[ Customers / Case studies ]
Numbers with denominators
Security vendors love a percentage. We publish the measurement window, the sample size, and who did the measuring — because a metric you can interrogate is worth ten you have to take on faith.
[ How we report numbers ]
Read this before the case studies
- Numbers are customer-reported and time-boxed — we publish the measurement window, not just the delta.
- Denominators are shown. '22% faster across 14 deals' beats '22% faster' and we say so.
- Reductions in findings reflect the customer's remediation work, prioritized by Vault — the platform finds; people fix.
- No extrapolation, no composites, no 'up to'. If a sample is small, we label it small.
- Results are illustrations, not guarantees. Your estate, team, and baseline will differ.
Meridian Trust Bank
Financial services · 4,600 employees · regional bank
- AWS
- Azure
- On-prem core
[ The problem ]
Two overlapping exam cycles (FFIEC and NYDFS) consumed most of two quarters. Evidence lived in 31 tools and a heroic spreadsheet; the security team could describe risk but not rank it, and 'critical' findings numbered in the thousands.
[ What we did ]
Connected 118 cloud accounts agentlessly in week one. Posture Graph collapsed the finding queue into ranked attack paths; the Evidence Engine mapped both exam regimes to one control set and began continuous collection. The examiner workspace went live for the next cycle.
"Examiners asked how we produced evidence this current. That is a sentence I had never heard in eleven exam cycles."
- audit field-work window, 2024 cycle vs 2025 cycle
- 9 wks → 11 days
- open critical attack paths in the first 90 days
- 214 → 9
- of exam evidence auto-collected, per their internal PMO
- 83%
- retired at renewal, funding the program's next hire
- 6 tools
Helixware Health
Health-tech SaaS · 340 employees · clinical workflow platform
- Google Cloud
- Kubernetes
[ The problem ]
Enterprise hospital deals were stalling on security review: no SOC 2 Type II, HIPAA posture asserted but not evidenced, and a three-week average turnaround on 300-question security questionnaires — fatal against funded competitors.
[ What we did ]
Evidence Engine cross-mapped HIPAA and SOC 2 into one control program with owners and due dates. Posture Graph's data classification located and traced every PHI store. Questionnaire answering drafted responses from live control state, with citations.
"We stopped losing deals in security review. Not 'fewer' — stopped. The trust page plus a four-day questionnaire turnaround changed how procurement treats us."
- first SOC 2 Type II report, full observation period
- 0 exceptions
- median security-questionnaire turnaround
- 3 wks → 4 days
- shorter enterprise sales cycles, measured across 14 pre/post deals
- 22%
- of PHI stores classified and reachability-mapped
- 100%
Parcelworks
Logistics SaaS · 1,150 employees · multi-cloud after two acquisitions
- AWS
- Google Cloud
- Kubernetes
[ The problem ]
Two acquisitions left three CSPM tools, three alert queues, and no shared definition of severity. On-call security engineers were paged 40+ times a week, mostly for findings nobody would ever fix.
[ What we did ]
All three estates joined one Posture Graph in the first month. Toxic-combination scoring replaced three severity schemes; detections were consolidated into Runtime Detect with dedup routing, and the eBPF sensor was rolled out only to the payment-adjacent clusters.
"We did not buy a dashboard; we bought back our on-call rotation. The pager going quiet was the moment the team believed."
- reduction in alert volume at equal detection coverage, over 60 days
- 71%
- fewer overnight security pages to on-call engineers
- 58%
- posture tools after consolidation, at lower total spend
- 3 → 1
- measured sensor CPU overhead on payment clusters
- 0.6% p95
Meridian Trust Bank, Helixware Health, and Parcelworks are fictional companies. These case studies illustrate how honest customer evidence should be reported — they are not real results.
[ Next step ]
Become the fourth case study
Every engagement starts the same way: a 45-minute demo on your environment, a 14-day proof of value, and numbers we would both be comfortable publishing — denominators included.