Skip to main content
Xoxoday Empuls maintains a formal, continuous risk analysis process that includes quarterly internal vulnerability scans, annual third-party penetration tests, and structured remediation timelines tied directly to threat severity.
Xoxoday Empuls operates a formal, continuous risk analysis process designed to keep management informed about evolving security threats and vulnerabilities across the platform. This is not a periodic checkbox exercise — it is an ongoing programme embedded into the day-to-day security operations of the engineering and security teams. Continuous Threat Intelligence The Xoxoday Empuls security team actively monitors vendor advisories, CERT alerts, and industry vulnerability databases to stay ahead of emerging threats. New findings are evaluated for relevance to the Xoxoday Empuls production environment and immediately feed into the Threat and Vulnerability Management procedure. This keeps the risk register current rather than relying on point-in-time assessments alone. Structured Scanning and Penetration Testing Internal vulnerability scans run at least quarterly across all production environments. External penetration tests are conducted at least annually by independent third parties, with additional assessments triggered following security incidents or significant platform changes. This cadence aligns with the technical controls required under ISO 27001 and SOC 2 Type II — both of which Xoxoday Empuls maintains — providing independently verified assurance to enterprise customers. Risk-Based Remediation Timelines Every identified vulnerability is logged, assessed for risk and business impact, and assigned a remediation path — patching, configuration hardening, or compensating controls. Timelines are defined by severity: critical vulnerabilities require immediate remediation, while high-severity findings are resolved within 30 days. This structured approach ensures that no identified risk is left untracked or deprioritised without a documented rationale. Governance and Executive Reporting Results from vulnerability scans and penetration tests feed directly into Xoxoday Empuls’s central risk management process. Summary reports are provided to the CTO and senior management, giving leadership a continuous view of the platform’s security posture. For enterprise customers integrating Xoxoday Empuls with HR systems such as Workday, SAP SuccessFactors, or Darwinbox, this governance structure provides assurance that platform-level security risks are being actively managed and escalated at the appropriate level. This end-to-end process — from threat intelligence through to executive reporting — means that security threats and vulnerabilities are continuously identified, prioritised, and addressed within defined timelines, not left to accumulate between annual reviews. Learn more: [Xoxoday Empuls Help Centre — 8. IT RISK ASSESSMENT](

Does Xoxoday Empuls have a 24x7 security incident response team?

Learn how Xoxoday Empuls detects, escalates, and resolves security incidents with defined response procedures and stakeholder communication protocols.

Does Xoxoday Empuls encrypt data in transit and at rest?

Understand how Xoxoday Empuls protects data at rest and in transit using industry-standard encryption controls across all production environments.