Strengthening security across a live payments environment.
PesaWay operates a payments technology environment where availability, customer information and transaction security are central to the business. Seraph Cyber was engaged to assess and strengthen security across multiple layers while working carefully around a live, always-on operation.
Testing security without disrupting the business.
PesaWay required a security partner capable of thoroughly testing its external application and APIs while respecting the operational requirements of a production payments environment. The engagement also needed to provide visibility beyond application security, including employee phishing exposure, endpoints, infrastructure architecture and the organisation's collaboration environment.
- Production, always-on payments environment
- Customer information & transaction security in scope
- External application, API & collaboration environment
- Testing required minimal disruption to live operations
Our Approach
Application & API Security
Penetration testing of the external web application and APIs, covering authentication, access control, input validation, API authorisation and potential data-exposure risks, aligned to OWASP Top 10 and SANS/CWE considerations.
Human Risk
A two-stage phishing simulation and awareness exercise provided an evidence-based view of employee response to phishing threats.
Infrastructure & Endpoint Security
Seraph conducted endpoint security assessment and architecture analysis across the infrastructure and web application environment.
Microsoft Security Transformation
Seraph supported migration from Google Workspace to Microsoft 365, followed by deployment of Microsoft Intune and Microsoft Defender.
Findings designed to be acted on.
Findings were practical and reproducible, with clear remediation guidance. Issues requiring urgent attention were escalated during the engagement rather than being held until final reporting. Testing and migration activities were performed with minimal disruption and with careful handling of sensitive customer information.
Thorough testing. Live operations, uninterrupted.
A production payments environment can't be taken offline to test it. Every assessment — application, API, endpoint and phishing simulation alike — was scoped and paced around PesaWay's live operations, with urgent issues flagged immediately rather than saved for a final report.
A broader view of security across the environment.
The engagement provided PesaWay with security visibility spanning applications, APIs, employee behaviour, endpoints, infrastructure and Microsoft security controls. The technical team received reproducible findings and clear remediation actions rather than unvalidated scanner output.
“The findings were practical — real, reproducible issues with clear remediation steps.”
Evidence before conclusions.
Validate
Confirm technical findings before presenting them as material risk.
Escalate
Communicate urgent findings during the engagement rather than waiting for final reporting.
Explain
Give technical teams the evidence they need while giving leadership clear business context.
Verify
Where included in scope, retest remediation to confirm whether the issue has actually been resolved.
Put your security controls to the test.
Talk to Seraph Cyber about assessing your environment, validating technical risk and building a clear path to remediation.