Its work often includes building and running the websites and campaign platforms its clients depend on, which is where enterprise security expectations come into play.
The agency had won the commercial and creative evaluation for a multi-year engagement. The final step was procurement, where the buyer's security team required evidence of an independent penetration test of the platform, along with responses to a detailed security questionnaire.
Scoping the test against what the buyer actually asked
The engagement began with a review of the buyer's security requirements, so the test scope addressed every item explicitly rather than covering the ground a standard scope would and leaving gaps to argue about later.
Intrudify tested the platform, websites and hosting environment in scope, validating each result and documenting reproduction steps, impact and remediation guidance. This is LD's development team completed the follow-up work, and Intrudify re-tested and issued a closure confirmation.
Documentation written to be read by a security reviewer
The final package included the report with an executive summary for non-technical reviewers, a remediation summary, and a mapping of results to the buyer's questionnaire items.
The requirements were thorough and more than most agencies are asked for. The point of mapping results to them directly was to give the buyer’s security team confidence rather than raise a second round of questions.
The client's procurement team wanted a pentest report, we got one in a couple of days, and we signed a three-year contract.
The outcome
The documentation answered every security item on first submission and no further evidence was requested. With security cleared, the deal moved to contract and This is LD signed a three-year engagement.
The agency now holds a security package it can reuse the next time enterprise procurement asks the same questions.
