From 94 Days to 6 Hours: Cloud Security Overhaul and SOC Build for an Enterprise Financial Services Firm Operating Across Three Jurisdictions
A penetration test revealed 14 critical findings across a financial services firm's AWS and Azure environments including client financial data publicly accessible online. With a regulatory review 18 weeks away and zero detection capability, Cybasco delivered a complete cloud security overhaul and SOC build. Mean time to detect moved from 94 days to 6 hours. The regulatory review found zero critical findings.
An enterprise financial services firm managing client assets across three regulatory jurisdictions had migrated its operations to cloud infrastructure over three years. Each system had been migrated independently, under separate project timelines, by different technical teams, without a unified cloud security framework governing the migration decisions. The result was a cloud environment that had grown considerably faster than the security controls designed to protect it. A mandatory third-party penetration test, conducted as part of a regulatory preparedness review, produced a findings report that warranted immediate executive escalation. Fourteen critical findings were identified across the combined AWS and Azure environment. Among them: three S3 buckets containing client financial records, investment positions, and personally identifiable information were publicly accessible without authentication. Multiple IAM configurations contained excessive privilege. Network security group rules allowed lateral movement between environments. MFA was not enforced for administrative access to production systems. Logging and monitoring coverage was insufficient to detect the majority of the attack scenarios tested. The penetration tester's assessment of the firm's current detection posture was stark: under existing conditions, a sophisticated attacker could maintain presence in the environment for an estimated 94 days before generating an alert. In a financial services context where regulatory frameworks impose prompt incident notification obligations and where client asset security is a fiduciary duty this was not an acceptable risk position. A regulatory review was scheduled for 18 weeks from the engagement start. The outcome of that review would determine the firm's continued operating authorization in one of its three jurisdictions.
The firm's trading and client management systems were live throughout the engagement. Remediation could not introduce system downtime or affect client-facing operations.
Three separate regulatory frameworks one per jurisdiction imposed differing incident notification requirements, data residency obligations, and security control standards that the remediation had to satisfy simultaneously.
The absence of any SIEM or SOC capability meant that the detection infrastructure did not exist and had to be built from zero within the engagement window, not enhanced from an existing baseline.
The three publicly accessible S3 buckets represented potential breach exposure at the moment of discovery requiring immediate remediation before any other engagement activity could proceed.
Three publicly accessible S3 buckets containing client financial data secured within 48 hours of engagement start access restricted, bucket policies corrected, access logging enabled. Full IAM audit across AWS and Azure identified 94 accounts and service principals with permissions exceeding operational requirements least-privilege remediation reduced excess permissions by 78% without disrupting any operational workflow. 47 overly permissive network security group rules corrected against CIS Benchmark standards. MFA enforced for all administrative access to production systems. Server-side encryption validated and enforced for all client data storage. Full ISO 27017 and ISO 27018 control gap assessment completed and remediated.
34 log sources identified, prioritized, and onboarded across AWS CloudTrail, Azure Monitor, network infrastructure, and application layers. 32 SIEM use cases engineered, tested, and tuned specifically for the firm's environment and financial services threat model covering authentication anomalies, lateral movement, data exfiltration patterns, privilege escalation, and sector-specific attack scenarios. Alert thresholds calibrated against 30 days of baseline traffic to minimize false positive volume. Automated enrichment configured for highest-priority alert categories, reducing analyst investigation time per alert
12 scenario-specific incident response playbooks written for financial services attack patterns. Escalation matrix defining notification paths, regulatory reporting obligations by jurisdiction, and client communication procedures. SOC operational model defining analyst roles, shift coverage, and escalation authorities. Board KPI dashboard for monthly security performance visibility. 90-day post-engagement transition plan enabling internal team to assume full SOC operational ownership.
The regulatory review, conducted at week 18, found zero critical findings a complete reversal of the penetration test results that had initiated the engagement. The regulator formally noted the implementation of comprehensive logging, monitoring, and incident response capability as positive evidence of operational security maturity. The firm retained its operating authorization across all three jurisdictions. The detection improvement was the most quantifiable outcome: mean time to detect moved from the penetration tester's estimated 94-day exposure window to a measured 6 hours under the implemented detection posture a 99.7 percent improvement in detection velocity. This single metric transformed the firm's risk exposure profile from one of the most vulnerable in its peer group to one of the most responsive. The 32 SIEM use cases deployed into live production generated alerts within the first 30 days of operation. Two of those alerts identified unauthorized access attempts that the previous environment with no detection capability would not have registered at all. The remediation of 94 over-privileged IAM accounts eliminated lateral movement pathways that the penetration test had demonstrated were exploitable. The firm subsequently used its cloud security and SOC governance transformation as a primary differentiator in three institutional client RFP processes each of which included security questionnaire requirements that the firm was now positioned to answer comprehensively and with documented evidence for the first time. "The penetration test told us we had 94 days of exposure we could not detect. Within 18 weeks, Cybasco had closed every critical finding, built a detection capability we did not have, and delivered a regulatory review with no findings. The 6-hour detection time is not just a security metric. It is a client promise we can now make and keep." — Chief Risk Officer, Enterprise Financial Services Firm
Cloud environments that grow faster than the governance around them are not unusual they are the norm across organizations that prioritized migration velocity over security architecture. The risk this creates is not theoretical. It is a penetration test finding away from becoming a regulatory event. What this engagement demonstrates is that a cloud security posture and detection capability of genuine enterprise depth can be built within a defined window, against a regulatory deadline, in a live financial services environment where downtime is not an option. The 94-day-to-6-hour detection improvement is the number that represents this outcome most precisely. It is the difference between an attacker who has time and an attacker who does not.