Frequently asked questions
A control is a security policy or requirement your team enforces — for example, "All production databases must be encrypted at rest." In Whistic, you create a control with a title and summary, assign an owner, and attach tests to verify it.
A test defines how to verify a specific control. You specify instructions, pass/fail criteria, and test type (manual upload or browser agent). Each test run creates a permanent, timestamped record with evidence.
Manual tests require a user to follow the steps and upload evidence themselves. Browser Agent tests use AI to navigate to a URL, follow instructions, and capture a screenshot automatically. The user then reviews the result and marks pass or fail.
Yes — you set a recurrence cadence (e.g., every 12 months) when creating the test. The system tracks the next due date. The system tracks the next due dates and controls can be sorted by due date on the controls page.
Every test run creates a permanent, timestamped record with the result, any uploaded files or screenshots, and notes. Full test history is viewable per control at any time.
Yes — use the pencil icon on a test result to override or supplement the AI-generated explanation with your own notes.
Yes — use the Actions dropdown to export controls and test history.
Credentials are encrypted at rest using the same standards Whistic uses for all sensitive data. They are scoped to specific domains and subdomains — they cannot be passed to sites outside that scope. Raw credential values are never exposed in logs, test definitions, or exports.
We currently support username/password login only. Sites requiring multi-factor authentication cannot be automated at this point.
Password manager integration is not supported at launch and may be considered for a future release.
The agent is best-effort. If it cannot navigate to the right place or the screenshot does not meet your criteria, mark the test as fail and add a note. You may need to update the instructions or URL.
The scheduled test will run and log a failure. That failure is your signal to review and update the URL or instructions.
It can be used to track controls relevant to any framework — SOC 2, ISO 27001, HIPAA, etc. V1 is a starting point for building and verifying your controls library. Framework auto-mapping (e.g., automatically linking controls to SOC 2 criteria) is planned for V2.
If controls are deleted, tests and history associated with them will be deleted.
