Q39
Are you PCI DSS compliant? At what level?
Webex Contact Center and Enterprise are PCI DSS v4.0.1 compliant; Webex Calling maintains PCI DSS v3.2.1 self-attestation of compliance.
Public evidencehigh confidence
Webex Vendor Risk & Security Assessment
ThirdProof independently checks public intelligence sources to show what your team can verify about Webex before Webex sends a questionnaire or a security document.
Webex's SOC 2 report is confidential. There is no public registry for SOC 2, so the report itself has to come from Webex — ThirdProof does not hold or distribute it. What this page gives you is an independent assessment built from evidence anyone can check, and a record of which certifications are registry-verified versus claimed on Webex's own trust page.
✓ FedRAMP Certified — Class C (Moderate) Checked August 2026.
Webex for Government (Cisco) is FedRAMP Certified at Class C (Moderate) via the Agency path (package F1511207635). Commercial Webex is a separate offering.
Risk
Tier 3 — Moderate RiskEvidence confidence
100%25 of 27 sources returned data
Questionnaire
68 / 133 answered51% from public evidence
Last assessed
Aug 27, 2026Evidence confidence measures how much of the evidence ThirdProof set out to gather it was able to gather and corroborate. It is not a statement that every fact about this vendor is known.
🟢IP Reputation: Abuse score: 0%, 0 reports🟡SSL/TLS: TLSv1.2🟢Domain Age: 27.5 years🟢Infrastructure: 2 open ports, 0 CVEs
- FedRAMP Status
- Webex is not listed on the FedRAMP Marketplace (checked August 2026).
- SOC 2 Status
- Webex — SOC 2: Vendor attested — trust page. SOC 2 reports are confidential with no public registry, so compliance status is not publicly verifiable. Request the full Type II report and bridge letter directly from the vendor.
- Sanctions Screening
- Webex returned no matches in OFAC SDN, EU Consolidated, and UN sanctions screening.
- Risk Tier
- ThirdProof assigned Webex a Moderate Risk tier across 27 intelligence sources, 25 of which returned usable evidence (evidence confidence 100%).
27 sources queried, 25 returning usable evidence. The Webex assessment ThirdProof has already run covers both a risk report and an auto-filled security questionnaire, with anything the evidence could not settle listed as an open question.
Get the Latest Webex Vendor Assessment →Full risk assessment + 133-question security questionnaire|Free · Delivered by email
Certification & Compliance Status
Security questionnaire — auto-filled
68 questions answered before Webex responds.
ThirdProof used public evidence to pre-fill 51% of a 133-question vendor security questionnaire — without waiting for Webex. The remaining 65 are listed as open, so the follow-up you send is short and specific.
Q37
Do you have a current SOC 2 Type II report?
SOC 2 Type II: Vendor attested — trust page
Public evidencemedium confidence
Q42
Are you GDPR compliant? Do you have a DPA available?
Cisco Webex has signed Data Processing Agreements (DPAs) available and supports GDPR through data protection and privacy mechanisms.
Public evidencehigh confidence
Q40
Are you HIPAA compliant? Do you sign BAAs?
Cisco Webex signs a standard BAA with covered entities and business associates, and is HIPAA compliant when a BAA is in place.
Public evidencehigh confidence
Q23
Is data encrypted at rest? What encryption standard is used (e.g., AES-256)?
Webex encrypts data at rest and in transit using AES-256-GCM cipher for both messaging content and meeting recordings.
Public evidencehigh confidence
+ 63 additional evidence-backed answers
Get the Complete Webex Assessment →
See all 133 questions, evidence links, findings, and the vendor follow-ups still required.
What you can verify before Webex sends anything
Independent evidence settles part of the review. The rest still needs the vendor.
Public evidence establishes
- No Sanctions Matches Found
- No SEC Enforcement Filings Found
- Vendor Commits to Not Training on Customer Data
- Clean domain reputation
- Clean Safe Browsing Status
Still requires vendor confirmation
- Current SOC 2 report and its audit scope
- Access Control — 8 of 12 questions need vendor input
- Data Security — 8 of 14 questions need vendor input
- Governance & Risk — 6 of 10 questions need vendor input
- Incident Response — 6 of 10 questions need vendor input
Reviewing Webex for your company?
Get the complete ThirdProof assessment now, then use the same workflow to assess the rest of your vendor stack.
5 vendors free · No credit card
Need ongoing vendor reviews? ThirdProof includes up to 50 vendor assessments per month for $399. See pricing
Executive Summary
Narrative analysis for Webex
Webex is a mature, established collaboration platform owned by Cisco with a 27-year domain history and significant enterprise adoption.
Area Requiring Attention
The vendor demonstrates strong security fundamentals: ISO 27001 certification, SOC 2 Type II claims, comprehensive encryption (AES-256-GCM for data at rest and in transit), multi-factor authentication support, and an explicit commitment to not training AI models on customer data. Infrastructure exposure is minimal (2 open ports: 80, 443), domain reputation is clean across threat intelligence databases, and the vendor maintains documented incident response procedures with 72-hour breach notification compliance.
The full risk rationale, every finding and the recommended vendor follow-ups are in the complete assessment below.
Independence Statement
All evidence in this assessment was independently sourced from external data sources without vendor participation or input.
Investigation Findings
2 findings identified for Webex
1 high1 low
high
Significant adverse media in historical archives
Historical media archives document a pattern of security incidents affecting Webex deployments between April and July 2026. Three high-severity articles reference critical vulnerabilities requiring patches, trojanzed application installers distributing Starland RAT malware, and fake Webex downloads used in malware distribution campaigns. …
low
Threat intelligence pulses detected
Webex.com appears in 45 threat intelligence pulses on the OpenThreat Exchange. This high pulse count is typical for large, public-facing infrastructure providers and does not indicate direct risk from Webex itself. …
✓
Security Strengths
Evidence that positively supports Webex's posture
Neutral observations, source coverage notes and items ThirdProof could not independently establish are recorded separately in the complete assessment — they are not counted as strengths.
✓
No Sanctions Matches Found
Sanctions & Watchlist Screening →✓
No SEC Enforcement Filings Found
SEC Filing Search →✓
Vendor Commits to Not Training on Customer Data
AI Data Usage Policy →✓
Clean domain reputation
Threat Intelligence →✓
Clean Safe Browsing Status
Malware & Phishing Check →✓
Clean Website Security Scan
Website Security Scan →✓
Clean IP Reputation
IP Reputation →Webex complete vendor assessment
Tier 3
Moderate Risk
68 / 133
questionnaire answers
27
sources checked
Aug 27, 2026
assessment date
- Complete 133-question security questionnaire
- Evidence behind every answered item
- Full findings and risk rationale
- Recommended vendor follow-ups
- Source and evidence inventory
- Source-cited PDF assessment
Risk tiers are set by a deterministic rules engine. AI summarises sourced evidence and writes the narrative; it does not assign the tier. Read the full methodology.
Frequently asked about Webex
Is Webex FedRAMP authorized?+
Webex was not found in the FedRAMP Marketplace when it was checked on August 27, 2026. Absence of a public record is not evidence that the certification is absent; organisations with a hard requirement should confirm directly with the vendor.
Does Webex have SOC 2 Type II?+
Webex states that it maintains SOC 2 on its trust page. Because SOC 2 reports are generally confidential and there is no public SOC 2 registry, ThirdProof classifies this as vendor-attested until the current report and its scope have been reviewed. Request the report directly to confirm the audit period and which systems are in scope.
Is Webex on the OFAC sanctions list?+
Webex returned no matches in ThirdProof's OFAC SDN, EU Consolidated, and UN sanctions screening as of August 2026.
What is Webex's vendor risk tier?+
ThirdProof assigned Webex a risk tier of Moderate Risk as of August 2026, with an evidence confidence of 100% across 27 intelligence sources. Evidence confidence describes how much of the evidence ThirdProof set out to gather it was able to gather — not certainty about every fact concerning Webex.
Has Webex had any data breaches or security incidents?+
ThirdProof's assessment as of August 2026 records 1 incident-related finding for Webex, of which 1 is rated high severity or above. The most severe concerns significant adverse media in historical archives. Each finding states whether the incident affected Webex's own systems, a customer's environment, or a third party — a distinction that changes what you should ask about — and links to the source it was drawn from. The complete assessment carries all of them with their evidence.
Is Webex PCI DSS compliant?+
Webex Contact Center and Enterprise are PCI DSS v4.0.1 compliant; Webex Calling maintains PCI DSS v3.2.1 self-attestation of compliance. ThirdProof records this from Webex's published compliance evidence; request the current Attestation of Compliance to confirm the scope that applies to your integration.
Does Webex support HIPAA and sign BAAs?+
Cisco Webex signs a standard BAA with covered entities and business associates, and is HIPAA compliant when a BAA is in place. If protected health information is in scope for your use, confirm BAA availability in writing before contracting.
Can ThirdProof pre-fill a Webex security questionnaire?+
Yes. ThirdProof answered 68 of 133 questions (51%) about Webex from public evidence, before contacting the vendor. Each answered item carries the evidence it was drawn from. The remaining 65 are listed as open, so the follow-up you send Webex is short and specific.
Also investigate these vendors
Represent Webex? Submit updated security evidence.
If Webex is in your vendor stack, can you prove you assessed them?
SOC 2 CC9.2, HIPAA, PCI DSS and CMMC all require documented vendor due diligence — not just knowing the answer, but holding evidence that you verified it. The Webex assessment above is already written; ask for it and it lands in your inbox.
✓ This assessment: free, no account required✓ Your first 5 vendor investigations are free✓ No credit card required