Northwind — pen-test & hardening
Full-scope penetration test and production hardening engagement for a Series B fintech processing $40M/month.
- Grey-box web app pen-test
- Cloud infrastructure review (AWS)
- WAF + header hardening
- 90-day remediation retainer
- Engineering ticket pipeline integration
What they needed to solve.
Northwind was preparing for SOC 2 Type II and needed to close critical gaps before their audit window. The previous pen-test report was 240 pages and had been gathering dust in a Notion archive for 18 months.
How we approached it.
A three-phase engagement: grey-box web application pen-test, cloud infrastructure review, and a 90-day remediation retainer. Every finding mapped to a CVSS score, a concrete engineering ticket, and a clear rationale for why it matters this quarter versus next.
Design decisions.
- AaSöhne Mono — report body
- AaSöhne Breit — exec summary
Findings ranked by impact × exploitability. Each finding is a single Jira-ready page, not a chapter.
- Engineering-readable report (≤ 60 pages)
- Findings exported as Jira tickets via API
- Re-test included for every critical / high
What changed.
240-page PDF report, no engineering action plan, no Jira tickets, no re-test included, blocked SOC 2 timeline.
Engineering-readable report, Jira tickets, full WAF, re-tests, SOC 2 Type II passed first attempt.