Research Library / Case Studies /

Fintech

A Fintech Frontier Entrusts Payatu's Precision in SOC Services

A fintech company handling large volumes of sensitive customer data needed round-the-clock visibility into threats across its cloud and productivity platforms. Payatu stood up and ran a Security Operations Center covering eight critical platforms with 24x7 monitoring, ticketing, reporting and incident response.

Security Operations Center (SOC)

At a glance

INDUSTRY

Fintech

CLIENT PROFILE

Audit recovery services and source-to-pay automation provider

SERVICES

Security Operations Center (SOC)

ENGAGEMENT

Managed 24x7 SOC monitoring and incident response

Key Takeaways

Client – A fintech company providing audit recovery and source-to-pay automation services, handling large volumes of sensitive customer financial data.

Problem – The client needed to strengthen its security posture and lacked round-the-clock visibility into threats across its cloud and productivity platforms.

What Payatu did – We stood up a Security Operations Center delivering 24x7 monitoring, ticketing, reporting and incident response across eight platforms including Microsoft Azure AD, Microsoft 365, SFTP servers, Azure DevOps and a cloud data platform.

Outcome – The client now has an established security baseline, a documented network diagram, audited email policies that cut down spam and phishing, incident SOPs and weekly SOC reporting.

the challenge

Why the client called us in

As a fintech company handling large volumes of sensitive customer data, the client recognized that the first step to protecting that data was identifying gaps in its security posture. Rather than build an internal monitoring capability from scratch, it wanted continuous, expert-led visibility across its cloud platforms, productivity suite and infrastructure. The client approached Payatu to set up and run a Security Operations Center that could detect and respond to threats around the clock.

Establish 24x7 monitoring across critical platforms
Get structured ticketing, reporting and incident response
Receive actionable, trend-based security recommendations

scope of engagement

What was in scope

24x7 monitoring support across all in-scope platforms
Ticketing for every identified alert and incident
Regular reporting to the client's security and management teams
Response workflow including weekly advisories and daily updates on emergency alerts
Monitoring of the Email Archiving Platform for brute-force logins, foreign-country logins and persistence attempts
Monitoring of SFTP servers for brute-force logins, new services and sudo command execution
Monitoring of Microsoft Azure AD for privilege role assignment, OAuth app additions and impossible travel activity
Monitoring of Azure Virtual Desktop, Microsoft 365, the Cloud Data Platform, Azure DevOps and the Project and Work Management Platform

Our Approach

How Payatu ran the engagement

01

Ticket Creation and Initial Triage

Every alert was opened as a ticket and given an initial triage pass to capture the basic details.

02

Investigation

Analysts dug into each alert, running queries and analysis to establish what had actually happened.

03

Client Input and Escalation

Where more information was required, we queried the client directly and flagged delayed responses as blocked items until data came through.

04

Conclusion and Recommendations

Each ticket was closed out with a conclusion and recommendations, feeding into weekly advisories and ongoing security guidance.

Key findings

What we found

Security Baseline

No established security baseline existed prior to the engagement; one has now been created and is continuously maintained.

Network Visibility

No network diagrams existed, leaving devices unidentified and unmanaged across the environment.

Email Security

Exchange and email policies were improperly configured, contributing to spam and phishing volume reaching users.

Incident Process

No Standard Operating Procedures existed for handling incidents and alerts.

the outcome

Results and Impact

Through the SOC engagement, the client moved from ad hoc, undocumented security operations to a structured, continuously monitored environment. Email hygiene improved, previously unmanaged devices were brought into view, and the security team now works from documented baselines and processes instead of institutional memory.

‍