Case studies · 5 programmes
Real programmes. Real scale. Names under NDA.
Banks and a multinational group trusted me with production applications. Here is what we did, what was hard and what I learned, in enough detail to be useful.
230+ production applications protected across two enterprise programmes
Platforms I have deployed and run in production
Featured
112 bank applications, moved wave by wave.
The largest single programme: a leading Sri Lankan private bank’s web applications and APIs, migrated to cloud WAAP and taken from monitoring to blocking.
All cases
Five programmes across the six areas.
Each case maps to the areas I assess. Read the ones closest to the problem you are facing.
- 112applications migrated112 bank applications moved to cloud WAAP, wave by waveBanking · A leading Sri Lankan private bankF5 Distributed CloudRead the case
- 120applications protectedAround 120 applications under WAAP, API and bot protectionManufacturing · A global apparel group headquartered in Sri LankaImpervaRead the case
- T1bank vulnerability programmeTier-1 bank scanning upgraded and extended to web applicationsBanking · A Tier-1 Sri Lankan commercial bankTenable Security CenterRead the case
- RASPin-app protection liveIn-app runtime protection live in a customer banking appBanking · A leading private bank’s mobile appZimperiumRead the case
- SIEMtelemetry pipelineWAAP security events arriving in the bank’s SIEM, reliablyBanking · A leading Sri Lankan private bankF5 → Logstash → Trellix SIEMRead the case
Why are the clients anonymised?
Every programme on this site was delivered under a non-disclosure agreement. I describe the sector, the scale and the work, but never the client’s name. The numbers, such as the roughly 112 applications moved to cloud web application and API protection (WAAP) for a bank, are real and stated as briefed.
Were these consulting assessments or delivery projects?
They were delivery programmes I led as Head of the Application Security Business Unit at Innov8 (Pvt) Ltd. That hands-on delivery is why my assessments are practical: I have seen what breaks during real migrations, rollouts and integrations, and I build that into every recommendation.
Can I speak to a reference client?
Where a client has agreed to act as a reference, I can arrange a conversation after an initial call and under the right confidentiality terms. I never share client names publicly or without permission.