Insurtech fixes a platform-wide session-takeover flaw before its re-test, then locks in an annual security cadence
A growth-stage insurtech platform provider. Outcome verified
The problem
A growth-stage insurtech was about to release a new multi-role web application and had about two weeks to learn whether it was safe. As larger carriers signed on, it also realized one-off tests would not satisfy customers asking about year-round security. It had a small engineering team and release dates that could not move.
Why it mattered
The platform holds carrier, policyholder and contractor data; a breach or a failed customer security review would directly threaten growth with larger clients.
What we did
For the launch, Vizius ran a compressed clear-box test with multiple testers and AI-driven automation as a second set of eyes, reporting findings as they were confirmed. It then converted the relationship into a fixed-price annual assurance program: baseline testing of each application, re-testing of fixes, release testing and quarterly reviews.
What changed
The pre-release test found no high-risk issues and the product shipped with a prioritized fix list. In 2026 the flagship platform's most serious exposure, predictable session tokens allowing account takeover across all portals, was confirmed fixed on re-test, leaving only three low-risk items. The client is budgeting the same program for 2027.
- Software and saas
- Small company