How to Build the Security Posture in Saas company

Case study overview

Industry	AI · SaaS · Procurement Technology
Company size	50–100 employees
Product	AI-powered procurement intelligence platform
SEDIVIO products used	Cyrima · TestSec
Challenge	ISO 27001 required by enterprise clients, application security testing not keeping pace with releases
Result	ISO 27001 certified, continuous penetration testing in place, compliance embedded in Jira

24/7

continuous penetration testing across the full application and API surface

100%

of ISO 27001 controls tracked with a named owner and documented evidence

The Challenge

Selling AI into enterprise manufacturing

Enterprise procurement teams in manufacturing routinely request it as part of their own supply chain compliance obligations. Without it, conversations with the largest prospects were difficult to progress regardless of the product’s capabilities.

At the same time, their engineering team was shipping a fast-evolving AI platform — new agents, new integrations, new API surfaces added regularly. Annual penetration tests could not cover a product that changed this quickly. Vulnerabilities introduced between test cycles went undetected, and the team had no continuous visibility into its application security posture.

Before SEDIVIO

ISO 27001 certification not yet in place blocking enterprise deals
Compliance tasks tracked informally with no clear ownership
Annual security tests unable to keep pace with product releases
New AI agents and API integrations going untested between cycles
No live visibility into compliance or security posture

After SEDIVIO's help

ISO 27001 certified — procurement conversations unblocked
All controls tracked as Jira tasks with named owners and evidence
Continuous testing covering the full platform and API surface 24/7
New features and integrations automatically added to testing scope
Real-time compliance and security posture visible at any point

The Solution

Compliance and security running at the pace of an AI product team.

SEDIVIO implemented Cyrima and TestSec in a single engagement, addressing both the compliance gap and the security testing gap together. The two products worked in parallel — Cyrima ensuring ISO 27001 obligations were tracked and evidenced inside the development workflow, and TestSec ensuring the platform those obligations covered was continuously tested.

Cyrima: ISO 27001 mapped to the Jira workflow

Cyrima mapped ISO 27001 and GDPR requirements to Jira tasks automatically. Each control was assigned to a team member and tracked alongside regular development work. Evidence was captured inside the ticket as tasks were completed.

TestSec: full attack surface covered continuously

TestSec mapped entire external attack surface — the web application, all APIs, and any new services added during development. Continuous automated testing ran 24/7 without agents or disruption to the live platform. New endpoints and integrations were detected and added to scope automatically as the product evolved.