Security and Compliance
Detectify helps organizations meet compliance requirements across a range of security and regulatory frameworks. As an application security testing and attack surface management platform, Detectify provides continuous vulnerability detection, security testing evidence, and asset discovery — key components of most compliance programs.
This section maps Detectify’s capabilities to specific requirements within each framework, showing where Detectify provides direct coverage and where complementary tools are needed.
Coverage Overview
| Framework | Category | Detectify Coverage | Key Capabilities |
|---|---|---|---|
| OWASP Top 10 | Application Security | Strong | Built-in OWASP Top 10 pass/fail reporting, payload-based tests |
| OWASP LLM Top 10 | AI/LLM Security | Moderate | Injection testing, output handling, AI/ML tool exposure detection |
| OWASP ASVS | Application Security | Moderate | Validation, access control, API, and configuration verification |
| WASC | Web Security | Strong | Injection, information disclosure, client-side attacks, authorization |
| PCI DSS | Payment Card Industry | Strong | PCI ASV scanning, DAST for Req 6 and 11, CVSS-based reporting |
| HIPAA | Healthcare | Moderate | Technical safeguard vulnerability detection, evaluation evidence |
| DORA | Financial Services (EU) | Moderate | ICT vulnerability management, system testing, asset identification |
| PSD2 | Payment Services (EU) | Moderate | API security testing, vulnerability management, data protection |
| ISO 27001 | Information Security | Moderate | Vulnerability management (A.8.8), configuration management (A.8.9) |
| NIST CSF | Cybersecurity | Moderate | Asset management, vulnerability scanning, continuous monitoring |
| SOC 2 | Trust Services | Moderate | Vulnerability management evidence, system monitoring, risk assessment |
| HITRUST CSF | Risk Management | Moderate | Vulnerability scanning, web application testing, configuration auditing |
| FedRAMP | US Government Cloud | Moderate | Vulnerability scanning (RA-5), flaw remediation (SI-2), input validation (SI-10) |
| MITRE ATT&CK | Threat Intelligence | Partial | Initial Access and Reconnaissance technique detection |
| GDPR | Data Protection (EU) | Moderate | Article 32 security testing, vulnerability detection for data protection |
| NIS2 | Cybersecurity (EU) | Moderate | Vulnerability handling, effectiveness assessment, asset discovery |
| Cyber Resilience Act | Product Security (EU) | Moderate | Vulnerability identification, security testing, technical documentation |
| IEC 62443 | Industrial Systems | Partial | Web/API interface testing for industrial systems with web components |
Coverage levels
- Strong — Detectify directly addresses the core requirements of this framework
- Moderate — Detectify covers the vulnerability management and application security components, but the framework also requires controls outside Detectify’s scope
- Partial — Detectify provides tangential coverage; the framework primarily addresses domains outside web application and API security
How Detectify Fits Into Your Compliance Program
Detectify is one component of a compliance program. It covers vulnerability scanning, application security testing, and attack surface management. Most frameworks also require:
- Static application security testing (SAST) — Code-level analysis
- Web application firewalls (WAF) — Runtime protection
- Endpoint protection — Device and host security
- Identity and access management (IAM) — User provisioning and authentication infrastructure
- Network security — Firewalls, IDS/IPS, network segmentation
- Governance and policy management — Documentation, training, and organizational controls
- Incident response — Detection, containment, and recovery procedures
Each framework page details exactly which requirements Detectify addresses and where complementary tools are needed.