Skip to main content
Virtik

CISA Secure by Design Pledge signatory

Secure by Design at Virtik

Virtik USA, Inc. is an official signatory of the U.S. Cybersecurity and Infrastructure Security Agency's Secure by Design Pledge.

Our public commitment reflects an engineering and operational approach centred on stronger identity controls, secure architecture, vulnerability reduction, resilience, transparency and continuous improvement.

Verify on CISA.govSecurity architecture

Why it matters

Security decided at design time, not bolted on

Secure by Design asks software manufacturers to take ownership of customer security outcomes rather than passing the work downstream. The burden of safety should sit with the vendor who can fix a whole class of defect once, not with every customer who has to configure around it.

That matters more than usual here. Virtik is bought by the people responsible for physical security at airports, utilities, campuses and government sites. A security platform that is not itself defensible is a liability wearing the wrong badge, so our own posture has to survive the same inspection we help our customers apply to everything else.

Virtik uses CISA Secure by Design principles as a reference framework for strengthening its cybersecurity practices, product architecture and operational security posture. Virtik has publicly committed to advancing the goals of the CISA Secure by Design Pledge.

Focus areas

Four domains that carry the work

Each is expanded below with the specific training completed and what it contributes.

Defensive Cybersecurity

Detecting, analysing and responding to threats, and reducing the chance that the same incident happens twice.

5 courses

Zero Trust Architecture

Never trust, always verify — access is authenticated, authorised and continuously evaluated rather than assumed from network position.

6 courses

Critical Asset Governance

Identifying what matters most, assessing the risk to it, and monitoring it continuously.

3 courses

Infrastructure & Network Security

Wireless and network exposure is a common way in, and it is governed separately from application security.

1 course

The pledge

What Virtik committed to

CISA's pledge sets out seven goals for software manufacturers.

  • Multi-factor authentication
  • Default passwords
  • Reducing entire classes of vulnerability
  • Security patches
  • Vulnerability disclosure policy
  • CVEs
  • Evidence of intrusions

The pledge is a commitment to demonstrate measurable progress towards these goals, not a declaration that all seven are complete. The authoritative description of each goal is published by CISA; the statements of support page carries participants' own words.

15 courses completed

Training completed, by domain

Course names are recorded exactly as issued. This section describes competency held by the team — see the section below for what is deployed in the product.

Defensive cybersecurity and incident management

Defensive cybersecurity and incident management are the parts of a security programme that assume something will eventually get through. The training below covers the lifecycle from first indicator to post-incident review.

  • Cyber Defense Analyst — Incident Response

    • Understanding the life cycle of an incident from detection to remediation
    • Identification of threats and incidents
    • Coordination of response and communications
    • Post-incident analysis to reduce recurrence

  • Cyber Defense Analyst — Indicators of Compromise

    • Identifying signs of compromise
    • Using tools to detect Indicators of Compromise
    • Analysis of event logs and malicious signatures
    • Implementation of proactive remediation measures

  • Cyber Defense Analyst — SIEM

    • Using SIEM tools for log collection and analysis
    • Aggregation and correlation of security events
    • Real-time suspicious activity detection
    • Reporting and alerting for improved threat visibility

  • Cyber Defense Analyst — Vulnerability Assessments

    • Understanding vulnerability assessment methodologies
    • Identification of security vulnerabilities in systems and applications
    • Using vulnerability scanning tools
    • Recommending remediation and implementing best practices

  • Cybersecurity Training for Defense of Internet-Accessible Systems

    • Protection of externally accessible services
    • Simulation and response to attacks in controlled environments
    • Implementation of advanced defensive mechanisms

Zero Trust and secure architecture

Unlike perimeter-based models, Zero Trust assumes that every access attempt must be authenticated, authorised and continuously evaluated. Reducing implicit trust shrinks the attack surface and limits how far an intrusion can travel.

  • Zero Trust Basic Principles for Federal Agencies

  • Zero Trust Architecture: Choosing a Model Based on the Task

  • CyberStat Workshops — Pillar 1: Identity, Parts 1 and 2

  • CyberStat Workshops — Pillar 3: Networks

  • CyberStat Workshops — Pillar 4: Applications and Workloads

  • CyberStat Workshops — Pillar 5: Data

Key skills acquired

  • Strengthening multi-factor authentication and privileged access management
  • Micro-segmentation concepts to reduce lateral movement
  • Granular access control based on risk
  • Encryption concepts for data in transit and at rest
  • Continuous monitoring of application activity

What it contributes

  • Zero Trust practices can reduce implicit trust, decrease attack surfaces and strengthen identity and data security.

Governance and management of critical assets

  • Overview of High Value Assets (HVA)

  • A Leader's Approach to Assessment and Authorization (A&A)

  • CDM Dashboard: Auto-creation of API keys

Key skills acquired

  • Definition and identification of High Value Assets
  • Assessment of risk and potential impact
  • Development of protection strategies
  • Risk-management principles
  • Continuous monitoring and automated access-management concepts

What it contributes

  • Strengthening resilience against cyber threats
  • Supporting cybersecurity compliance activities
  • Improving incident-management capabilities

Securing infrastructures and networks

  • Cyber Defense Infrastructure Support Specialist — Wi-Fi Security

What it contributes

  • Supporting stronger internal Wi-Fi security
  • Reducing wireless intrusion risk
  • Contributing to broader cybersecurity practices

Training vs. product

What is deployed, as distinct from what is known

Completing a course on SIEM does not mean Virtik operates a SIEM. Completing Zero Trust workshops does not mean every Zero Trust control is live in production. Those are different claims with different evidence, and we keep them apart deliberately.

The section above is competency held by the team. Below is the shorter list of controls that are properties of the running platform. It is short on purpose: it contains only what survives a reviewer asking to be shown.

  • Tenant isolation at the data layer

    Access is enforced in the database with row-level security, not only in the interface, so a client-side defect cannot become a cross-tenant data leak.

  • Role and entitlement dual gating

    What a person may do is checked twice and independently: against their operational role, and against their organisation's commercial entitlement.

  • Governed AI execution

    AI actions run under explicit operating modes with per-tenant policy, enforced per-user budgets and a tool authorisation boundary defined by risk class.

  • Audited operational actions

    Consequential actions are recorded as auditable events, so after-action review works from the record rather than from recollection.

  • Scoped, credentialed integrations

    Integrations are credentialed per organisation and governed by the same entitlement model as the rest of the platform.

  • Authentication controls

    Multi-factor authentication is available, and administrative surfaces are separated from operational ones so day-to-day use does not require elevated access.

These are the same controls described on the security architecture page, stated once and referenced here rather than restated in different words.

Measurable progress, and what we are not claiming yet

The pledge asks for demonstrable progress. Publishing progress metrics before they are measured would defeat the point, so this page does not carry any. What we can state today is the architecture already in place, the training completed, and the disclosure route that is open now.

Virtik holds no third-party security certification. There is no SOC 2 report, no ISO 27001 certificate and no FedRAMP authorisation, and the compliance page says which are not held rather than leaving it to inference.

Open today

A vulnerability disclosure route is one of the seven pledge goals and is live now — anyone can report a suspected vulnerability and see what we commit to in return.

Report a vulnerabilityTrust Center

References

Official sources and related reading

Pledge status is verifiable at CISA. Nothing here asks you to take our word for it.

cisa.gov

Secure by Design Pledge signers

CISA's own directory of organisations that have signed.

cisa.gov

Statements of support

Participants' published statements on the initiative.

virtik.ai

Security architecture

Where the controls sit in the running system.

virtik.ai

Trust Center

Posture, governance and documentation, including what is pending.

virtik.ai

Responsible AI

How AI execution is bounded and attributed.

virtik.ai

Vulnerability disclosure

How to report an issue, and what we commit to.

Reviewing Virtik's security posture?

Security questionnaires, architecture reviews and technical sessions go to the same place. You will get a straight answer about what is in place and what is not.

Contact the security teamTrust Center