Case study · Large payments platform
A vulnerability backlog that finally went down.
One intake, severity clocks and a weekly number leadership reads took a payments platform’s backlog down by 98 percent.
The brief
A large payments platform received findings from red teams, risk reviews and incident response, each in its own format. Leadership wanted one answer to a simple question: how exposed are we today?
The difficulty
- The same issue was reported twice, by two teams.
- Owners disputed severity, and the clock stopped while they did.
- Some findings were not vulnerabilities at all, but business risks waiting for a decision.
What we did
- Intake
One front door
Every source normalized and de-duplicated, so each issue existed once.
- Clock
SLOs by severity
A weekly On-SLO percentage, reported to leadership.
- Separate
Vulnerabilities from risks
A vulnerability gets a fix and a deadline. A risk gets an owner and a formal decision.
- Extend
AI and ML in the same lifecycle
Prompt injection and model guardrails on the same clocks as everything else.
The result
- 98%
- Reduction in the backlog
- 3
- Sources, one intake
- Weekly
- A security number leadership reads
- Hundreds
- Of audit findings with dated owners
The lesson
Tools find vulnerabilities. Programs close them. What closes them is ownership, a clock, and a number someone senior reads every week.