Static-analysis checklist of common security weaknesses, each related to the 16 frameworks Vigilent advises on (ISO/IEC 27001:2022, TISAX, SOC 2, OWASP ASVS and Top 10, UL 2900, NIST CSF 2.0, PCI DSS v4.0.1, IEC 62443, CIS Controls v8.1, MITRE ATT&CK, NIST SP 800-53, NIS2, GDPR, NIST SP 800-82, HIPAA and CCPA Article 9) through Vigilent's framework crosswalk. Upload source files on the Code Audit tab and scan — results appear here. Checks cover Authentication, Authorization, Injection, Cryptography, Configuration, API Security, Network, Infrastructure, Mobile, Supply Chain, Privacy, and Incident Response.

This is not a live penetration test. Vigilent's automated tool identifies patterns commonly associated with security weaknesses in uploaded source files. A penetration test means authorized, active attacks against a running system by qualified testers. Vigilent does not perform penetration tests; we can help you scope one with a specialist firm and use its results in your compliance assessment — schedule a consultation.

Points the audit engine at a live website or IIoT/OT endpoint instead of uploaded source: HTTP security headers, a real TLS handshake, a shallow same-domain crawl, DNS/email hygiene, configuration hardening, and optional MQTT/CoAP/AMQP protocol checks. Findings map to ISO 27001:2022 Annex A the same way Code Audit findings do.

Requires the Network Assessment Agent API. Browsers can't open a raw TLS handshake or read another site's response headers (CORS) — this tab calls the Python backend (POST /scan-url) that does the real work. Configure its URL below once deployed.

This tab lives in Vigilent Labs (staff-only), not in the client-facing Client Portal — it is gated separately from client-facing access.

Every scan needs Legal's signed scope grant for the engagement. Sign in as the assessor the grant names; the target host must be listed in it, and the scan reaches only the hosts it lists. The scan is recorded under the grant's client, so a client erasure removes it.