The Challenge
Rapidly growing FinTech had 120 days to produce a SOC 2 Type I report or lose a strategic customer.
Key Issues
- No formal security programme or documented policies
- 247-item security questionnaire blocking a USD 3.9M deal
- One DevOps engineer covering all infrastructure
The Solution
We built a turnkey security programme that satisfied auditors on the first attempt.
Key Actions
- Rolled out a lightweight GRC platform in one business day -> reduced evidence-collection effort by ~30 %.
- Facilitated an executive risk workshop -> secured C-suite sponsorship, making security a shared KPI.
- Embedded automated SAST/DAST scans in GitHub Actions -> cut median fix time from 38 days to 12 days.
- Launched quarterly phishing drills and secure-coding clinics -> lowered click-through rate from 11 % to 2 %.
