Software firm that secured its flagship product finds half its own corporate controls unimplemented
A regional custom-software development firm. Outcome verified
The problem
A regional custom-software development firm had built solid security practices around one of its hosted, regulated products but had never measured its own corporate environment against a standard. As the company grew and customers asked harder security questions, leadership wanted to know where it actually stood. There was no dedicated security staff.
Why it mattered
The firm builds and hosts applications for enterprise and government customers, so a weak corporate network was a direct path to client data and a credibility problem in sales cycles.
What we did
Vizius paired stakeholder interviews and side-by-side console reviews with independent checks (vulnerability scans, a phishing test, dark-web and admin-credential discovery) so the CIS scorecard was validated rather than self-reported. The key observation: the firm already knew how to do this. The controls it applied to its regulated product simply had not been applied to the company itself.
What changed
Half of the 20 CIS controls scored under 5 percent implemented, with the largest gaps in anti-malware, patching and account management; 5.8 percent of 86 staff clicked the test phish. Most fixes needed no capital spend.
- Software and saas
- Small company
- CIS Controls