Clearing a security backlog before it cost the enterprise deals

The provider sold a learning and student engagement platform used by universities. It had grown well in the mid-market and had then hit a wall: four enterprise procurement cycles in eighteen months had stalled at security review, and two of them had gone to a competitor with a SOC 2 report.

Security had been handled the way it often is in a fast-growing product company — an annual penetration test, findings triaged into the backlog, and most of them still sitting there. The backlog was not evidence of negligence so much as of a team that had prioritised features while the buyer profile changed underneath it.

The findings that mattered were architectural rather than cosmetic. Authorisation was enforced inconsistently across services, tenant boundaries relied on application-layer checks that a developer could forget, secrets were held in configuration files, and audit logging was insufficient to reconstruct who accessed a student record.

Student data raised the stakes. The platform holds education records subject to FERPA in the United States and personal data subject to GDPR for institutions with European students, and the customers asking the hardest questions were the ones with the largest deal values.

Answering a security questionnaire took weeks because the answers had to be researched each time. There was no maintained control documentation, so every questionnaire was effectively a fresh internal investigation.

The objectives: remediate critical and high findings with the architectural causes rather than the symptoms, enforce tenant isolation and authorisation at the platform layer, move security testing into the development pipeline, establish maintained control documentation, and reach SOC 2 Type II readiness.

The work started with an architectural review rather than a scanner run. Most of the recurring findings traced back to a small number of structural decisions, and remediating those removed whole classes of finding rather than individual instances.

Authorisation was consolidated into a central policy service. Previously each service implemented its own checks, which is why coverage was inconsistent and why a new endpoint could ship without one. Every request now passes through a single evaluation point with policies defined as code and covered by tests.

Tenant isolation was moved from application logic into the data layer using row-level security tied to the authenticated tenant context. A developer can no longer accidentally write a query that crosses an institutional boundary, because the database will not return the rows.

Secrets were removed from configuration and moved to a managed secrets service with short-lived, automatically rotated credentials. Historic secrets found in the repository history were rotated and the history was cleaned as part of the same exercise.

Audit logging was rebuilt around the question the customers actually asked: who accessed which student record, when, and from where. Logs are structured, tamper-evident, and retained on a defined schedule rather than being an operational byproduct.

Security testing then moved into the pipeline — dependency scanning, static analysis, container image scanning, secret detection, and infrastructure-as-code policy checks on every build — so new findings surface in a pull request rather than in next year’s penetration test. Control documentation was written as the work was done and is maintained alongside the code it describes.