Case Studies
A sample of the kind of work Invision Solutions takes on.
Specifics are anonymised to respect client confidentiality — ask directly for detail relevant to your situation.
DevSecOpsEnterprise Retail
Pipeline Security Uplift
- Situation
- A large retail organisation was shipping through CI/CD pipelines with no consistent security gate. Vulnerable dependencies and hard-coded secrets were reaching production, and each engineering team applied its own standard.
- Action
- Introduced GitHub Actions security gates with Snyk dependency and container scanning, moved secrets into a managed store, and codified the whole standard as reusable workflows so every team inherited it by default rather than by discipline.
- Outcome
- Critical and high-severity findings reaching production fell by roughly 70% over two quarters, and median time-to-remediate moved from around three weeks to under four days.
Cloud MigrationSaaS Scale-up
Secure-by-Design Migration
- Situation
- A growing SaaS business needed to move off ageing self-managed infrastructure without carrying its flat network model and long-lived credentials into the new environment.
- Action
- Designed the target architecture with segmented networks and short-lived, role-based access from day one. Delivered the landing zone as Terraform modules and ran the migration in phases, each independently reversible.
- Outcome
- Migration completed in 14 weeks with no unplanned downtime. Standing privileged access was reduced from 40-odd permanent admin accounts to four break-glass accounts, with day-to-day access issued just-in-time.
SOC 2 Type IIFinancial Services
Audit Readiness Programme
- Situation
- A financial services client had committed to SOC 2 Type II for a client-mandated deadline, with controls that were largely informal and evidence gathered by hand.
- Action
- Ran a gap assessment against the Trust Services Criteria, implemented the missing technical controls, and automated evidence collection so the observation window produced its own audit trail rather than a year-end scramble.
- Outcome
- Readiness reached in 11 weeks against a 16-week deadline. Evidence collection for the majority of in-scope controls became automated, cutting the manual effort per observation period from several days to a few hours.
CSPMMulti-Cloud
Posture Management Rollout
- Situation
- Workloads had spread across more than one cloud provider with no single view of misconfiguration. Drift went unnoticed between quarterly reviews, and severity was assessed inconsistently.
- Action
- Deployed cloud security posture management across all accounts, tuned the rule set to the organisation's actual risk appetite to cut alert noise, and routed findings into the existing engineering workflow with clear ownership.
- Outcome
- High-severity misconfigurations dropped by about 60% in the first 90 days. Tuning cut alert volume by roughly three quarters, and mean time to detect configuration drift fell from a quarterly review cycle to under 24 hours.
Security ArchitectureRegulated Enterprise
Zero Trust Access Model
- Situation
- A perimeter-based access model no longer matched how the organisation worked — contractors, third-party integrations, and remote employees all sat inside a trusted network boundary.
- Action
- Designed a Zero Trust access model on Microsoft Entra ID with conditional access, device posture checks, and just-in-time elevation. Sequenced the rollout so no user group lost access during transition.
- Outcome
- Standing access to production was removed for all but a small break-glass group, with privileged sessions moved behind approval and time limits. Third-party access moved from shared credentials to individually attributed identities.
Solution ArchitectureScale-up
Security Advisory Retainer
- Situation
- An engineering team was making architectural decisions with security consequences and no senior security voice in the room, discovering problems at review rather than at design.
- Action
- Embedded as a fractional security architect: design review at proposal stage, threat modelling for new services, and vendor assessments — plus written standards the team could apply without waiting on a review.
- Outcome
- Around 30 designs reviewed before build over 12 months. Security rework identified at release review fell markedly, with most issues instead caught at design stage where they cost far less to fix.
Own product
Not everything here was built for a client.
PayReckon is a live product I designed, built, and run — UK take-home pay calculators comparing umbrella, limited company, and PAYE employment behind a single shared tax engine.
It is not security work. It is here because the discipline is the one I sell: correctness held by tests, every tax figure traceable to its source on gov.uk, and automated checks that fail the build rather than relying on someone remembering to look.
PayReckonLive product
UK take-home pay, three ways
- Situation
- A day rate and a salary are not comparable numbers, and comparing arrangements usually means three separate tools that disagree with one another.
- Action
- Built three calculators over one tax engine, so identical taxable income is taxed identically whichever arrangement produced it. The umbrella circularity — employment costs charged on the pay that remains after deducting them — is solved algebraically rather than approximated.
- Outcome
- Live at payreckon.co.uk and in active use, covering three tax years across Scottish and rest-of-UK rates. A round-trip test asserts that gross pay plus every employment cost returns the assignment rate exactly.