Continuous Security for a Fast-Moving SaaS Startup
A Series-B SaaS startup ships product updates multiple times per week. Their engineering team of 40 developers deploys microservices across AWS ECS, but they have only one part-time security engineer. Manual penetration tests are performed once a quarter by an external vendor, costing $15,000-$25,000 per engagement, and the reports arrive weeks after the code has already changed.
Run on Vedha · Security & Assurance
The challenge
New API endpoints and frontend features are deployed faster than manual pentests can cover them.
The quarterly pentest cycle leaves a 3-month blind spot where new vulnerabilities go undetected.
The security engineer spends most of their time on compliance paperwork, not hands-on testing.
How Vedha solves it
On-Demand Flow Execution
After each major sprint, the security engineer kicks off a VEDHA Flow targeting the staging environment. They enter the target scope (e.g.https://staging.app.example.com) and a goal like "Perform a comprehensive web application pentest focusing on the new billing API endpoints."
Autonomous Goal Decomposition
VEDHA's Generator Agent breaks the goal into 10-15 ordered subtasks crawling the target, fingerprinting the tech stack, testing authentication flows, fuzzing API parameters, checking for IDOR vulnerabilities, and more.
Sandboxed Execution
All scanning tools like nmap, sqlmap, custom Python scripts written by the Coder Agent run inside an ephemeral Docker container, ensuring zero risk to the production environment.
Dynamic Plan Refinement
When the Pentester Agent discovers the billing API uses GraphQL, the Refiner Agent dynamically patches the plan to add GraphQL-specific introspection and injection subtasks that weren't in the original plan.
Real-Time Dashboard
The security engineer watches live terminal output, agent reasoning logs, and screenshots stream into the React UI via WebSocket subscriptions no waiting for a PDF report weeks later.
The outcome
- testing frequency increases from quarterly to weekly, closing
- 0 daystesting frequency increases from quarterly to weekly, closing
- cost per test drops
- $0cost per test drops
Testing frequency increases from quarterly to weekly, closing the blind-spot window from 90 days to 7 days.
Cost per test drops from ~$20,000 to the cost of LLM API tokens and compute (typically under $50 per run).
A critical IDOR vulnerability in the billing API is caught within hours of deployment to staging, before it reaches production.
Representative scenario: a modelled industry situation showing how this accelerator applies. Figures are projections, not a named client result.
Capabilities used
Every accelerator is assembled from the same capability layer, so a workflow you adopt here shares its foundation with the rest of the portfolio.
More from Vedha
Safety & Security
Pre-Compliance Penetration Testing for a Healthcare Platform
A digital health company building an electronic health records (EHR) platform must satisfy HIPAA security requirements before launching. Their compliance officer needs evidence of penetration testing to include in the security risk assessment. The company's infrastructure includes a React frontend, a Node.js/Express API, a PostgreSQL database, and an S3 bucket storing patient documents.
Safety & Security
Red Team Simulation for a Financial Institution
A mid-size bank with 2,000 employees conducts annual red team exercises as part of its cybersecurity maturity program. The internal red team consists of three senior security engineers who manually simulate adversary tactics across the bank's external-facing infrastructure: internet banking portals, mobile API gateways, and partner integration endpoints. Each exercise takes 4-6 weeks.
Safety & Security
Securing a University's Research Infrastructure
A large public university runs a sprawling IT environment: student portals, research lab servers, faculty intranets, IoT devices in smart buildings, and shared HPC (High-Performance Computing) clusters. The central IT security team of two people is responsible for securing all of it. They have no budget for commercial penetration testing tools and limited time for manual assessments.
Bring us the version of this that you actually have.
Every engagement is fixed-scope and outcome-guaranteed. The scoping conversation starts with your systems, not with a template.