ValidMost Valid Project

Valid Cybersecurity

The trust that protects identities. Now protects your whole company.

From identity to infrastructure, Valid extends its security experience to protect applications, cloud, code, certificates, suppliers and digital assets. All in one integrated platform.

Explore the platformSee solutions
0:00
0:00

Watch the platform consolidate risk from nine modules in real time.

9
integrated modules
1
sign-on for all of them
315
cloud posture checks
4
clouds audited
  • Google Cloud
  • AWS
  • Azure
  • Oracle Cloud

GCP is the parity reference, with 14 control families and 87 checks. The other clouds cover the equivalent critical families.

The modules

Every discipline gets a module. All of them speak the same language.

Enable only what you need. Modules share identity, company and permissions, so what one finds feeds what the next one shows.

  • ASM

    Attack Surface Management

    Maps and monitors your external attack surface: exposed assets, SSL/TLS, and whatever faces the internet without your knowing.

  • CSPM

    Cloud Security Posture Management

    Cloud posture and compliance across GCP, AWS, Azure and Oracle Cloud, with 315 checks and attack-path detection between resources.

  • PA

    Pentest Automation

    Automated, continuous penetration testing: discovery, triage and retest, without waiting for the annual window.

  • SAST

    Static Application Security Testing

    Static source-code analysis with taint tracking and a low false-positive rate, scored per repository.

  • DIA

    Digital Intelligent Assistant

    Compliance self-assessment and form automation: GRC and privacy work without loose spreadsheets.

  • FA

    Firewall Rule Auditor

    Firewall rule auditing with a local LLM: shadowing, orphaned rules and compliance, without shipping your config off-site.

  • TPCRM

    Third-Party Cyber Risk Management

    Third-party cyber risk: questionnaires, evidence and a score per supplier, with movement tracked over time.

  • TC

    Threat Consciousness

    Security awareness training and phishing simulation, with coverage per department and click rate tracked campaign over campaign.

  • GCD

    Automated Certificate Discovery

    TLS certificate discovery and inventory: what expires, what already has, and what is served over obsolete TLS.

How it works

From the exposed asset to the number that reaches the board.

Each module solves a concrete problem. Together they become a single reading of risk, the same one the CISO takes upstairs.

Consolidated view

The dashboard that answers “where do we stand?” in ten seconds

Global risk score, financial exposure, open incidents and control coverage, fed by the modules you enabled, with nobody stitching spreadsheets together on a Friday.

  • Global risk, with direction

    A 0-to-100 score with 30-day movement, so you show a trend rather than a snapshot.

  • Incidents and coverage side by side

    What is burning right now, and how much of your surface is genuinely monitored.

  • Wallboard mode

    The same reading full-screen, for the SOC wall or the boardroom display.

ASMCSPMPASASTTPCRM
Consolidated CISO dashboard showing global risk score, financial exposure and active incidents
  • ASMAttack Surface Management
  • GCDAutomated Certificate Discovery

What the internet sees of you, before someone uses it

Continuous discovery of external assets and a TLS certificate inventory with expiry windows. The surface changes every week; the monitoring keeps up.

  • Continuous discovery

    New assets land in the inventory without anyone registering them by hand.

  • Certificates before they bite

    Expiry, hostname mismatch and obsolete TLS flagged days ahead.

  • Wildcard, self-signed and validation level

    Every certificate classified by type, issuer and negotiated TLS version.

ASMGCD
ASM certificates screen: TLS inventory per monitored domain, showing issuer, expiry window, validation level and TLS version
  • PAPentest Automation

Pentest that runs when the asset changes, not when the contract allows

An annual pentest window leaves eleven months of unverified exposure. PA scans what ASM discovered, scores every finding by severity and CVSS, and keeps the history so you can prove what was fixed.

  • Findings with evidence and CVE

    Each item carries the tool, CVSS, the exact target and the remediation advice.

  • A lifecycle, not a snapshot

    Open, retested and resolved, with detection date and recurrence count.

  • Authorisation is governed

    Every run has an approved target and an audit trail of who authorised what.

PA
PA dashboard: consolidated rating with a grade, exposure by severity, scan activity over the last seven days and a ranking of the most exposed targets
PA
PA vulnerabilities screen: findings by severity with CVE, CVSS, target, tool and detection date
  • CSPMCloud Security Posture Management

It is not the lone misconfiguration. It is the path it opens.

An open port on its own is noise. An open port that leads to an IAM escalation that reaches the database is an incident waiting to happen. CSPM chains the hops and shows the whole path.

  • Chained attack paths

    From external exposure to the crown-jewel resource, hop by hop, with severity along the way.

  • 315 checks across four clouds

    GCP is the parity reference, with 14 families and 87 checks. AWS, Azure and Oracle Cloud cover the equivalent critical families.

  • Prioritised by reach

    Whatever grants access to sensitive data moves up the queue. The rest waits.

Clouds audited
  • Google Cloud87
  • AWS84
  • Azure72
  • Oracle Cloud72
CSPM
CSPM Attack Paths screen: exposure chains from the internet to the resource, with exploitability and the findings tied to each path
  • FAFirewall Rule Auditor

The firewall rule nobody has removed in three years

Every rule base accumulates temporary any/any entries, cleartext protocols and rules nobody uses any more. FA assesses the firewall posture and rates each rule by criticality, with a verdict and a fix per firewall and per business area, so the analyst can decide what stays, what changes and what goes.

  • A verdict per rule, not a raw dump

    Each rule gets a technical status, a 1-to-5 criticality and what to do about it.

  • Stale rules with zero hits

    Cleanup candidates identified from the appliance own hit counters.

  • Accepted risk has an expiry

    An exception needs justification, approval and an end date, and still counts as open risk.

FA
FA dashboard: consolidated risk grade, audited rules by status, stale rules and exposure per business area
  • TPCRMThird-Party Cyber Risk Management
  • SASTStatic Application Security Testing
  • TCThreat Consciousness

The risk that walks in through someone else’s door

A compromised supplier, a vulnerable dependency in your code, and an employee who clicks: three vectors a perimeter scan will never surface. Each gets its module, all of them feed the same score.

  • Suppliers with score and history

    Who improved, who slipped, and who stopped answering the questionnaire.

  • Code by grade, not by list

    Every repository gets an A-to-F grade, so refactoring gets prioritised on evidence.

  • Phishing measured, not assumed

    Click rate per department and per campaign, with training coverage tracked alongside.

TPCRMSASTTC
Static code analysis panel showing coverage percentage and A-to-F grades per repository

Financial quantification

Risk in currency, not in red and amber

“High severity” does not approve a budget. The platform translates technical exposure into annualised loss expectancy using the FAIR methodology and compares it against the market benchmark, so the board conversation moves from adjectives to numbers.

CISO FAIR exposure panel: annualised loss expectancy of R$ 4.8M, own exposure of R$ 3.2M against the IBM Brazil 2024 average of R$ 3.9M, and a 34% annual probability of a material event

Illustrative figures. The reference benchmark is the IBM Cost of a Data Breach 2024; your exposure is computed from the modules you have enabled.

The platform

One module is a tool. Nine modules need a platform.

What makes the modules work together is not point-to-point integration, it is a shared foundation of identity, permission and operations.

  • Single sign-on

    One authentication across every module. Users switch tools without switching passwords.

  • Genuine multi-tenancy

    Every session runs inside a selected company. One client’s data never touches another’s.

  • Permission per module

    Viewer, editor or manager, set per application rather than as one blanket role for everything.

  • Reporting on demand

    Executive PDF export drawn from the same data that feeds the dashboard.

  • Scheduling and alerts

    Recurring scans and notification when posture shifts, without anyone remembering to run them.

  • Open to integrate

    An API and an application catalogue to wire the platform into what you already run.

See it against your own data

A thirty-minute conversation to understand your environment and show the platform running over a real slice of your surface.

Sign in to the platform