Systemic European bank: industrializing secure development at scale

Context

A systemic European bank with dozens of agile squads delivering business-critical applications. Veracode (SAST/SCA) and AppScan (DAST) were deployed, but enforcement was fragmented, the vulnerability backlog kept growing and developer adoption varied from team to team.

FuturWork embedded a senior Application Security expert for two years to reinforce secure SDLC practices, industrialize CI/CD security gates and drive developer enablement.

Challenges

• Controls present but not industrialized. Jenkins pipelines were configured inconsistently, some scans were triggered manually, and false positives caused tool fatigue.
• High vulnerability backlog. Critical and high findings piled up, with recurring flaws such as XSS, injection and insecure deserialization.
• No standard governance or reporting. Tracking was fragmented and management had little visibility.

What we did

• Industrialized Jenkins security gates. Veracode scans were built into CI pipelines with standard security stages and policy-based quality gates.
• Risk-based remediation. Structured triage with squads, SLAs per severity and an escalation workflow for overdue criticals.
• Coaching and governance. Recurring training, targeted code reviews, updated secure coding guidelines and executive dashboards.

Results

• 100% of releases scanned
• 45% reduction of the critical backlog
• 35% faster remediation cycles
• 40% fewer false positives
• 25% fewer recurring OWASP flaws

From tool-based scanning to industrialized secure development at enterprise scale.

Facing a similar challenge? Talk to our team.