Continuous monitoring and the new era for security

Sanctum is Convergent's AI-augmented security platform. It brings vendor risk assessment, security testing, content protection and incident readiness together in one place, with one dashboard and one live risk score.

The Sanctum platform, powered by an AI-augmented Risk Correlation Engine, is organised into four windows (Core, Test, Media Guard and IR) containing 12 modules, connected as one system instead of stand-alone tools. Sanctum:

• Turns findings from any module into a single live risk score and profile.
• Standardises workflow, evidence and remediation across every service.
• Gives clients one place to see risk, compliance and progress in real time.

Sanctum is multi-tenant, consent-based, consultant-verified and continuously mapped to industry requirements through an AI-augmented Unified Control Framework (UCF). It runs underneath every Convergent engagement, including TPN Assessments, the NCBA Committed to Security program, Vulnerability Management and Managed Remediation.

Studios, streamers and content owners; the vendors in their supply chain; and any organisation that needs to manage third-party security risk.

• Studios, streamers and content owners that need visibility across their vendor supply chain and must meet MPA, TPN and studio-specific requirements.
• Supply-chain vendors that are asked to complete the same assessments repeatedly for different clients.
• Independent productions without an in-house security team.
• Other regulated industries, for example the legal-collections sector through the NCBA Committed to Security program.
• MSSPs and compliance providers that want to deliver their own branded, Sanctum-powered programs.

Sanctum is built and run by Convergent (Convergent Digital Security), a global cybersecurity services provider with teams in Denver, Los Angeles, London and Mumbai.

Convergent finds what is actually exploitable, helps clients prioritise it against real business risk and stays involved through remediation, with outcomes tracked to closure rather than deliverables left on a shelf. Its services span three areas:

• Offensive security: AI testing, penetration testing, red teaming, application security, secure code reviews and social engineering.
• Assurance: cloud and site assessments, TPN assessments, vulnerability management, Zero Trust foundation, security assessment programs and posture validation.
• Advisory and remediation: managed remediation, ISO, NIST and SOC 2 readiness, privacy compliance, fractional CISO support and incident-response support.

Sanctum is the platform that runs underneath all of this work.

‍

No. Sanctum does the repetitive work so your people can focus on decisions. Every AI finding is validated by a human.

Convergent's offensive security work stays human-led, and Sanctum is where testers' findings are stored, triaged and proven closed. In assessments, Sanctum Advise flags responses that deserve a closer look and routes each one to a human assessor for approval, while Sanctum Assist drafts and QCs reports. Analysts act instead of assembling. Sanctum Advise encodes two decades of Convergent assessment and offensive security experience into repeatable software.

Most organisations buy a separate tool for each security job. Sanctum covers the same ground in one platform, with one live risk score instead of separate logins and reports.

Across ten capability areas, Sanctum provides full coverage on one platform. Typical point-in-time tool stacks compare as follows:

• Partial, or needs a separate vendor: third-party and vendor risk; offensive security (penetration testing and vulnerability assessment); dark web and leak monitoring; MDR/EDR alerting; tabletop and BCP/DR exercises; governance and compliance mapping.
• Not typically offered: chain-of-custody protection, personnel vetting, AI-correlated risk scoring and a unified single platform.

The difference is not the ground covered but how it is delivered: stitched across separate vendors, logins and reports, or brought together in one live risk score.

It means protecting your content at every stage, from script to final release, and proving that every vendor that handles it can be trusted.

Sanctum watches your assets in motion and monitors the dark web for leaks, while its vendor risk and compliance modules prove trust across the supply chain. All of this is constantly mapped to industry requirements as they evolve. In practice, S2S protection combines Sanctum. Media Guard (Trace chain-of-custody monitoring, Threat Detection endpoint alerting and Leak Monitoring) with Sanctum. Core (vendor assessment and risk scoring), so a content owner can see both where an asset is and how trustworthy each vendor handling it is.

It means keeping watch over your security all the time, instead of checking it once a year, so problems are spotted and fixed while they are still small.

Continuous security monitoring replaces the single annual snapshot with an ongoing view of your security posture. That view covers vulnerabilities across your infrastructure, alerts from your endpoint detection tools, leaked credentials and lookalike domains on the dark web, and how sensitive files move between organisations. When each of these signals is correlated against your assessment results, the risk picture stays current and remediation can be prioritised on what is actually happening now.

An annual assessment or penetration test shows how secure you were on the day it happened. Continuous monitoring shows how secure you are today.

Systems, vendors and workflows change every week, and emerging technology widens the attack surface between scheduled reviews. Point-in-time assessments and human-led testing remain a vital part of the answer, but they need to be combined with secure configuration management and constant monitoring. Sanctum is built to do both. Assessments set the baseline, and continuous vulnerability management, endpoint threat detection, chain-of-custody tracking and dark web monitoring keep that baseline accurate between cycles.

Pre-release content passes through many hands, and every hand-off is a chance for a leak. Continuous monitoring gives early warning across the whole chain, not just inside your own network.

Dailies, cuts and key art move constantly between studios, VFX houses, post-production and localisation vendors. By the time pirated content appears on a forum or torrent site, the damage to a release window is usually done. A vendor that passed its assessment last year may have a new exposure today. Much can be done to reduce the impact by combining aggregated log information with enriched metadata and turning it into actionable intelligence for incident response. That is the gap continuous monitoring closes.

The pressure is growing. In many programs the interval between assessments has stretched from annual to every two years, and with budget, time and resource under pressure, remediation between assessments is often not prioritised. Today's complex workflows do not lend themselves to traditional assessment methods without the support of technology, and that technology needs to be affordable at scale, including for smaller vendors.

Security risk is growing faster than most teams can hire for. Continuous monitoring on one platform closes the gap without a multi-year build-out.

Vendor risk, compliance pressure and attack surface are expanding every year through vendor sprawl, cloud adoption and remote work, while security headcount and budget are not. The gap shows up in three places:

• Specialist capacity: penetration testing, cloud security, GRC, remediation and advisory skills are costly to hire and hard to keep fully used in-house.
• Delivery variance: every new requirement creates more custom workflows, handoffs and non-standard effort, the opposite of a repeatable program.
• Coverage gaps: more systems and vendors can mean more blind spots instead of more confidence, if nothing ties the picture together.

Sanctum ties the picture together, and Convergent provides the specialist capacity on top.

‍

Sanctum has four product suites, which we call windows: Core, Test, Media Guard and IR. Between them they contain 12 modules, and they all report into one dashboard.

• Sanctum. Core (5 modules): Vendor Assessment & Risk Management, Sanctum Advise, Sanctum Assist, Atrium and Vetting.
• Sanctum. Test (2 modules): Vulnerability Management and Penetration Testing.
• Sanctum. Media Guard (3 modules): Threat Detection, Trace and Leak Monitoring.
• Sanctum. IR (2 modules): Tabletop Exercises and Response.

Every module shares the same data model, the same AI-augmented Risk Correlation Engine and the same consent-based sharing, so a finding in one window is visible in the context of all the others. Some Convergent materials use earlier module names: VA Scanning (Vulnerability Management), Monitor or EDR (Threat Detection), MediaGuard (Trace), Dark Web Monitoring (Leak Monitoring) and Cyber-CPR (Response).

Sanctum. Core is the foundation of the platform. It assesses how secure your vendors are, scores their risk and helps you prepare for compliance.

Core provides AI-augmented assurance, workflow and risk management tools within a Unified Control Framework mapped to current stakeholder (TPN and studio) requirements and to the Secure Controls Framework (SCF). That includes questionnaire-driven vendor and third-party risk assessment, AI-assisted advisory review and the internal compliance-readiness tooling stakeholders use every day. It contains five modules: Vendor Assessment & Risk Management, Sanctum Advise, Sanctum Assist, Atrium and Vetting. Every other Sanctum module builds on Core's risk scoring, and Core is where most organisations start.

Sanctum. Test checks your systems for weaknesses on a continuous basis, rather than once a year.

Test moves past the annual, point-in-time check box toward orchestrated testing that keeps pace with a changing attack surface. It provides AI-augmented vulnerability management and penetration testing, available periodically or continuously, through two modules: Vulnerability Management and Penetration Testing. Every finding is tracked through remediation and reported into Core's risk correlation engine.

‍

Sanctum. Media Guard protects your content. It tracks where your files go, watches for suspicious activity on devices, and looks for leaks on the dark web.

Media Guard provides content protection for media assets, on the network and off it. It combines agent-based secure configuration monitoring and endpoint detection and alerting with chain-of-custody file monitoring and dark web and asset exposure tracking, all correlated into one risk dashboard. It contains three modules: Threat Detection (real-time MDR/EDR alerting across your endpoint stack), Trace (chain-of-custody monitoring for pre-release assets) and Leak Monitoring (continuous dark web credential-exposure monitoring). Chain-of-custody and monitoring services run 24/7/365.

‍

Sanctum. IR helps you prepare for a security incident and respond when one happens.

IR carries a team from readiness drill to active incident response and recovery. It contains two modules: Tabletop Exercises, which are AI-driven rehearsals of incident response, business continuity and disaster recovery plans, and Response, client-facing incident case management. Response is currently in development.

‍

It gives your vendors a structured security questionnaire and turns their answers into a risk score you can track on one dashboard.

This Sanctum. Core module provides:

• AI-augmented mapping to the Unified Control Framework, allowing a single assessment, report and remediation plan that meets each stakeholder's specific requirements.
• A stakeholder-driven questionnaire database, with composite risk scoring from the AI correlated-risk engine, shown in a configurable risk dashboard.
• An AI-augmented workflow builder to document and track changes to ongoing workflows and the technologies in use.

The module includes Sanctum Advise, Sanctum Assist and Atrium, and it is where most accounts start.

Sanctum Advise is an AI reviewer. It reads vendor answers, points out anything that needs a closer look, and passes it to a human expert to decide.

This Sanctum. Core module provides AI-powered assessment review that automatically flags vendor responses warranting a closer look, with its reasoning and supporting file notes. It then routes each item to a human assessor for validation and approval. Sanctum Advise productises consultancy-grade guidance, encoding two decades of Convergent assessment and offensive security experience. It is included within Vendor Assessment & Risk Management.

Sanctum Assist is the AI helper built into the platform. It spots patterns from past assessments and drafts reports, so your team edits rather than writes from scratch.

This Sanctum. Core module is the AI layer woven across the platform. It analyses assessment responses, surfaces historical findings and drafts and QCs reports, so analysts can act instead of assemble. Output is always validated by a human. Sanctum Assist is included within Vendor Assessment & Risk Management.

It regularly scans your systems for known weaknesses, reports what it finds and tracks each one until it is fixed.

This Sanctum. Test module provides AI-augmented vulnerability assessment scanning with managed scan orchestration, triaged findings and host-level reporting. Remediation is tracked in real time and reported to Core's risk correlation engine, so each finding stays visible until it is proven closed. Scanning can run periodically or continuously. For TPN and studio-sponsored or referred vendors, scanning is available at a discounted partner rate, and results can be shared with studios through the consent model.

Expert testers try to break into your systems the way an attacker would, so you can fix weaknesses first. Sanctum manages each test from start to finish, and testing can be repeated as often as your systems change.

This Sanctum. Test module covers internal, external and application penetration testing engagements, plus code review, with end-to-end engagement management. Testing can be periodic or constantly updated as technology and workflows change, going beyond the annual penetration test according to stakeholder requirements or the client's preferred option. Findings are reported within Vendor Assessment & Risk Management and feed the unified risk view. Testing is human-led by Convergent's offensive security team.

Threat Detection connects to the security software already running on your computers and servers, and brings its alerts into Sanctum so they become part of your overall risk picture.

This Sanctum. Media Guard module provides continuous MDR/EDR alerting. It connects your endpoint-detection stack (CrowdStrike, SentinelOne, Microsoft Defender, Sophos, Huntress and Cortex XDR), auto-tracks alerts as remediations and feeds them into the risk correlation engine in real time. Threat Detection does not replace your EDR or MDR tooling; it adds that telemetry to your wider risk view.

Trace keeps track of your pre-release files as they move between vendors, so you know where they are and who has handled them.

This Sanctum. Media Guard module protects media assets using their associated metadata. A deployed agent monitors each file's chain of custody, recording the originating hash and tracking new versions as new content is created. Trace is available as a studio-managed service covering unlimited assets, or as a platform license with vendors onboarded individually. Combined with Threat Detection and Leak Monitoring, it gives you the chance to catch a leak before it reaches a forum or torrent site.

It searches the dark web for your leaked passwords and content, and for fake websites pretending to be your brand.

This Sanctum. Media Guard module provides continuous dark web credential-exposure monitoring, covering credential leaks in clear text and hashes for validation. It also monitors for lookalike and typosquatted domains impersonating your brand, checking MX records, DNS registration dates and DKIM, SPF and DMARC configuration. Using AI, live signals are fed into the platform for triage, and dark web chatter is cross-referenced to flag threats before they are weaponised. Every match is verified and risk-ranked, so your team acts on confirmed threats instead of chasing noise. The studio license covers 2,000 domains a month and can be extended in 2,000-domain bundles.

They are guided practice runs of a security incident, so your team can rehearse its response plan and find the weak spots before a real incident happens.

This Sanctum. IR module provides AI-driven incident response, business continuity and disaster recovery tabletop exercises, with live scenario generation, live facilitation and after-action reporting. Scenarios are built on the client's own policies and workflows stored in Atrium, and the exercise responds to the choices made as it runs, which makes it more realistic and shows where plans can improve. Three delivery options are available:

• Third-party self-service.
• Remote, supported by Convergent.
• Onsite, supported by Convergent.

Tabletop Exercises can also be white-labelled.

Atrium is a shared online library of security policies, guides and evidence that your team and vendors can use.

This Sanctum. Core module is a functional online internal and collective information repository, with example hardening guides, policies and guidelines. It also acts as the client's data repository for supporting evidence and useful materials, and stores the policies and workflows that Tabletop Exercise scenarios are built on. Training and awareness platform, covering cyber security and content security that is available through a partnership with OOONA, will be added and made available through Atrium and relevant for Vendor Assessments & Risk Management.

Vetting runs background checks on the people who will have access to your content, in line with studio requirements.

This Sanctum. Core module provides personnel background screening that complies with studio requirements. It is available globally, subject to local legal restrictions, and can be white-labelled. There are three tiers:

• Basic: identity verification and right to work (TPN-compliant).
• Standard: Basic plus up to three references.
• Enhanced: Standard plus a criminal background check.

Vetting data follows the same consent model as vendor data.

Response is Sanctum's incident case-management tool, which helps your team and Convergent work together during a live security incident. It is currently in development.

This Sanctum. IR module provides client-facing incident-response case management. It covers the full incident lifecycle, evidence and observable tracking, playbook-driven response workflows, and team-scoped case isolation with a need-to-know facility for real-time IR collaboration. Response, formerly Cyber-CPR, is in development. Pricing will be confirmed on release.

Sanctum checks everything against one set of security controls that is mapped to the industry standards you need to meet, so you don't have to collect the same evidence again for each client.

For media and entertainment, Sanctum uses an AI-augmented Unified Control Framework (UCF), independently mapped to MPA Content Security Best Practices, TPN and studio-specific requirements, and constantly updated as those requirements evolve. The UCF is also mapped to security industry standards through the Secure Controls Framework (SCF), which programs such as NCBA Committed to Security tailor to their own industry. Sanctum also supports ISO, NIST and SOC 2 readiness work.

The owner of the data does. Nothing is shared with anyone unless the owner agrees, and they can withdraw access at any time.

Sanctum is multi-tenant by design. Data can be owned by stakeholders, vendors or both, and each owner grants access on their own terms. Access is permission-based within the platform:

• Owner-granted access: sharing is explicit and revocable, never automatic.
• Scoped visibility: stakeholders see only what has been shared with them. Studios see their vendors, and vendors see only their own data.
• Assess once, share many: one assessment, with controlled distribution to many stakeholders.

All sharing remains subject to the relevant legal, contractual and regulatory requirements.

A vendor completes one assessment and can then share the result with every client that asks, instead of filling in a new questionnaire for each one.

Through the consent model, one vendor assessment can be shared with every studio or stakeholder that needs it, instead of each one recollecting the same vendor data from scratch. This reduces assessment fatigue for vendors and gives stakeholders like-for-like comparison across their whole portfolio. Continuous monitoring keeps the shared report current between assessment cycles.

‍

Sanctum combines everything it knows about a vendor or client into one score out of 100, weighting each source of evidence by how much it really tells you about risk. The score updates on its own as new results come in.

Every module feeds the same AI-augmented Risk Correlation Engine. The composite score blends assessment results with remediation posture, vulnerability scan coverage, dark web exposure, threat detection and more, each weighted by its significance rather than given an equal, arbitrary share. In a typical profile, for example, the assessment carries 35%, remediation 20% and VA scans 15%.

• Live and automatic: the score recalculates as new findings, remediations and scans come in, so no analyst hours are spent maintaining a spreadsheet.
• Honest about coverage: a module that has not been activated shows as "No data" or "Coming soon", not a false zero, so the score never overstates coverage you have not turned on.
• Actionable: every finding has an owner and is tracked to closure, and the weighted breakdown shows exactly what is pulling the score down.

Because one good test result is not the whole picture. If open remediation items or gaps in scanning remain, the composite score reflects that.

A single assessment is a point-in-time view. In one real Sanctum vendor profile, the latest assessment scored 100/100 ("Low Risk"), but the vendor's composite score was 70.1/100 ("Medium"), because remediation posture and scan coverage pulled the real picture down. A perfect result on its own cannot push the overall score higher than the rest of the evidence supports. That is the point of continuous, composite scoring: nobody can hide behind a single good result.

One place to see your risk, compliance and progress in real time: what was found, what has been fixed, what remains and who owns it.

Sanctum moves risk, compliance, workflow and remediation out of ad hoc spreadsheets and into an ongoing operating process:

• Risk: assess, prioritise and communicate the issues that matter.
• Compliance: track requirements, evidence and readiness activity.
• Workflow: create repeatable ownership, follow-up and approval processes.
• Remediation: track findings to action, validation and closure.

This makes quarterly business reviews and board updates straightforward. Instead of rebuilding the picture from scratch for every audit, you can show what was found, what was fixed, what remains, who owns it and how your security posture is changing.

Sanctum is built to connect. It can send findings and risk data to the tools you already use, such as ticketing, chat and CRM systems.

Sanctum is built on a REST API, so assessments, findings, scans and risk data never stay locked in:

• REST API and exports: a token-authenticated REST API; assessment, scan and dark web exports; report and findings export (PDF or CSV); and activity and performance data endpoints.
• Native connectors: webhooks to push events out, Slack notifications, Jira (findings to tickets), and MDR/EDR connectors for CrowdStrike, SentinelOne, Defender, Sophos, Huntress and Cortex XDR.
• CRM and GRC via API: push risk and vendor status to Salesforce, ServiceNow or other GRC tools, data warehouse and BI feeds, or middleware such as Zapier and Workato.

Salesforce and most CRM and GRC targets connect through the API, webhooks or an iPaaS layer, not through a one-click native connector.

No. Every Convergent service works on its own. Sanctum is the recommended way to run it at scale, and you can switch between the two at any time.

There are two ways to engage, with the same specialists either way:

• Convergent only: project-based work such as a penetration test, VA scan or assessment, with findings delivered as a report and readout. You track remediation and evidence yourself. This suits a one-time test or a single review.
• Convergent + Sanctum (recommended): the same delivery plus a live platform. Every finding feeds one real-time risk score, ownership and remediation are tracked to closure, and one dashboard shows compliance and progress. This suits ongoing risk or compliance work.

You can move between the two models at any time, with no migration needed.

Sanctum is one flat annual platform fee, sized to your environment, not priced per tool or per seat. Specialist work such as penetration testing is quoted separately.

The platform fee covers a core bundle of capabilities, including EDR integration, Sanctum Advise and Assist, dark web monitoring, unlimited VA scanning and the Atrium repository. Penetration testing, fractional CISO and other specialist engagements are scoped and quoted per engagement, the same way they would be alongside any point solution. For studios managing a supply chain, the Core enterprise license covers an unlimited number of vendors, and vendor-side services such as scanning, vetting and tabletop exercises are available at discounted TPN and studio-sponsored rates. For a quote, contact info@convergentds.com.

Add up what you already pay for separate security tools and services, and compare it with one flat Sanctum platform fee. Convergent can help you build the comparison.

The ROI has two halves:

• Cost: most programs run separate tools for vendor risk, testing, monitoring and compliance, each covering one slice of the picture. The Sanctum ROI Worksheet maps your current stack and annual cost against each capability, next to one flat platform fee. Send it back and Convergent will size the real comparison for your environment.
• Risk maturity: a composite score that recalculates automatically removes analyst hours spent maintaining spreadsheets, and stops a single clean report from hiding real risk. Ask to see a live risk profile for your own environment.

Yes. Sanctum is designed to give smaller organisations access to the same security tools as large studios, at a cost that fits their size.

Security technology can be expensive to deploy, so Sanctum provides affordable access at scale. Studios can sponsor or refer their vendors, and discounted TPN and studio-sponsored rates are available for scanning, vetting and tabletop exercises. Tabletop Exercises can be run self-service. Assess once, share many means a smaller vendor completes one assessment and shares it with every client, instead of paying for repeated assessments.

Book a demo. We then set up a proof of concept so you can try Sanctum with your own vendors before you commit.

The typical path is: detailed demonstration, proof of concept with enterprise access, sample study, feedback, maturity and deployment. Sanctum. Core is the usual starting point, and the Test, Media Guard and IR suites are added as your needs grow. We are happy to discuss your exact requirements. Book a walkthrough at convergentds.com/book-a-meeting or email info@convergentds.com.

Yes. Service providers can run their security practice on Sanctum, under their own brand, instead of stitching together a dozen separate tools.

For MSPs, MSSPs and security practices, Sanctum is the operating layer underneath the work they deliver to their own clients. Partners do not have to build:

• A correlation engine: assessments, remediation status, scans, dark web exposure and threat detection are already weighted into one live score per client.
• A workflow layer: ownership, evidence and remediation tracking are standardised across every module, so a new client engagement doesn't mean inventing a new process.
• New tooling to grow coverage: modules a client hasn't activated show as "no data", so coverage can be phased in as accounts grow, on the same dashboard.

Every client-facing surface can carry the partner's brand, and one partner account can run any number of independent client programs. Partners can deliver project-based engagements or run Sanctum as a live platform and move between the two at any time. Platform pricing scales with the number of clients, and partners earn a margin on Convergent-delivered add-on services such as penetration testing. Convergent runs a tiered partner program (Registered, Certified and Strategic).

Yes. Existing data can be brought across, with the right approvals.

Existing Convergent scanning clients can move to the TPN partner instance, with the necessary approvals and consent. Data from other platforms can be brought in through Sanctum's REST API and the optional data-integration service, which is scoped for each ingest source.

‍