Skip to content

Case studies

How the work fits together, end to end.

Three illustrative engagements that show how our platform, managed services, consulting and GRC teams combine. Each names a sector only, with no client names, logos or quotes, and describes the outcomes this kind of engagement typically delivers.

Illustrative engagementFintech · payments platform

Mapping the API surface before a partner launch

A payments company was about to open its APIs to partners. Its engineering teams had added endpoints over several years, and nobody could say with confidence which versions were still live or which returned card-adjacent data.

What we did

  • Built an API inventory from specs, gateway logs and live traffic, and flagged endpoints present in traffic but missing from the specs.
  • Ran a focused penetration test on authorization: two users per role, cross-tenant access attempts on every object type.
  • Added schema validation and per-client rate limits at the edge, and authorization tests to CI.

Typical outcome

  • Typically: deprecated API versions retired before launch.
  • Typically: authorization findings fixed and retested before partners receive credentials.
Illustrative engagementHealthcare SaaS

From security questionnaires to a SOC 2 Type II report

A healthcare software vendor was losing weeks on every hospital security review. It had policies, but no attestation and no way to show controls had operated over time.

What we did

  • Ran a readiness assessment against the Trust Services Criteria and HIPAA Security Rule requirements, and closed the gaps.
  • Connected the identity provider, cloud and code repositories to collect evidence continuously.
  • A fractional CISO owned the program and the auditor relationship through the review period.

Typical outcome

  • Typically: a Type I report first, then Type II after the review period.
  • Typically: security reviews answered from a shared answer library and trust page.
Illustrative engagementManufacturing · multi-site

24/7 coverage for a lean IT team across several plants

A manufacturer with a small IT team ran plants on networks that had grown separately. Alerts from its endpoint tool went to a shared inbox that nobody watched at night.

What we did

  • Onboarded endpoint, identity and firewall telemetry into managed detection and response, with containment playbooks agreed up front.
  • Network operations monitoring for plant connectivity, with one escalation path for security and uptime issues.
  • Ran a ransomware tabletop with plant managers and leadership.

Typical outcome

  • Typically: alerts triaged around the clock, with host isolation pre-approved for confirmed threats.
  • Typically: a written, tested decision path for a ransomware event.

Have a problem that looks like one of these?

Tell us about your environment and we will suggest where to start.

Talk to an expert