The challenge
A PE-backed financial services company that manages vehicle recovery handles sensitive data across a large network of field agents. Its enterprise customers needed SOC 2 assurance to keep doing business with it.
It also needed incident response across that agent network, a plan for its proprietary on-premise applications and better protection for its public-facing apps. The need for security leadership was constant, but not big enough to justify a full-time CISO.
Our approach
Since 2020 we’ve served as the company’s virtual CISO, running security operations against a roadmap we refresh every year. We prepared the company for its SOC 2 audit, supported it through to a clean report and have kept the program current through each audit cycle since.
Along the way we supported incident response across the field agent network, moved four proprietary applications to the cloud, supported the Azure environment alongside the company’s systems administrator, scoped a web application firewall, and built a data warehouse with Power BI reporting that brings several systems together.
The outcome
The company has a clean SOC 2 report at about half the cost of a full-time CISO, and six years of continuous security leadership through multiple audit cycles. Gaps in application security testing were found and put on the roadmap before they could become incidents.
SOC 2 audit report
proprietary applications moved to the cloud
of continuous security leadership, since 2020
