We don't just recommend security controls.
We help you prove they're working.
ThreatGovern™ collects the evidence that each control is in place and working, tracks the exceptions, and reports every control's status, so the proof is ready before your auditor, insurer or board asks for it.
ThreatGovern™ is Vijilan's vCISO and security advisory service, built on continuous control assurance. For every control in scope it reports the status, the evidence behind it and when that evidence was collected, the open exceptions, and who owns each fix. On Premium, a named Vijilan advisor leads the program; Essentials and Standard deliver the evidence with platform or SOC analyst review.
The problem it solves is proof. Every organization facing an audit has a list of controls it is supposed to have. The hard part is showing, on a given day, that each one is in place, producing evidence and being reviewed. Today that answer is usually a scramble of screenshots and exports.
A control with no evidence behind it is reported as not verified. It is never assumed to be working.
ThreatGovern provides operational evidence, not an audit, attestation or certification: your auditor still issues the opinion. It is delivered white-labeled through MSP and MSSP partners, or directly to mid-market and enterprise buyers, and it starts with a free Control Readiness Snapshot.
Start with a free Snapshot. Then pick a tier.
The Control Readiness Snapshot shows which of your controls have evidence behind them today, which rest on self-attestation, and which have none. Pick the tier you are aiming for, leave a work email, and the ThreatGovern team scopes the Snapshot with you within one business day.
- Starts with a free Control Readiness Snapshot
- A control with no evidence reads “not verified”, never assumed
Early Access: your program runs on the Vijilan portal from day one, against CIS Controls v8.1, with evidence stored with its collection date, expiry and a SHA-256 hash. During Early Access, framework crosswalks are delivered by the ThreatGovern advisory team, and automated assessment from connected telemetry rolls out source by source. Your scope is confirmed in writing before anything starts.
Five fields for every control.
Never assumed, always dated.
| Status | Effective · Effective with exceptions · Ineffective · Not applicable · Not verified |
|---|---|
| Evidence source | The system that produced the proof: SIEM, identity provider, Microsoft 365 audit log, endpoint sensor, cloud control plane, or a document you supplied |
| Collection date | When the evidence was gathered, and when it expires |
| Exceptions | Each open gap, with the date it was found |
| Remediation owner | The named person responsible, and the due date |
If we cannot see the telemetry, the control is reported as not verified. It is never assumed to be working.
The controls a SOC can prove.
Because it already watches them.
Audit log management
Are the right sources collected, centralized, retained for the required period, protected from tampering and reviewed to conclusion? Is a failure in the logging pipeline caught before an auditor finds the gap?
Access control monitoring
Who holds privileged access, is MFA enforced where it must be, are leavers disabled within policy, are dormant accounts caught, and is access to sensitive data logged and reviewed?
Data protection
Is sensitive data inventoried, encrypted at rest and in transit, backed up and restorable, watched for exfiltration, and retained and disposed of according to policy?
Scope, connect, evidence,
report.
Scope
Choose the frameworks that apply. Not sure? Tell us what data you hold, such as cardholder data, health information or controlled unclassified information, and we propose the set.
Connect
We read the systems that generate evidence: your SIEM, identity provider, Microsoft 365 or Google Workspace audit logs, endpoint telemetry and cloud control planes. A control with no connected source reads "not verified" until it has one.
Evidence
Proof is collected on the cadence each control needs, stored with its collection date and a SHA-256 hash, and tracked to its expiry.
Report
You get the status of every control, the open exceptions and who owns each fix, in a form you can hand to your auditor.
Early Access: your program runs on the Vijilan portal from day one, against CIS Controls v8.1, with evidence stored with its collection date, expiry and a SHA-256 hash. During Early Access, framework crosswalks are delivered by the ThreatGovern advisory team, and automated assessment from connected telemetry rolls out source by source. Your scope is confirmed in writing before anything starts.
The same SOC that watches your environment collects the proof.
ThreatGovern runs on Praxis AI™, Vijilan’s SOC platform, and attaches to ThreatRespond™, ThreatDefend™ or NextDefend™. ThreatHunt™ findings and containment actions become evidence that your detection and response controls work, not just incident records. Already have a consultant or a GRC platform? Keep them: ThreatGovern supplies the operational evidence both need.
Tabletop exercises
Rehearse the incident before it happens, with ThreatRehearse.
Branching incident response and disaster recovery exercises from the ThreatGovern practice, built on NIST SP 800-84 and CISA Tabletop Exercise Packages, with the Vijilan SOC in the room.
See how ThreatRehearse worksWhite-label for partners.
Direct for your own company.
Sell compliance evidence under your brand.
Your clients’ auditors, insurers and boards now ask to see controls working. ThreatGovern gives you the answer, with your logo on every report and evidence pack.
- Fully white-label, and you own the client relationship
- QBR-ready control and exception reports
- Your Partner Success Manager scopes each engagement with you
We never compete with our partners for their clients.
Proof ready before the auditor asks.
Replace the week of screenshots with a control-by-control record your auditor can work from, kept current by the team that already watches your environment.
- Every control’s status, evidence and owner in one place
- Exceptions tracked to a named owner and a due date
- Works alongside your IT provider, consultant or GRC platform
Mapped to the references
your auditor uses.
Mapping shows which requirement a control’s evidence supports. It is not a statement that you comply with a framework: your auditor or assessor decides that.
| Framework | During Early Access |
|---|---|
| CIS Controls v8.1 | Runs as a program on the Vijilan portal today |
| NIST CSF 2.0 | Advisor-led crosswalk during Early Access |
| HIPAA Security Rule | Advisor-led crosswalk during Early Access |
| PCI DSS v4 | Advisor-led crosswalk during Early Access |
| SOC 2 Trust Services Criteria | Advisor-led crosswalk during Early Access |
| CMMC Level 2 | Advisor-led crosswalk during Early Access (readiness, not certification) |
ThreatGovern provides operational control evidence. It is not an independent audit, attestation or certification: your auditor or assessor still issues the opinion.
ISO/IEC 27001 is a certification Vijilan holds and SOC 2 Type II an independent audit of Vijilan. CPSP is a CrowdStrike partner-program designation, not an audit. HIPAA, PCI DSS and CMMC Level 2 evidence packs are available on request.
The ThreatGovern™ whitepaper
Ten pages on the governance gap: why security programs fail without an owner, and how governance connects to a SOC that acts. Work email required.
Common questions.
What is ThreatGovern™?+
ThreatGovern™ is Vijilan’s continuous control assurance service. It collects the evidence that each security control is in place and working, tracks the exceptions, and reports every control’s status, its evidence and who owns each fix, so the proof is ready before an auditor, insurer or board asks for it.
Is ThreatGovern an audit or a certification?+
No. ThreatGovern provides operational control evidence. It is not an independent audit, attestation or certification, and it does not make you compliant with a framework. Your management stays responsible for its compliance decisions, and your auditor or assessor issues the opinion. ThreatGovern gives both of them the evidence.
What does Early Access include?+
Your program runs on the Vijilan portal from day one, against CIS Controls v8.1, with evidence stored with its collection date, expiry and a SHA-256 hash. During Early Access, framework crosswalks for NIST CSF, HIPAA, PCI DSS, SOC 2 and CMMC Level 2 are delivered by the ThreatGovern advisory team, and automated assessment from connected telemetry rolls out source by source. Your scope is confirmed in writing before anything starts.
What is the Control Readiness Snapshot?+
A free first look. For each control domain it shows how many of your controls have a connected evidence source today, how many rest on self-attestation, and how many have no evidence at all. The ThreatGovern team scopes it with you within one business day of your request.
What happens to a control you cannot see?+
It is reported as not verified. A control is never shown as working unless the evidence behind it exists and is current.
We already have a consultant or a GRC platform. Do we need ThreatGovern?+
Keep them. Advisors define what your program should accomplish; GRC platforms organize policies and questionnaires. ThreatGovern supplies the operational evidence both of them need: the logs, the review records and the control status that show the program is running.
Can MSPs and MSSPs white-label ThreatGovern?+
Yes. ThreatGovern is fully white-label: your logo on every report and evidence pack, delivered at your QBRs. Your Partner Success Manager scopes each engagement with you, and Vijilan never competes with its partners for their clients.
"Having those capabilities integrated into a single platform has simplified operations, improved our security posture, and allowed us to focus on strategic initiatives rather than day-to-day monitoring and management."
Start with
a free Snapshot.
See which of your controls have evidence behind them today. Or add ThreatGovern to your practice as a white-label line. Prefer to talk now? info@vijilan.com · +1 (954) 334-9988.