How a financial services platform went from two pentests a year to one on every release

The security team was not short of rigour. It was short of clock. Every material release needed a penetration test, every test took a consultancy six to eight weeks, and the invoice came in above $50,000. Release trains were being planned around test windows rather than the other way round.

• Assessments outlived the code they tested

  By the time a report landed, the application had moved through four sprints. Roughly a third of each report described a version of the product that no longer existed, and the team spent days triaging which findings were still real.

• Testing was scoped to what the budget allowed

  Two annual assessments covered the flagship web application. The 90 public APIs, the internal admin tooling and the newly acquired subsidiary's estate were tested opportunistically, which in practice meant not at all.

• Regulatory evidence was assembled by hand

  PCI DSS and the internal audit cycle both wanted evidence of testing and remediation. Producing it meant an engineer exporting spreadsheets and reconciling them against Jira for the better part of a week, twice a year.

• Retests were a separate purchase

  Confirming a fix meant scheduling the consultancy again, so fixes shipped unverified and the team carried an unknown number of incomplete remediations into the next assessment.

AIPTx was wired into the deployment pipeline rather than the calendar. The scope stopped being a negotiation about consultant days and became a list of assets, and the question shifted from 'when is the next test' to 'what changed since the last one'.

1. 1

   Attack surface mapped before anything was tested

   Week 1

   Discovery enumerated subdomains, load balancers, API schemas and third-party dependencies across both the primary estate and the acquired subsidiary. It returned 118 internet-facing services against an asset register that listed 74.

2. 2

   Baseline assessment across web, API and cloud

   9 hours

   A full autonomous assessment ran against staging with production-equivalent data, covering the flagship application, all 90 APIs and the AWS control plane. Every confirmed finding arrived with the request and response that proved it, rather than a scanner signature.

3. 3

   CI gate on every pull request

   4–11 min per PR

   SAST runs on the diff and posts results as SARIF, blocking merges on new critical findings. Full DAST runs against the ephemeral environment each PR creates, so an introduced vulnerability is caught by the engineer who introduced it.

4. 4

   Business logic testing on the payment flows

   Nightly

   Race conditions on balance transfer, IDOR across account identifiers and price and limit manipulation were tested explicitly, the class of flaw a signature scanner has no rule for and a time-boxed manual test usually reaches last.

5. 5

   Compliance evidence generated, not compiled

   On demand

   Findings map to PCI DSS requirements and to the internal control library as they are created, so the audit export is a report run rather than a week of spreadsheet reconciliation.

6. 6

   Automatic retest on every fix

   Continuous

   Closing a ticket replays the original exploit. It reopens itself if the exploit still works, which ended the practice of shipping a fix and assuming it landed.

The first quarter after rollout is the fair comparison: same team, same release cadence, same regulatory obligations, different testing model.

85%

Faster security testing6–8 weeks to a 9-hour full assessment, then minutes per change

60%

Lower cost per assessmentConsultancy retained for annual red team rather than routine testing

3x

More frequent testingTwice a year to every release, plus nightly logic testing

44

Untracked services found118 discovered against 74 on the asset register

9

Critical findings in the first runIncluding two IDOR paths reaching other customers' statements

5 days

Median time to closeDown from 47 days, measured on criticals

• Discovery is the finding that pays for the programme

  The 44 services nobody had registered were not a footnote. Two of the nine criticals in the first assessment were on hosts the asset register did not contain, which means the previous testing model could not have found them at any budget.

• Frequency beats depth for regression-class bugs

  A short test on every change catches the vulnerability the team just wrote. A deep test twice a year catches it up to six months later, by which point it has been built on.

• Keep the humans for the work only humans do

  Consultancy spend did not go to zero. It moved from routine coverage to an annual adversarial red team with a physical and social engineering component, the part automation genuinely cannot do.

• Verified fixes change the meaning of 'closed'

  Automatic retest turned remediation from a self-reported status into an observed fact, and surfaced a steady trickle of fixes that had been marked done without working.