Skip to content
Solvex Space

Case studies

What an engagement looks like

Representative engagements across the practice areas — the risk a team faced, what we did, and how the outcome was measured. Each links to the exact services behind it.

Representative engagements. Clients are confidential; the figures and quoted comments illustrate typical outcomes for the work described.

Engagements

Representative engagement
Offensive / TestingFintech / embedded payments

Clearing a payments fintech's attack surface before Series B technical due diligence

Series B embedded-payments platform, ~180 staff, AWS-hosted, sponsor-bank integration

A Series B payments platform had a term sheet contingent on technical due diligence, and its sponsor bank required independent penetration-test attestation covering the payments API and public surface. We tested the application, its APIs and the code behind them under signed scope, proved which flaws were genuinely exploitable, and retested the fixes so the founder walked into the data room with a clean attestation instead of an open question.

Exploitable findings proven
2 critical, 7 high
Critical & high findings closed and retested clean
100%
Read the engagement
Representative engagement
Governance / ComplianceB2B SaaS / workflow platform

A clean SOC 2 Type II that unblocked a B2B SaaS company's enterprise pipeline

Series B horizontal SaaS, ~120 staff, enterprise-sales motion

Enterprise prospects were parking six-figure deals in vendor security review because the company had no SOC 2 report, and competitors with one were winning by default. A vCISO owned the programme end to end — closing control gaps, tightening identity and access, and training staff — so the company reached its observation window on a predictable timeline and came through its first Type II audit with a clean opinion.

Exceptions at first SOC 2 Type II audit
0
Control gaps closed across the Trust Services Criteria
41
Read the engagement
Representative engagement
Defense & MDRDigital health / healthtech (ePHI SaaS)

Standing up 24/7 detection for a healthtech scaling into hospital and payer contracts

Series B digital-health SaaS, ~90 staff, processing ePHI for US providers

Hospital and payer procurement — and the HIPAA Security Rule's monitoring expectations — demanded continuous detection and demonstrable response the startup could not staff in-house. We put the production ePHI workloads under a managed SOC with tuned detections and proactive threat hunting, cutting time-to-detect from hours to minutes and giving the team the monitoring evidence health-system risk assessors ask for.

Mean time to detect (highest-severity)
hours → under 10 min
Production ePHI workloads under 24/7 monitoring
100%
Read the engagement
Representative engagement
DFIR & ForensicsManufacturing / industrial

Ransomware recovery for a mid-market manufacturer, with no ransom paid

Mid-market industrial manufacturer, ~500 staff, multi-site plants

Ransomware detonated across a manufacturer's network overnight, encrypting servers and halting production. We took the callout, contained the intrusion in under six hours, and ran a forensically sound recovery from clean backups — restoring critical production within 72 hours without paying the attacker. A retainer now keeps a known responder one call away and shortens the next incident before it starts.

Ransom paid
$0
Time to containment
under 6 hours
Read the engagement
Representative engagement
Web3 & EmergingWeb3 / DeFi lending

Auditing a DeFi lending protocol before it held real TVL on mainnet

Seed-stage DeFi lending protocol, ~15-person core team, pre-mainnet

In DeFi a single contract bug is an irreversible loss, and no serious backer or integrator commits liquidity to unaudited code. We audited the lending protocol's contracts, economic design and oracle dependencies before mainnet, caught a fund-draining reentrancy path along with the rest of the findings, and re-audited every fix so the team launched with a publishable report — and a clean on-chain record since.

Findings across contracts and economic design
1 critical, 4 high, 7 medium
Fund-draining reentrancy path caught pre-mainnet
1
Read the engagement
Representative engagement
Cloud / DevSecOpsB2B SaaS / HR technology

Finding a cross-tenant data flaw in a B2B SaaS before a customer did

Series C HR platform, ~350 staff, multi-tenant on Kubernetes

An HR platform holding payroll and personal data for hundreds of customers had passed generic pentests for years — but nobody had ever attacked its tenant boundaries specifically. A dedicated isolation assessment proved that a background export job could be steered across tenants, a bug class its previous tests had no time to reach. It was fixed and retested before any customer, regulator or attacker ever saw it.

Cross-tenant paths proven exploitable
1 critical, 3 medium
Findings closed and retested clean
100%
Read the engagement
Representative engagement
Offensive / TestingSaaS / logistics technology

Moving a weekly-shipping scale-up from annual pentests to continuous coverage

Series B logistics platform, ~150 staff, weekly production releases

A logistics platform shipping to production weekly was buying one pentest a year — meaning fifty-one weeks of untested change. Moving to PTaaS put expert testing on the same cadence as engineering: new features tested in the cycle they ship, findings delivered through the portal as they're confirmed, and retests included instead of quoted separately.

Finding-to-ticket time
weeks → same day
Remediated findings retested
100%
Read the engagement
Representative engagement
Web3 & EmergingLegal technology / AI

Securing a legal-tech LLM assistant before its enterprise launch

Series A legal-tech company, ~60 staff, LLM assistant over privileged documents

A legal-tech company was weeks from launching an LLM assistant that answers questions over clients' privileged documents — a product where one prompt injection could mean privileged material crossing a client boundary. An adversarial AI assessment proved the retrieval pipeline could be poisoned to exfiltrate context, drove architectural fixes, and left the team a red-team prompt suite to re-run on every model upgrade.

Injection paths proven pre-fix
5
Cross-matter leakage after architectural fixes
0 reproduced
Read the engagement
Representative engagement
Governance / CompliancePrivate equity / software acquisition

Cyber due diligence that repriced an acquisition before signing

Mid-market PE firm acquiring a ~$40M vertical-software company

A private equity firm was days from a letter of intent on a vertical-software company when passive assessment surfaced exposed credentials, an unreported historical intrusion and an estate of end-of-life systems. The findings didn't kill the deal — they repriced it: remediation cost moved into the purchase price, cyber warranties into the agreement, and a 100-day security plan into the closing conditions.

Red-flag summary delivered
day 6
Material findings surfaced pre-signing
3
Read the engagement
Representative engagement
DFIR & ForensicsLogistics / freight forwarding

Containing a business email compromise before the wire cleared

Privately-held freight forwarder, ~400 staff, Microsoft 365 estate

A freight forwarder's finance team caught a supplier payment that didn't feel right — the account details had changed in a thread that read exactly like their supplier. It was a compromised mailbox with inbox rules hiding the real correspondence. Emergency response locked the estate down the same day, forensics mapped exactly which mailboxes and threads were touched, and the pending transfer was recalled before it cleared.

Funds lost
$0
Time to estate-wide containment
< 24h
Read the engagement
Representative engagement
Cloud / DevSecOpsEnterprise software / developer tooling

An SBOM program that turned 'are we affected?' into a minutes-long question

Growth-stage devtools vendor, ~200 staff, shipping self-hosted and cloud editions

When a critical dependency vulnerability landed, this vendor's last response took three engineers most of a week grepping build files — while enterprise customers demanded answers they didn't have. We built the dependency inventory they thought they already had, wired SBOM generation into CI for every release, and hardened the build pipeline the SBOMs describe. The next advisory was answered from a query, not an archaeology dig.

Advisory impact triage
~1 week → same morning
Dependencies invisible to previous tooling
hundreds
Read the engagement
Representative engagement
Defense & MDRMedia / digital publishing

A proactive threat hunt that evicted persistence before data left the building

Digital publishing group, ~600 staff, hybrid cloud and on-prem estate

No alert had fired. The publisher commissioned a hypothesis-driven threat hunt as an assurance exercise — and the hunt found a webshell on a forgotten staging server and credential-harvesting activity that existing tooling had been silently missing for weeks. Eviction ran as a coordinated action before any evidence of bulk data exfiltration appeared, and the telemetry gaps the attacker had lived in were closed under ongoing MDR.

Alerts fired before the hunt
0
Attacker activity window reconstructed
~5 weeks
Read the engagement

Have a similar challenge?

Tell us what you're facing — we'll scope the right engagement.

Start a conversation
Case Studies — Security Engagements & Outcomes — Solvex Space