Northwind Pay
Series A fintech · pre-SOC 2 Type II
Pre-SOC 2 pentest with a week-by-week remediation calendar, not a 200-page PDF
Surface critical findings ahead of the SOC 2 audit window with a clear remediation plan.
A small fintech needed a penetration test ahead of their SOC 2 Type II audit. The win wasn't the report — it was the remediation playbook that gave the engineering team a clear week-by-week path to a clean audit.
CRIT
10
HIGH
12
MED
10
LOW
14
- Industry
- Cybersecurity / Fintech
- Timeline
- 2 weeks
- Team
- 2
- Service
- Cybersecurity
- Project tier
- Security audit / $4,995 + Remediation
The Problem
What was broken.
Audit window in 8 weeks. The team had not had an external test before. They wanted a real report — one that would survive an auditor's review — and a remediation plan they could actually finish in time.
Our Approach
How we framed it.
Two-week test against scoped surface (web app, API, AWS account). Findings classified by severity with reproducible PoCs. Remediation playbook organized by week so the engineering team could execute against a calendar, not a backlog.
Capability proof
What this case demonstrates.
This case makes the hidden work visible: strategy, architecture, delivery control, quality evidence, and handoff.
01 / Product judgment
Problem framed before UI
Audit window in 8 weeks. The team had not had an external test before. They wanted a real report — one that would survive an auditor's review — and a remediation plan they could actually finish in time.
02 / Technical depth
5 stack decisions
Burp Suite Pro, Custom fuzzers (Go), AWS scanners (ScoutSuite, Prowler), Semgrep (SAST), Markdown (report)
03 / Delivery discipline
4 delivery checkpoints
Scoping + rules of engagement / Web + API testing / AWS testing
04 / Handoff quality
5 shipped artifacts
Two-week external + AWS pentest report / Reproducible PoCs for every finding / Week-by-week remediation playbook
Production artifacts
Inspect the work behind the visible result.
Each case exposes the surfaces, systems, evidence, and handoff package that make the shipped product usable after launch.
Experience layer
Buyer or user surface
Two-week scoped test (web app, API, AWS account) with reproducible PoCs. Findings organised into a week-by-week remediation playbook; every high/critical re-tested before audit window.
Proof 01
Surface critical findings ahead of the SOC 2 audit window with a clear remediation plan.
Proof 02
Wrote the rules of engagement, scoped surface, agreed on test windows and emergency contacts.
Proof 03
Executive summary suitable for the auditor
Production signals
Observable
Errors, logs, alerts, or dashboards included.
Risk-aware
Security and compliance boundaries named.
Handoff-ready
Owner can keep operating after delivery.
Before / after · product UI mockup
Industry · Cybersecurity / Fintech
Before:Annual Nessus scan dumped a 200-page PDF — most findings ignored, no remediation tracking.
After:Two-week scoped test (web app, API, AWS account) with reproducible PoCs. Findings organised into a week-by-week remediation playbook; every high/critical re-tested before audit window.
How the engagement ran.
- 01Day 1
Scoping + rules of engagement
Wrote the rules of engagement, scoped surface, agreed on test windows and emergency contacts.
- 02Day 2-7
Web + API testing
Manual testing with Burp + custom fuzzers; SAST pass with Semgrep.
- 03Day 8-10
AWS testing
ScoutSuite + Prowler + manual review of IAM, S3, security groups.
- 04Day 11-14
Report + remediation playbook
Wrote the report and the week-by-week remediation playbook with the team.
- 1
Day 1
Scoping + rules of engagement
Wrote the rules of engagement, scoped surface, agreed on test windows and emergency contacts.
- 2
Day 2-7
Web + API testing
Manual testing with Burp + custom fuzzers; SAST pass with Semgrep.
- 3
Day 8-10
AWS testing
ScoutSuite + Prowler + manual review of IAM, S3, security groups.
- 4
Day 11-14
Report + remediation playbook
Wrote the report and the week-by-week remediation playbook with the team.
Deliverables
What we shipped.
- ✓Two-week external + AWS pentest report
- ✓Reproducible PoCs for every finding
- ✓Week-by-week remediation playbook
- ✓Re-test of every high/critical finding
- ✓Executive summary suitable for the auditor
Outcomes.
engagement targetsPlan: two-week test against web app, API, and AWS account
Plan: findings with reproducible PoCs and clear severity
Plan: remediation playbook organized by week, not by category
Plan: re-test of every high/critical finding before audit window
Plan: auditor-ready report with executive summary
Honest challenges
What we got wrong (or almost wrong).
The pretty version of any case study skips this part. We don't.
- 01
Some findings required customer-data access; coordinated tightly to avoid touching anything we shouldn't.
- 02
AWS IAM had drift from the documented policy; flagged it explicitly with a one-page IAM hygiene plan.
In our own words
The win wasn't the report — it was the playbook. Organising remediation by week, not by category, gave the engineering team a calendar instead of a backlog and turned an 8-week scramble into a planned sprint.
From the Hayaiti team
Engineering · design · security
Technical blueprint
How the work holds together.
Buyers should see that the visual layer is backed by architecture, quality gates, and operational ownership.
Experience
1Application
2Data
3Operations
4Security
5Stack used
5 technologiesRelated
Other cases like this.
Helix Health
HIPAA-ready intake portal
Replace clipboard intake with a 7-minute, accessible, HIPAA-ready web flow.
GovTechCity of Greendale
Municipal procurement portal
Replace a paper-and-fax vendor onboarding flow with a proper portal.
Cybersecurity / Bug BountyThree public programs
HackerOne disclosure suite
Found, triaged, and disclosed a small set of vulnerabilities against public bug-bounty programs.
Want a case study like this?
Want this level of production quality on your project?
Send a short brief and we'll reply with scope, timeline, price direction, and the first technical recommendation.