How Often Does Xoxoday Conduct Penetration Testing?

​

Penetration Testing at Xoxoday

Xoxoday follows a comprehensive penetration testing protocol designed to proactively identify and remediate security vulnerabilities before they can be exploited. Testing is conducted on an annual basis and covers Xoxoday’s full infrastructure stack, including networks, web applications, and APIs. Both Xoxoday’s internal security team and independent third-party cybersecurity firms participate in this process, providing rigorous and unbiased assessment of the platform’s security posture.

​

What Each Assessment Covers

Each penetration test simulates real-world attack scenarios to surface vulnerabilities that automated scanners alone might miss. Xoxoday’s assessments include testing for SQL injection, cross-site scripting (XSS), privilege escalation, authentication bypass, and other OWASP Top 10 vulnerability classes. By replicating techniques used by actual threat actors, Xoxoday validates the effectiveness of its security controls under realistic conditions — not just in theory.

​

How Vulnerabilities Are Remediated

When vulnerabilities are identified, Xoxoday prioritises them by severity using a risk-based approach. Critical and high-severity findings are addressed immediately through targeted patches, security updates, and system hardening. Lower-severity issues are tracked and resolved within defined remediation windows, with closure reviewed by Xoxoday’s security team before sign-off.

​

Ad-Hoc Testing After Major Changes

Beyond the annual schedule, Xoxoday conducts ad-hoc penetration tests whenever significant changes are introduced to the platform. This includes major feature releases, architectural updates, or the addition of new enterprise integrations — for example, when connectors are introduced for HRMS platforms such as SAP SuccessFactors, Darwinbox, or Workday, or when collaboration integrations like Slack and Microsoft Teams are modified. This approach ensures that each change cycle does not inadvertently introduce new attack surfaces.

​

Alignment with ISO 27001 and SOC 2 Type II

Xoxoday’s penetration testing programme aligns with the requirements of internationally recognised security frameworks, including ISO 27001 and SOC 2 Type II. Both standards require organisations to regularly assess security controls through technical testing, and Xoxoday’s annual and event-driven testing cadence satisfies these obligations. Results and remediation actions are documented and available to enterprise customers during security review processes.

​

Continuous Security Validation

By combining scheduled annual assessments with responsive ad-hoc testing, Xoxoday maintains a continuously validated security posture. This dual-cadence approach ensures that both evolving attack techniques and platform changes are assessed systematically, giving your organisation confidence in the resilience of Xoxoday’s security infrastructure. Learn more: Xoxoday Help Centre — Security