Test what holds. Govern emerging AI.
Three parts of VitalSec handle three different jobs: vulnerability remediation, security-control testing, and AI-use governance. Each stays within customer permissions and writes evidence to the same system.
Three distinct jobs
Vulnerability work, control testing, and AI governance are different jobs.
VUMA
Vulnerability management + validated closure
VUMA brings vulnerability findings into VitalSec, combines duplicate and contextual evidence, sends approved remediation through the path available in that environment, and checks the source again before calling the finding closed.
Open VUMACAAT
Controlled adversarial validation
CAAT runs controlled, approved tests against security controls and exposed paths. It records what happened, determines PASS, FAIL, or INCONCLUSIVE from the evidence, and keeps each test within customer-set scope and safety limits.
Open CAATShadowAI
AI discovery, governance + evidence
ShadowAI finds AI clients and developer tooling from endpoint software evidence, ties those findings to device, identity, and policy context, and keeps discovery separate from any approved remediation.
Open ShadowAIShared evidence record
All three write to Evidence Continuity.
VUMA, CAAT, and ShadowAI solve different problems. Each keeps its own finding, test, or decision, and all three write observations, approved actions, validation results, and source history to Evidence Continuity so the evidence remains usable later.