<?xml version="1.0" encoding="UTF-8"?>
<!--
  Every URL here is verified to return 200. A sitemap that advertises 404s burns
  crawl budget and reports as errors in Search Console. The three WordPress-era
  posts previously listed went away with the retired product; the four current
  articles were live but were missing from this file.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>https://vulnytics.com/</loc>
    <lastmod>2026-07-26</lastmod>
    <changefreq>weekly</changefreq>
    <priority>1.0</priority>
  </url>

  <!-- Blog: the acquisition surface. Each post answers a question a founder
       actually types while an enterprise security review is on their desk. -->
  <url>
    <loc>https://vulnytics.com/sample-report.html</loc>
    <lastmod>2026-07-26</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.7</priority>
  </url>
  <url>
    <loc>https://vulnytics.com/blog/</loc>
    <lastmod>2026-07-26</lastmod>
    <changefreq>weekly</changefreq>
    <priority>0.7</priority>
  </url>
  <url>
    <loc>https://vulnytics.com/blog/security-review-approved-with-conditions.html</loc>
    <lastmod>2026-07-26</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://vulnytics.com/blog/dpa-subprocessors-retention-security-review.html</loc>
    <lastmod>2026-07-26</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://vulnytics.com/blog/trust-page-for-saas-startups.html</loc>
    <lastmod>2026-07-26</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://vulnytics.com/blog/enterprise-vendor-security-review.html</loc>
    <lastmod>2026-07-26</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://vulnytics.com/blog/security-attestation-letter.html</loc>
    <lastmod>2026-07-26</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://vulnytics.com/blog/do-you-need-soc2-to-sell-to-enterprise.html</loc>
    <lastmod>2026-07-26</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://vulnytics.com/blog/how-to-pass-a-security-questionnaire.html</loc>
    <lastmod>2026-07-26</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://vulnytics.com/blog/penetration-test-cost-for-startups.html</loc>
    <lastmod>2026-07-26</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://vulnytics.com/blog/soc2-vs-penetration-test-vs-continuous-scanning.html</loc>
    <lastmod>2026-07-26</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://vulnytics.com/blog/intruder-io-alternative-for-startups.html</loc>
    <lastmod>2026-07-26</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.8</priority>
  </url>

  <!-- Legal. Not ranking pages, but they must stay discoverable: payment
       providers and enterprise reviewers both go looking for them. -->
  <url>
    <loc>https://vulnytics.com/terms.html</loc>
    <lastmod>2026-07-26</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.3</priority>
  </url>
  <url>
    <loc>https://vulnytics.com/privacy.html</loc>
    <lastmod>2026-07-26</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.3</priority>
  </url>
  <url>
    <loc>https://vulnytics.com/refund.html</loc>
    <lastmod>2026-07-26</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.3</priority>
  </url>
  <url>
    <loc>https://vulnytics.com/cookies.html</loc>
    <lastmod>2026-07-26</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.3</priority>
  </url>
</urlset>
