SpartanX can enforce your organization's own security policies during engagements — not just industry standards and CVEs. By importing your corporate policy documents, you can detect when implementations deviate from your stated standards, creating a direct link between policy documentation and real-world security testing.
What Are Policies in SpartanX?
Most organizations maintain security and compliance policies — cryptography policies, acceptable use policies, key rotation schedules, and others — stored in shared drives or document repositories. In practice, these policies are frequently not followed in code or infrastructure configuration.
SpartanX's Policies feature imports these documents and uses them as a reference during engagements. When a policy violation is detected — for example, a key that hasn't been rotated per the stated schedule — SpartanX flags it alongside security vulnerabilities.
Connecting Google Drive and Importing Policies
SpartanX reads policy documents from Google Drive. To set this up:
Go to Integrations and connect your corporate Google Drive account (the connection is read-only)
Navigate to the Policies section
Select "Add Policy" and choose the relevant documents from Google Drive
Set the access level — typically "Everyone" for organization-wide policies
Import the documents into SpartanX
Once imported, policies appear in the SpartanX policy library and are active for all subsequent engagements.
Keeping Policies Current
Policies evolve over time. An AI policy that didn't exist three years ago may now be a core organizational requirement. SpartanX supports policy re-syncing — you can refresh imported policies at any time to pick up changes made in the source Google Drive documents.
Examples of policies that benefit from this feature:
Cryptography policy — e.g., "All keys must be rotated every 90 days" or "SHA-256 is the minimum acceptable hashing algorithm"
AI usage policy — governing how AI systems are developed and deployed
Data retention and access control policies
Policy Violations vs. Vulnerabilities
Policy violations are distinct from security vulnerabilities. A violation indicates that an implementation doesn't conform to an internally stated standard — even if it isn't directly exploitable as a security flaw. Examples:
A key has not been rotated in 180 days, violating a 90-day rotation policy
SHA-128 is detected in use, violating a SHA-256 minimum standard
These findings appear in engagement results alongside traditional vulnerabilities, giving security and compliance teams a complete picture of both technical risk and policy adherence.
What's Next
The next section covers how to upload mobile application binaries — APK and IPA files — into SpartanX for mobile security testing.