Before launching a product that holds customer portfolios, a data provider had it attacked first
A global financial market-data provider. Outcome verified
The problem
A global financial market-data provider was moving from publishing data to holding customer information inside its own web products. Each new product raised the stakes, and the developers needed to know whether their code would stand up to a real attacker before customers relied on it. The products shared authentication layers and shipped fast, so one missed check could affect every endpoint.
Why it mattered
The applications held customer personal data and, in the newest product, customers' securities holdings. A flaw there would breach the boundary between one customer and another.
What we did
Vizius tested as a real customer would, working against the boundary between accounts and against the cloud account hosting the product, with source code access so findings were confirmed at root cause rather than inferred. Findings were shared as found, and dozens of cloud observations were consolidated into a short list of decisions.
What changed
The 2023 test of the first product found three high-severity flaws, including customer personal data readable by any logged-in user. The 2026 test of the new product found an application that held up well, with two specific gaps to close and no customer data exposed outside the test team.
- Financial services
- Midsize company