Compliance and Audit Readiness
Keep Audit Evidence Current by Default.
Audit prep goes wrong when the evidence is a snapshot from months ago. External Attack Surface Management classifies each issue against compliance frameworks when it is detected, and logs each decision made about it.
Third-Party Risk Management applies those classifications to your vendors. Open PCI DSS 4.0 findings, yours and your processors’, becomes a filter instead of a project.
Weak TLS cipher High
Issue
-
Detected2026-09-18
Classified the same moment:
-
Classificationsowasp_tt_2021, pci_4_0, pci_3_2, hipaa, CWE, CAPEC, WASC (does not apply here: hipaa)
Does not apply herehipaa:
-
Filterframework: PCI DSS 4.0 · state: open · tag: payments
-
Resultthis issue, with its state history
-
ExportIssue detail (PDF)
Evidence Ages Between Audits.
The controls run all year. The evidence for them is usually gathered in a few weeks before the auditor arrives.
Snapshots
Collected Once, Trusted for a Year
Evidence gathered for the last audit describes the surface as it was then. It says nothing about what changed since.
Translation
Findings in One Language, Controls in Another
A scanner reports a weak cipher. The auditor asks about a requirement. Someone has to translate between the two, every cycle.
Vendors
Controls Outside Your Walls
Processors, hosts and service providers carry part of your scope, and their evidence usually arrives as a questionnaire.
Compliance Frameworks Are Mapped at Detection.
Each issue carries its classifications from the moment it is raised. The list below is complete: the Deepinfo Platform does not claim mappings to other regulations.
| OWASP Top 10 (2021) | Web application risk categories. owasp_ |
|---|---|
| PCI DSS 4.0 | Payment card industry requirements, current version. pci_ |
| PCI DSS 3.2 | The previous version of the standard. pci_ |
| HIPAA | US safeguards for health information. hipaa |
| CWE | Common Weakness Enumeration: the weakness behind a finding |
| CAPEC | Common Attack Pattern Enumeration and Classification: the attack pattern that exploits it |
| WASC | Web Application Security Consortium threat classes |
Every Decision Stays on Record.
An auditor asks what happened to a finding, not only whether it is open. Issues move through states from newly detected to verified resolved, and an accepted risk or a false-positive call stays on the issue with its history instead of being deleted.
Found
Open
The team can decide
Each scan checks
newly detected
orreappeared
unresolved
checked again on every scan
optional, kept on record
marked as resolvedrisk acceptedignoredmarked as false positive
verified resolved
the signal is gone: no one has to mark itnot applicablewhen a scan cannot tell
Where the Evidence Comes From.
No separate compliance module to feed. The evidence is a by-product of the monitoring your team already runs.
Risk Detection
Raises each issue with its evidence, a severity from Critical to Information and its framework classifications.
Remediation
Keeps each issue’s state history, from newly detected to verified resolved, accepted risks and false positives included.
Continuous Scanning
Stores each layer of each asset as a dated snapshot, so you can show what an asset looked like on a given day.
Compliance Tracking
Applies those classifications to all issues across vendor portfolios, with nothing to configure per vendor.
From Finding to Audit File.
-
01
Detect
Scans raise issues on your assets and your vendors’ assets, already classified.
-
02
Filter
Narrow by framework, severity, state, asset tag or vendor. Open PCI DSS 4.0 findings on assets tagged for payments is one filter.
-
03
Resolve
Owners fix or decide. A fix is verified by rescan, and a decision stays in the issue’s history.
-
04
Export
Export any issue search in full, or produce issue overview, issue detail and executive summary reports as PDF, on demand or on a schedule.
Use This Data in Your Tools
Auditors and GRC tools can pull the certificate, technology and vulnerability data behind each finding through the API.
Questions About Compliance and Audit Readiness
Which frameworks are mapped?
OWASP Top 10 (2021), PCI DSS 4.0, PCI DSS 3.2, HIPAA, CWE, CAPEC and WASC. Each issue carries the classifications that apply to it.
Does a classification mean we are compliant?
No. A classification says which framework a finding is relevant to, so your team can prioritize and evidence it. It is not an attestation: compliance decisions stay with your compliance function and your auditors.
Can we use the findings for other regulations?
As supporting evidence, yes. Regulations such as GDPR ask for appropriate technical measures, and a current, classified record of external findings helps show them. The platform does not map findings to those regulations’ controls.
Does this replace a GRC tool?
No. The platform produces the external evidence, classified and current. Your governance process decides what that evidence means for each control.
Can we verify a fix right before an audit?
Yes. Start an instant scan on the asset from the platform or with one API call. If the issue is no longer found, it moves to verified resolved without waiting for the next scheduled pass.
Can we show which alerts went out?
Yes. The platform API lists the notification emails that were sent, each with the rule that triggered it, so an auditor can see which alerts went out and why.
Are vendor findings classified too?
Yes. Third-Party Risk Management runs vendors on the engine that scans your assets, so vendor issues carry the same classifications.
Answer the Auditor With Current Data.
Book a demo to filter real findings by the frameworks your audits use.