The situation
A software vendor is starting to win larger accounts, and each deal now brings a detailed security questionnaire. Controls have grown organically, access has accumulated over the years, and no one person owns the overall picture.
The company needs to fix real weaknesses first, then prove the fixes to its customers and auditors.
The challenge
Over-broad cloud access
Long-lived credentials and wide roles mean one compromised account could reach too much.
Limited engineering time
Security work has to fit around a committed product roadmap.
Proof, not promises
Auditors and customers expect evidence that controls run consistently.
The approach
- 1
Scope and authorisationWeek 1
Agree assets, objectives and rules of engagement in a signed document.
- 2
Authorised assessmentWeeks 2–4
Test the application, APIs and cloud environment, focusing on paths to customer data.
- 3
Remediate with engineersWeeks 5–10
Work alongside developers to close findings and automate checks in the pipeline.
- 4
Readiness and retestWeeks 11–14
Finalise policies, collect evidence, retest every fix and prepare for the auditor.
Key decisions and trade-offs
Fix attack paths before writing policies
Why: Documentation should describe security that really exists.
Trade-off: Audit paperwork starts later in the programme.
Replace long-lived keys with short-lived identity
Why: This eliminates the most common route to a serious cloud compromise.
Trade-off: Deployment tooling needs to be changed across the board.
Automate evidence collection
Why: Continuous evidence is more credible and far less work to maintain.
Trade-off: Adds an annual platform subscription.
How success is measured
| Measure | Baseline | Target | How it’s measured |
|---|---|---|---|
| Critical findings | Established by test | 0 open | Independent retest of all findings |
| Time to fix criticals | No defined process | <7 days | Ticket timestamps |
| Long-lived credentials | Inventory in week 1 | Fully retired | Cloud posture scans |
| Audit readiness | Not assessed | SOC 2 Type I ready | Pre-audit gap review |
Key takeaways
- Fix the path to the data first, and the long tail second.
- Engineers adopt security controls that make their work easier.
- An auditor issues the report, but readiness is won months earlier.