A JSE-listed financial services provider cut critical exposure by 71%
Client anonymised at their requestA merger left a fragmented, unmeasured estate
Following the acquisition of a smaller competitor, the group inherited two overlapping technology estates with inconsistent controls, duplicated internet-facing services and no unified view of vulnerability. The board’s risk committee was being asked to sign off on a posture nobody could actually quantify.
An annual penetration test had become the only measure of security, a once-a-year snapshot that was stale within weeks. Critical findings recurred between tests, remediation was untracked, and there was no way to demonstrate progress to regulators or the audit committee.
From point-in-time testing to continuous assurance
We replaced the annual snapshot with a continuous programme, anchored to a single risk register the board could read.
- AUnified the attack surfaceConsolidated and de-duplicated all internet-facing assets across both estates into one authoritative inventory.
- BContinuous vulnerability managementStood up scheduled scanning with senior-tester validation, so real exploitable issues were separated from scanner noise.
- CPrioritised, tracked remediationEvery finding was risk-rated, assigned an owner, and tracked to closure in a live register mirrored to the board dashboard.
- DQuarterly independent assuranceEach quarter we re-tested and issued a board-ready report mapped to the group’s control frameworks.
A defensible posture in three quarters
Within nine months the group had a measurable, improving posture, and a risk committee that could finally see it.
- 71% fewer critical findings across the consolidated estate, quarter on quarter.
- Median remediation time down to 4.2 days for critical issues, from an unmeasured baseline.
- A single board-ready dashboard the risk committee now reviews every quarter.
- Clean evidence trail for regulators and external auditors, mapped to control requirements.
“For the first time, we could show the board exactly where we stood, and prove it was getting better every quarter.”
Mapped to the standards that matter
Every quarterly report was framed against the group’s regulatory and control obligations, so assurance and compliance drew on the same evidence.
This case study is anonymised at the client’s request. Sector, scope, methods, frameworks and outcomes are described as delivered; identifying details have been generalised to protect the client’s security posture.
Want an outcome like this?
Start with a baseline assessment. We’ll show you where you stand today and map the path to a posture your board can trust.