Bundle United Kingdom

BACKGROUND

Please describe your company and position.

I am the Chief Technology Officer (CTO) of CDL Software

Describe what your company does in a single sentence.

We are a regional FinTech startup that provides a peer-to-peer (P2P) lending and mobile banking platform. Our app constantly processes confidential payment data, does transactions and user identity verification on a daily basis.

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Bundle United Kingdom to accomplish?

• Before we secure our Series B funding, we want to conduct a security audit and vulnerability assessment on our website and mobile app.
• Assist us in attaining SOC 2 Type II compliance.
• Internal phishing tests mimic real attacks through pre-configured scenarios or default templates.

SOLUTION

How did you find Bundle United Kingdom?

• Online Search
• Clutch Site

Why did you select Bundle United Kingdom over others?

• High ratings
• Pricing fit our budget
• Good value for cost
• Company values aligned

How many teammates from Bundle United Kingdom were assigned to this project?

Other

Describe the scope of work in detail. Please include a summary of key deliverables.

Represent Studio served as our external security partner. They didn't just run automated scanners; their team performed deep manual testing.

1. Their key deliverables included:
2. Both white-box and black-box penetration testing on our iOS, Android, and web applications.
3. A comprehensive security review of our third-party APIs and payment gateway integrations.
4. Running simulated phishing campaigns to test our employees' security awareness.
5. Delivering a prioritized remediation roadmap with step-by-step instructions on how to patch identified vulnerabilities.

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

1. As a result of the partnership, our board of directors and our investors were calmed completely.
2. They discovered two critical vulnerabilities in our API logic and assisted us in patching them before exploitation.
3. Thanks to their extensive audit, we passed our SOC 2 Type II certification in the first go!
4. Our internal team’s time-to-respond to threats has improved dramatically with this framework and way of working.
5. Any violations in security must be avoided. We have had no incident of a security breach since we started.

Describe their project management. Did they deliver items on time? How did they respond to your needs?

100-page Reports are Quite Useless. The educational approach of Represent Studio is their forte.  Many cybersecurity firms are known to run away, tossing a 100-page pdf report over the fence. Their “white-hat” engineers took the time to sit on video calls with our developers to explain the why behind the vulnerabilities and how to write it more securely moving forward.

What was your primary form of communication with Bundle United Kingdom?

• In-Person Meeting
• Email or Messaging App

What did you find most impressive or unique about this company?

The execution was technically flawless. If there is one thing I would recommend, the first draft of their final report was almost too technical and difficult for our non-technical executives and board members to read. But, as we asked, they quickly put together a wonderful 2-pager executive summary in 24 hours that perfectly highlighted business risks.

Are there any areas for improvement or something Bundle United Kingdom could have done differently?

Our entire journey with Bundle United Kingdom has been quite an experience and we have really liked the final product. The first onboarding and knowledge-transfer experience is an area I would mention for minor development. It took longer than we intended for their team to fully integrate into our internal project and start getting used to the micro minutiae of our industry-specific jargon. It was not much of an issue the first week, and after setting baseline, workflow with them is very smooth and proactive. Our submission deadlines for the project were not impacted in any way.