VA Platforms
One platform, two ways to regain control.
Virtual Auditor delivers a complete security & compliance program, while Inventory Manager goes deep on one of your hardest problems: knowing exactly where regulated data lives, who can touch it, and what they’re doing with it - across hundreds of applications.
VIRTUAL AUDITOR- Continuous security & compliance, delivered as a managed program.
Most organizations still treat security like a project: a big assessment every few years, a thick PDF, and a mad scramble before audits. Virtual Auditor turns that into an always-on program that discovers issues, tracks remediation, and produces evidence you can hand directly to auditors.
What Virtual Auditor does
- Automatically identifies servers, endpoints, databases, and key applications in your environment.
- Normalizes metadata so security, IT, and audit are finally looking at the same picture.
- Evaluates configurations, patch status, exposure, and user access against frameworks like HIPAA, PCI DSS 4.0/4.0.1, NIST CSF 2.0, ISO 27001, SOC 2, and NYDFS 23 NYCRR 500. (Table Media)
- Highlights the specific gaps that will matter to regulators, examiners, and external auditors.
- Quarterly reviews with a senior security auditor to prioritize fixes, plan the next 90 days, and prepare board-ready updates.
- Optional tabletop exercises and playbooks for events like ransomware, business email compromise, and PHI exposure.
- Tracks changes over time—new assets, new accounts, new connections—and flags drift from approved baselines.
- Integrates with your existing logging/monitoring tools to enrich findings and avoid rework.
- Produces artifacts that answer the questions auditors actually ask:
- What systems handle regulated data?
- Who has access, and why?
- How do you monitor and review activity?
- Reduces manual evidence collection (SharePoint folders, ad hoc screenshots, etc.) and brings it into a single view.
Ideal For
Regional and community banks subject to NYDFS 23 NYCRR 500, PCI, and FFIEC-aligned expectations.
Health systems, clinics, and business associates under HIPAA/HITECH and payer security requirements.
Mid-sized organizations that need “big company” audit evidence without building a big company security team.
INVENTORY MANAGER- Application & PHI inventory you can defend in front of any auditor.
Regulated organizations don’t fail audits because they lack tools—they fail because no one can answer simple questions with confidence:
- Which applications touch PHI or other regulated data?
- Who has access, and should they?
- Can you prove what happened, with which data, and when?
Most teams try to stitch this together with spreadsheets, SharePoint, and a SIEM. It’s partial at best—and auditors increasingly expect a complete inventory of systems that process or store ePHI and how users access them. (The HIPAA Journal) Inventory Manager solves this problem end-to-end.
Key Capabilities
- Discovers and catalogs all applications in scope for regulated data—often hundreds in a single health system.
- Tags applications that process, transmit, or store PHI or other regulated data so you know exactly what’s in scope.
- Correlates application user lists with HR and directory data to flag:
- Stale accounts
- Shared or generic service IDs
- Users whose access no longer aligns to their role
- In one recent deployment, the tool surfaced 100+ users with unnecessary access in a single clinical application—exposure that had never been noticed in prior audits.
- Generates a formalized security assessment and inventory report aligned to NIST-style controls and audit expectations, avoiding one-off, manual writeups.
- Visualizes how PHI moves between servers, databases, and applications.
- Documents these flows in a way auditors and examiners understand, eliminating last-minute diagram scrambles.
- Pulls logs from servers and applications to answer: who did what, with which patient or customer record, and when?
- Detects blind spots like generic print-service accounts that make it impossible to tie a printed medical record back to an individual user—exactly the kind of issue auditors and regulators zero in on.
How Organizations Use Inventory Manager
Healthcare
Build and maintain an authoritative PHI system inventory; prove who has access and how activity is reviewed; quickly answer OCR and third-party auditor requests.
Financial Services
Identify business-critical applications with sensitive customer data; confirm least-privilege access; demonstrate compliance with data protection rules.
As an Add On to Virtual Auditor
Start with a narrow scope (e.g., 5–10 high-risk apps) to show rapid value, then expand over time across your estate.
ENGAGEMENT MODEL (HIGH LEVEL)
Scope & objectives
Agree on the initial application set (often 5–10 critical systems).
Deploy & connect
Install Inventory Manager in your environment and connect to relevant data sources.
Analyze & remediate
Review findings jointly, prioritize removal of high-risk access, and document compensating controls.
Present to auditors & leadership
Use Inventory Manager’s outputs as the backbone of your audit narratives and board updates.