SAMPLE FINDINGS REPORT

Company A — Adversarial Verification

This is an anonymized, representative output of the VerityHelm engine, produced using Methodology v1.0. Company identity has been redacted. All findings are factual observations derived from public signals.

Disclaimer: VerityHelm produces findings, not opinions. This report does not constitute a security assessment, legal opinion, or audit attestation. See Methodology v1.0 for data sources, limitations, and scoring logic.

1. Subject

Vendor
Company A (private SaaS — mid-market collaboration platform)
Ticker
Not publicly traded
Report Type
Adversarial Verification — Public Signals Only
Methodology Version
v1.0
Audit Firm Identified
Not publicly disclosed
Certifications Claimed
SOC 2 Type 2, ISO 27001, ISO 27701, ISO 27017, ISO 27018, HIPAA, PCI DSS (Merchant Level 2), plus two region-specific attestations

2. Methodology Disclosure

This analysis uses VerityHelm Methodology v1.0. The following public signal sources were queried. No confidential documents were accessed; no private systems were probed.

  • SEC/EDGAR full-text search (N/A — private company)
  • Certificate Transparency logs (crt.sh)
  • GitHub Security Advisories
  • Internet Archive Wayback Machine
  • CourtListener / RECAP federal court records
  • Vendor security page (public)
  • Vendor trust center (third-party hosted)
  • Vendor engineering blog

Known limitations: Public-signal analysis only. Private companies produce a reduced signal profile. Pattern matching uses deterministic rules and can produce false positives. See Methodology §6.1.

3. Findings

Gap Severity: Medium

SOC 2 Audit Firm Not Publicly Disclosed

Company A's trust center and security pages describe certifications but do not name the SOC 2 audit firm. Customers must request the identity directly to verify auditor quality.

Context: Audit-firm non-disclosure is common industry practice and is not inherently problematic. However, it prevents independent verification of the auditor's AICPA peer review standing without vendor cooperation.

Source
Trust center + security page analysis
Retrieved
2026-04-06
Method
Methodology v1.0 — Claim Extraction (§3)
Informational Severity: Low

Third-Party Trust Center Platform

Company A hosts its trust center on a third-party compliance platform. This is standard practice. The platform choice is not itself a compliance signal; the existence of a structured, externally-accessible trust center is a positive transparency indicator.

Source
Trust center URL + platform fingerprinting
Retrieved
2026-04-06
Method
Methodology v1.0 — Signal Collection (§2)
Positive Signal Severity: Low

Comprehensive International Certification Portfolio

Company A claims nine certifications, including two region-specific attestations targeting European and Asian enterprise markets. The breadth of ISO certifications (four distinct standards) exceeds what is typical for companies of this size.

Context: Breadth of certification does not guarantee depth of control implementation, but it demonstrates sustained compliance investment and intentional market expansion.

Source
Security page + compliance announcements (blog)
Retrieved
2026-04-06
Method
Methodology v1.0 — Signal Collection (§2)
Gap Severity: Medium

Reduced Public-Signal Coverage (Private Company)

As a private company, Company A has structurally reduced signal availability: no SEC filings, no public financial disclosures, no PCAOB cross-reference, limited court-record visibility. The engine accurately identifies this as a known limitation (Methodology §6.1).

Recommended action: For private companies, direct vendor engagement (report request, security questionnaire) is more critical than for public companies. VerityHelm's value in this profile is trust-page analysis plus cross-reference against the signals that exist.

Source
Pipeline coverage assessment
Retrieved
2026-04-06
Method
Methodology v1.0 — Known Limitations (§6.1)
Informational Severity: Low

Bug Bounty Program Referenced But Metrics Not Published

Company A's security page references a bug bounty program, but aggregate metrics (payouts, report volume, response SLAs) are not published. This contrasts with peer vendors that publish annual disclosure reports.

Context: The existence of a program is a positive signal. The absence of published metrics is common for private companies and does not indicate a problem, but it reduces independent visibility into vulnerability-management maturity.

Source
Security page review
Retrieved
2026-04-06
Method
Methodology v1.0 — Signal Collection (§2)
Positive Signal Severity: Low

Enterprise Security Features Indicate Maturity

Company A publishes workspace-wide audit logs, pre-built SIEM/DLP integrations (enterprise tier only), encryption at rest and in transit, and documented least-privilege access controls. Feature presence is consistent with the SOC 2 monitoring control claims.

Source
Security page + help center articles
Retrieved
2026-04-06
Method
Methodology v1.0 — Cross-Reference (§4)

4. Questions to Ask the Vendor

  1. Which CPA firm performed your most recent SOC 2 audit, and what was the audit period?
  2. Is your SOC 2 audit firm enrolled in the AICPA Peer Review Program?
  3. How many security incidents occurred during your most recent audit period?
  4. Which compliance platform do you use for evidence collection, and did that platform facilitate the audit engagement?
  5. Your region-specific certifications suggest international expansion. Are these maintained by your SOC 2 audit firm, or separate regional auditors?
  6. What is the exact scope of your HIPAA BAA — does it cover all product tiers or specific plans only?
  7. Would you share aggregate bug bounty statistics (reports received, payouts, median response time)?

5. Signal Freshness

SourceLast QueriedData Available
SEC/EDGAR2026-04-06N/A — private company
Certificate Transparency (crt.sh)2026-04-06Yes
GitHub Security Advisories2026-04-06Yes
Internet Archive Wayback2026-04-06Yes
CourtListener / RECAP2026-04-06Queried
Vendor security page2026-04-06Yes
Vendor trust center2026-04-06Yes
Vendor engineering blog2026-04-06Yes

6. Analysis Summary

  • Total findings: 6
  • Contradictions: 0
  • Gaps identified: 2 (audit-firm non-disclosure, reduced public-signal coverage)
  • Observations: 4 (including 2 positive signals)
  • Patterns checked: 5 automated + manual enrichment
  • Signals correlated: 8

Factual summary (not opinion): Company A presents a solid compliance signal profile for a private SaaS company. No contradictions between public signals and the claims on its trust center were identified. The primary observations are structural — limited financial transparency, non-disclosure of audit firm — and are consistent with industry norms for private-company disclosure. For procurement teams: this vendor's claims appear internally consistent but cannot be fully independently verified without direct engagement (questions 1, 4, and 7 above are the most critical).