Northpay processes millions of card payments a month. Rapid growth had left hundreds of cloud accounts with inconsistent settings and a backlog of critical findings that no team could realistically clear.
Leadership needed two things at once: a meaningful drop in real risk, and a clean PCI DSS audit, all without pausing the product roadmap. The existing tooling reported plenty of problems but offered little guidance on where to begin.
Discovery
We mapped every cloud account and ranked 1,400 findings by real exploitability rather than raw severity. Internet-facing assets with paths to payment data moved straight to the top, and a large share of the old backlog turned out to carry little practical risk.
Remediation sprint
Automated guardrails fixed the most common misconfigurations, while our engineers paired with Northpay’s teams on the rest. New infrastructure checks in the delivery pipeline stopped the same issues from coming back after each release.
Results
Critical exposure dropped by 72% in twelve weeks, and the company passed its PCI DSS audit with zero major findings. Engineers now work from one ranked list, and new accounts inherit secure defaults from the day they are created.
For the first time, our engineers knew exactly which issues mattered. The backlog stopped feeling impossible.
Recommended Projects
Stay Protected With Next-Generation Security
Protect your data, apps and users with 24/7 monitoring, fast incident response and audit-ready security built for growing teams.