Bank-software vendor tests its rewrite three times during development and ships with zero high-severity findings
A small financial-software vendor serving banks. Outcome verified
zero high-severity findings
The problem
A small financial-software vendor was rewriting its core loan-management product for the cloud and wanted to know the new application was secure before bank customers saw it, not after. Because development was ongoing, a single test would go stale quickly, and findings had to reach a small team fast enough to fix in the next iteration.
Why it mattered
Banks run vendor security reviews. Users reaching reports they were not authorized to see, or a disabled employee's session staying alive, would be material findings against a product sold on trust.
What we did
Vizius tested the application three times across the development year rather than once at release, benchmarking each interim build against web-application best practice and delivering short findings with standard weakness references and concrete fixes the developers could act on directly.
What changed
No high-severity issues were found in any round. Medium findings fell from four in the first round to one in the second and two in the third; file-upload and session-expiration weaknesses were fixed, and two authorization and cross-site-scripting items were carried forward with specific remediation guidance.
- Software and saas
- Small company