We replaced a fund manager's broad VPN access with zero-trust controls that check the user, device and location, and grant privileged access only when it is needed. They cover 100% of identities and cut lateral-movement risk by 99%.
Industry: FinTech & Financial ServicesService: Cloud & DevOpsUpdated
Overview
The challenge
The client relied on older VPNs that gave broad network-level access. Once someone was inside, they could see sensitive databases and trade-execution engines, so a single stolen password could do a great deal of damage.
Most staff held admin rights they rarely needed, nothing stopped an attacker moving between systems, and setting up access for a new investment team took days of firewall tickets.
80% of staff had permanent Admin or Editor access to environments they only needed for seasonal reporting.
With no micro-segmentation, a single phished password could expose the entire business ledger.
Setting up secure access for a new investment team took 5+ business days of manual firewall tickets.
The solution
We added a global identity-aware proxy (IAP) that checks the user's identity, device health and location before any service can be reached.
Permanent admin rights were replaced with a just-in-time (JIT) request flow. Privileged access is granted for 4-hour windows through automated Slack approvals.
SPIFFE/SPIRE gives every microservice a short-lived identity verified with mutual TLS (mTLS), which removes static secrets and hard-coded API keys.
Before and after
Before
Trusted on the network
Once on the VPN, a user was trusted and could scan the internal network.
After
Checked at every resource
Access is denied by default, and every request is checked again at the resource.
Before
Hard to use
Slow VPN connections and repeated password prompts across tools.
After
Simple single sign-on
One cryptographic identity session covers all internal and cloud systems.
Before
Separate logs
Firewall logs and app logs were disconnected, so tracing an incident was slow.
After
One connected record
Every action is tied to a verified identity and device ID in a secure, traceable log.
Key features
Sidecars handle identity automatically, so developers never write sign-in code or manage secrets by hand.
Business impact
Zero auth code in apps
The platform keeps checking devices during each session, including disk encryption and OS patches, and cuts access automatically if a check fails.
Business impact
100% live compliance
Results
99% Blast Radius
Micro-segmentation means one compromised account can no longer reach neighbouring service clusters, cutting lateral-movement risk by 99%.
Before: High RiskAfter: Isolated
30x Faster Onboarding
Identity-based permissions replaced manual firewall tickets, so new investment teams get access in 4 hours instead of 5 days.
Before: 5 DaysAfter: 4 Hours
Faster delivery
These modules saved about 10 weeks of setup, which went into the SPIFFE service identities and the Slack approval flow.
Provided the OIDC and MFA base behind the identity-aware proxy.
Tied every action to a verified identity and device ID in one log, so incidents can be traced from a single place.
Enforced the deny-by-default rules and the 4-hour limit on privileged access.
Trust and control
The set-up is aligned with NIST 800-207 and FFIEC zero-trust maturity requirements for global financial institutions.
SecureIdentity data and audit logs are split by region to meet local data residency laws such as GDPR and APPI.
Verifiable dataProxy clusters run in 3 regions with automatic failover.
Zero downtimeThe client owns 100% of the zero-trust configuration, proxy logic and identity scripts.
100% ownedWe put a global identity-aware proxy in front of every service. It checks the user's identity, device health and location before allowing a connection, in under 40ms at p95. Access is denied by default, and admin rights are granted only for 4-hour windows through automated Slack approvals.
The controls cover 100% of identities and cut lateral-movement risk by 99%, so one compromised account can no longer reach neighbouring systems. Access for new investment teams now takes 4 hours instead of 5 days, which is 30x faster. Staff also use one sign-on instead of slow VPN connections.
The platform is aligned with NIST 800-207 and FFIEC zero-trust maturity requirements for global financial institutions. Identity data and audit logs are split by region to meet data residency laws such as GDPR and APPI, and every action is tied to a verified identity and device ID in a traceable log.
If one stolen password could open your whole network, we can help you move to zero-trust access without slowing your teams down.