How We Secured a $50M Fintech Platform Before Series B
Six weeks to a report the investment committee would read, and 47 findings the last audit missed
Client: Leading Fintech Startup
The Challenge
A Funding Deadline, and a Prior Audit That Had Signed Off Too Early
A fintech platform preparing to close a Series B had six weeks between kickoff and the investment committee meeting. A third-party audit twelve months earlier had returned a clean report, but the architecture had since grown past forty microservices, each with service-to-service authentication added as it was built. Nobody owned the API surface as a whole, and diligence would ask for evidence rather than assurances.
- Six weeks from kickoff to a report the investment committee would read
- A prior third-party audit had returned clean on an architecture that still carried critical flaws
- Forty-plus microservices, each with service-to-service authentication added as it was built
- No single owner for the API surface after eighteen months of rapid feature delivery
The Solution
VAPT with Remediation Running Alongside the Assessment, Not After It
Security Brigade put senior consultants on the engagement and released findings continuously rather than at the end, so engineering could remediate inside the six weeks rather than after them. Every finding passed three-layer L1/L2/L3 review before it reached the client, and each fix was retested and evidenced in Lemon within 48 hours of the release that carried it.
Services used
Our approach
- 01Phase 1: threat modelling against the funding-round risk register rather than a generic checklist
- 02Phase 2: automated scanning across every service, used to scope manual effort rather than to fill a report
- 03Phase 3: manual penetration testing and business-logic abuse on the onboarding, payment and settlement flows
- 04Phase 4: API security assessment across the service-to-service boundary, each fix retested within 48 hours
The Results
Series B Closed with Every Critical Finding Already Remediated
Forty-seven findings across the platform, every critical one closed and retested before the board meeting. The engagement produced an evidence pack the diligence team could read directly — finding, fix, retest date — rather than a summary the company had to defend in a call.
Ready to discuss your security needs?
Talk to our team about a similar engagement for your organisation.
Request a Scoping Call