Situation
A Series B fintech startup had hit product-market fit and was starting enterprise sales. But every large customer was requesting SOC2 certification and detailed security reviews.
The security reviews were taking 4-6 weeks to complete because the team had never documented their practices. Security lived in people’s heads. There was no inventory of systems, no data flow documentation, no formal access control policy.
Meanwhile, their biggest deals—worth £500k-£1M each—were stuck waiting for security sign-off.
Approach
We started with an assessment of their current state:
- What systems handle customer data?
- Who has access to what?
- What are your actual security practices?
- What’s the gap between what you do and what SOC2 requires?
Rather than implement a heavyweight compliance program, we focused on three things:
1. Document reality first. Spent 6 weeks mapping what they were actually doing (not what they should be doing). This became the foundation for everything else.
2. Fix the biggest gaps. Access control and vendor management were the biggest vulnerabilities. We built a simple vendor assessment process and tightened access controls.
3. Build the SOC2 narrative. SOC2 isn’t about being perfect—it’s about having a coherent story. We documented their controls, linked them to SOC2 requirements, and prepared audit evidence.
Results
Within 6 months:
Security reviews went from 4-6 weeks to 1 week. Because everything was documented, responding to customer questionnaires became straightforward instead of a research project.
They passed their SOC2 Type I audit. More importantly, they now had a documented security program that actually reflected their practices.
The £2M in blocked pipeline moved. Enterprise customers could sign because security was no longer a black box.
They stayed lean on headcount. No full-time security hire needed—a fractional CISO plus one contractor handled everything.
Key insight
The biggest win wasn’t compliance. It was turning security from a mysterious blocker into something customers understood and felt confident about. Once they could articulate their practices clearly, the objections disappeared.
Enterprise customers don’t need perfect security. They need to understand your security and feel confident you’re not reckless.