Seven Virto components for SharePoint Server, attacked on purpose by NATO’s own security testers.
The NATO Cyber Security Centre (NCSC) has penetration-tested seven Virto components for SharePoint Server. Virto Kanban Board Web Part was the first, in March 2024; most of the others followed in spring 2026. VirtoSoftware holds the NCSC disclosure report for each test, and every finding has been fixed.
What NATO tested
| Component | Version tested | Where to find it today |
|---|---|---|
| Virto Kanban Board Web Part | 5.3.3 | Virto Kanban Board Web Part |
| Virto Calendar Web Part | 9.1.7 | Virto Calendar Web Part |
| Virto Notifications & Alerts Web Part | 5.1.20 | Virto Notifications & Alerts Web Part |
| Virto Bulk File Download | 5.4.4 | Part of Virto Multiple File Operations |
| Virto Workflow Status Monitor | 3.1.11 | Part of Virto Workflow Automation |
| Virto Tab Navigation | 2.1.3 | Virto Tab Navigation |
| Cross-Site Lookup Selector | 3.1.5 | Part of Virto Cascade Lookup Web Part |
All seven are on-premises products: they install on your own SharePoint Server farm. The Virto apps for Microsoft 365 and Teams were not part of these tests.
What a penetration test is
In a penetration test, security specialists attack the software on purpose, the way an intruder would, to find weaknesses before anyone else does. What they find goes to the vendor in a report, so that it can be fixed. A test is not a certification: it tells you that experts looked hard at a specific version, and what they found there.
What the tests found and what we fixed
Every finding from the seven tests has been fixed. The 2024 test of Kanban Board found one vulnerability, CVE-2024-34400. We fixed it within 7 business days, and the fix shipped in Kanban Board 5.3.5. The findings of the Tab Navigation test of 18 May 2026 were fixed in Tab Navigation 2.1.5 in June 2026.
What it means for your security review
When a security or procurement team reviews software for SharePoint Server, one of the first questions is who, besides the vendor, has tested it. For these seven components the answer is NATO’s own cyber security centre.
The rest of what a reviewer needs — where your data is, which certifications we hold and which we do not, the licence terms, and how to request our documents — is on our Security & Compliance page.
