Cautio

BACKGROUND

Please describe your company and your position there.

Safee is a technology company that serves the supply chain and logistics market with innovative range of software.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Cautio?

Safee operates in a heavily regulated market where certain standards must be fulfilled. One of them is undergoing regular penetration testing and the reporting of results of periodical penetration testing.

SOLUTION

How did you select this vendor and what were the deciding factors?

Our selection criteria was mainly bases on the following factors:

• Security Expert who understands software development stages and company maturity stages.
• Security Expert who understand system architecture and can evaluate the viability of choices that seem astray from standard security recommendations.
• Security Expert that we can working with on long term basis to supervise our system growth and rescopes security focus as we grow.
• Security Expert that can explain approach, findings and recommendations to non technical people, like me.

Describe the project in detail and walk through the stages of the project.

The project followed the following main stages:

• Understanding business, system architecture, and functionalities.
• Running system penetration tests on certain system components/ functionalities.
• Reporting and discussing findings.
• Finalize recommendations with proposed approach for resolving security concerns.
• Our team works on implementing the recommendations.
• System penetration redone again.
• Affirmation of closure of security concerns.
• Regulatory Report writing.
• Regulatory Report Submission.
• Continuous penetration testing at specific time periods and specific system development milestones.

How many resources from the vendor's team worked with you, and what were their positions?

One resource, mainly due to our system scale at that time.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

Our regulatory submission have been examined and passed all regulatory requirements, and we maintain our regulatory accreditation through two major system scans and reporting per year

How effective was the workflow between your team and theirs?

Very efficient and to the point.

What did you find most impressive or unique about this company?

Cautio did not only perform a system scan, they provided us clarity on what we will have to deal with in the future given different pathways. These insights are now part of our system development and architecture considerations.

Are there any areas for improvement or something they could have done differently?

We haven't had anything of concern as we worked on the project. In fact we do have a continuous relationship with Cautio. They are like our lawyer on retain.