Vulnerability Management Program for a Credit Union
Mean time to remediate critical findings brought down from 63 days to 9.
Client name withheld by agreement- Client
- Credit union, 300,000 members
- Region
- Texas, U.S.
- Year
- 2024
- Duration
- 12 weeks
- Scope
- 6,500 assets · 48 branches
- Practice
- Offensive Security & Resilience
The challenge
What was at stake.
A credit union serving 300,000 members scanned constantly but fixed slowly. Thousands of findings sat in spreadsheets, and examiners had started asking pointed questions.
The IT team was small. It needed to know which few findings truly mattered.
What we did
The approach, step by step.
- 01
Full asset inventory
6,500 assets across 48 branches identified and assigned to owners.
- 02
Risk-based prioritization
Findings ranked by exploitability, exposure and business impact instead of raw severity scores.
- 03
Remediation service levels
Clear deadlines by risk tier, tracked weekly with the IT team.
- 04
Examiner-ready reporting
Trend reporting the board and examiners can read in two minutes.
Outcomes
What changed, in numbers.
- 63 to 9 days
- mean time to remediate critical findings
- 6,500
- assets inventoried and owned
- 48
- branches brought into one program
- 0
- repeat examiner findings
Our examiners now ask us how we did it.
Services delivered
Related engagements
More work in Offensive Security & Resilience.
-
United States · 8 weeks
Offensive Security & Resilience · 2025Pre-Peak Penetration Testing for a National RetailerTwo critical payment-page exposures found and fixed six weeks before holiday trading.
-
Gulf Coast, U.S. · 20 weeks
Offensive Security & Resilience · 2024OT-Safe Ransomware Resilience for an Energy UtilityRecovery time for core systems proven at under 18 hours, without touching live operations.
-
Dallas, Texas · 24 weeks
Offensive Security & Resilience · 2025 · OngoingOne Evidence Model for a Fintech LenderFour frameworks mapped to one control set, with audit evidence requests down by two thirds.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.