Sanctum is the foundation that your security operates on. A single place to track your risk assessments, vulnerability and pen-test findings, exercises, and evidence all live in one institutional memory — the platform that turns episodic engagements into a continuous view of risk.
Why Sanctum, not another tool
The way most organizations buy security is episodic — a pen test in Q1, an assessment in Q3, an exercise in Q4. The platform underneath is usually a folder of PDFs. Sanctum closes the gap between engagements by being the system every piece of work runs on, retaining the institutional memory of each one, and getting smarter the longer the relationship lasts.
Without a Platform
Findings arrive as PDFs. Remediation gets tracked in spreadsheets. Evidence lives in email threads. Twelve months later, the next engagement begins the cycle over — with none of the context, none of the history, and none of the compounding insight that should come from a continuous relationship.
With Sanctum
Every assessment, finding, and decision is captured in the platform. The second pen test starts where the first one ended. The remediation library learns from every fix that worked. The customer's risk picture compounds rather than resets — because the platform remembers what the consultants would otherwise have to relearn.
clients running on Sanctum
Each pane of glass contributes a different proof point to the continuous-coverage promise. All four share the same data model, the same finding catalogue, and the same institutional memory. A customer running all four does not experience four products — they experience one continuous view of their security posture.
Sanctum Core
The platform's foundational layer — risk assessments, client records, engagement workflows, finding catalog, report templates, user identity, role-based access, audit logs. Every other application runs on top of it. This is where institutional memory lives.
Getting smarter with every engagement.
Pen-Test
Findings editor with CVSS v4.0 scoring, framework mapping across CWE, MITRE, OWASP, MPA, and NIST, evidence attachment, a firm-wide finding catalogue, and template-driven reports. The depth of specialist offensive expertise, delivered through software.
Faster and more consistent with every report.
Vulnerability Assessment
Always-on vulnerability scanning, configurable schedules, dashboards for administrators and end users, branded report exports, and an online purchase portal for friction-free scope expansion. The application customers experience daily, not quarterly.
Coverage that runs whether or not we are in a room together.
Tabletop
A scenario-driven incident response and business continuity exercise platform with self-led and consultant-led modes, grounded in a curated corpus of real incidents. AI-driven scenario generation, plausibility checking, and after-action reports that flow back into the same finding catalogue.
Turning plans on a shelf into muscle memory.
The atrium
Findings without context are noise. A report that says "TLS 1.0 is enabled on the load balancer" is true and unhelpful — what your team actually needs is the answer to "how do I fix this, on my stack, without breaking my dependent services."
The Sanctum content library, Atrium, is the curated, versioned, internally-owned body of remediation guidance that closes that gap. Every finding links to the matching playbook. Every assessment surfaces the relevant policy template. The institutional knowledge of the firm, externalized into the platform.
This is what lets "deepest specialist knowledge" survive scale. Depth lives in the platform, not just in individuals. Every customer benefits from every other customer's hard-won lessons.
Welcome to the atrium
Hardening guides
Platform-specific, version-specific configuration baselines for the systems you actually run.
Remediation playbooks
Step-by-step scenario guidance for the multi-step fixes that used to require a senior consultant on a call.
Incident response runbooks
Pre-built and customizable runbooks for the incident scenarios your team most plausibly faces.
Policy and program templates
Information security policies, vendor risk questionnaires, board-reporting templates, examiner-readiness packets.
Control mappings
Every finding mapped to CIS, NIST CSF, NIST 800-53, ISO 27001, PCI DSS, HIPAA, and FFIEC.
Industry-tuned by default
Sanctum includes questionnaire libraries, control mappings, and reviewer workflows tuned to the specific assurance regimes the Convergent practice has been delivering for two decades.
TPN+
Motion Picture Association content security tiers
NCBA CTS
Committed to Security creditor firm program
ISO 27001
Information security management certification
SOC 2
Service organization controls attestation
NIST CSF
Cybersecurity framework alignment and maturity
PCI DSS
Payment card data security standard
FFIEC
Financial institution examination handbook
CSA CCM
Cloud Security Alliance controls matrix
See Sanctum in motion
Talk to the team about how Sanctum fits into your security program. Demo, walkthrough, or technical deep-dive — your call.