Case study

Scaling Vulnerability Management Without Scaling the Team

Fintech scaling security team 10X, reducing 97% container noise

ClearBank, the UK’s first new clearing bank in over 250 years, needed to manage a growing volume of vulnerabilities across an expanding digital landscape — without growing security headcount. Facing high complexity from multiple pipelines and legacy integration, the bank partnered with Phoenix Security to simplify and scale its AppSec efforts. ClearBank now accelerates towards zero critical vulnerabilities from code to cloud, cutting analyst workload by 98%.

What ClearBank achieved with Phoenix Security

Phoenix Security’s innovative approach not only met ClearBank’s needs but also positioned them to manage future challenges confidently. This partnership exemplifies how technology can empower organizations in highly regulated sectors to stay ahead in cybersecurity. By adopting Phoenix Security, ClearBank achieved:

Reduction in Container Vulnerabilities

0 %

By implementing container throttling and optimized remediation practices, ClearBank achieved a 98% decrease in container vulnerabilities—driving systemic risk down and accelerating secure DevOps adoption.

Engineering hours unlocked

0 K+

Policy-based routing and exceptions lead to ~4 hours/week saved per security engineer. 1.4K–2.8K developer hours/month avoided on critical triage; 35.7K+ hours/month avoided on container review.

Vulnerabilities Remain Post-Remediation

0 %

ClearBank achieved a dramatic decrease in weekly critical risk reduction outcome, representing an industry-leading security hardening effort over a one-year period.

Executive Briefing

ClearBank, a regulated fintech innovator, faced challenges with the ownership of cloud and software assets and an unprioritized flood of vulnerability alerts across applications and cloud infrastructure. Phoenix Security’s contextual prioritization engine and deduplication delivered a unified view of risks, automated triage and remediation workflows, and reduced the security team’s workload by 98%. Over 12 months, the number of critical findings decreased from high double digits to a single number that teams could solve. Each security professional reclaimed 2-4 hours per week, enabling scale without headcount growth.

Key Outcomes:

– 98% reduction in container-related noise and false positives

– 96–99% cut in weekly critical vulnerabilities

– 4 hours/week reclaimed per security engineer through automated triage

ClearBank's Background

ClearBank delivers real-time clearing and settlement services to UK banks and fintechs. Operating under strict FCA and PRA mandates, its security leaders require:

Traditional scanners generated thousands of siloed findings nightly, which overwhelmed security engineers and delayed critical fixes.

Customer Voice: Management

“If we showed developers 100× more ‘critical’ issues, most would be ignored. Automation and filtering cut the noise and raised engagement on genuine issues.”

– Huw Jeffries, Director of Security Engineering / Application Security, ClearBank)

Challenge

Noise, Context Gaps & Resource Constraints

1. Volume overload

SAST, SCA, Container, Cloud Misconfiguration, security scans produced Milions of findings, and the container scanner alone produced almost a million false positive raw findings per quarter that were highly inflated and inaccurate representations of risk.

2. Lack of context

Teams lacked business-critical asset tagging, so every medium-severity bug looked equal.

3. Triage bottlenecks

Manual grouping and deduplication consumed over 4 hours per engineer each week.

4. Scaling without headcount

Compliance demands increased, but the budget couldn’t support hiring more analysts.

ClearBank’s Experience: Engineering

“Version throttling and auto-removal of unseen images saved real time. We now see vulnerabilities in business context, run campaigns, and assign the right owners.”

– Neil Reed, Principal Security Engineer, ClearBank

Solution

Phoenix Security’s Contextual ASPM & Automated Workflows

1. Contextual Prioritization Engine

– Correlated SAST, container, and cloud findings against Clear Bank’s automated yaml-based inventory synchronized in real time with the Phoenix Security configuration, attributing the right problems to the right teams.
– Dynamic risk scoring: public-to-DMZ transitions automatically elevated scores for exposed assets.

2. Image Retention & Deduplication

– Ignored stale container images and merged duplicate alerts across CI/CD pipelines.
– Reduced container findings with 98% reduction in noise.

3. Automated Triage & Remediation Playbooks

– Customizable exception rules down-scaled test environments, focusing engineers on prod-critical issues.
– Integrated with ticketing to notify AppDev or Infra teams automatically when a critical CVE hits.
– In platform triage, flags, comments, and exceptions enabled the creation of a single data lake for vulnerabilities without the need to flood developers’ team backlogs.

4. Custom Status & SLA Tracking

– Defined VULN_STATUS: “Backlog”, “Pending Dev”, “In Remediation”, and “Verified”.
– SLA dashboards alerted execs when critical tickets breached 24-hour thresholds.

5. Real-Time Reporting

– Saved filters for CISO-level heatmaps and per-team vulnerability trends.
– Automated weekly exec summaries showing “Top 10 Criticals”, “Time-to-Remediate”, and “Risk Score Delta”.

Impact & Metrics

Metric	After Phoenix Security Implementation
Quarterly container findings	–98% noise
Weekly critical vulnerabilities	–99%
Engineer triage time saved/weekly	-4 h/week

Insights

For Security Leaders

For Security Practitioners

Automated Contextual Triage: Leverage environment and asset metadata to eliminate false positives.
Playbook Integration: Tie Phoenix alerts directly to DevOps pipelines for instant remediation handoff.
Metric-Driven Remediation: Track “time-to-fix” per CVE category and celebrate incremental improvements.

Learn More

Conclusion

By embedding Phoenix Security’s contextual ASPM, ClearBank transformed vulnerability management from a manual, siloed chore into a scalable, automated process — delivering 98% noise reduction, 99% fewer criticals, and millions in saved analyst costs. This partnership exemplifies DevSecOps at scale: context-driven, risk-focused, and relentlessly automated.

See more cases

Security Champion

AdTech

A global AdTech company implemented a scalable Security Champion program to embed security ownership across development teams. By training champions and integrating security into daily workflows, the organization fostered a proactive security culture. This approach significantly improved vulnerability response times and strengthened collaboration between engineering and security at scale.

Code 2 Cloud

Bazaarvoice

By integrating Phoenix Security into Backstage, a leading developer portal, the organization unified visibility into application security across all teams. Developers could now access vulnerability insights, remediation actions, and risk scores directly within their daily workflows. This seamless integration reduced context switching, improved developer efficiency, and accelerated secure development practices.

CISO View

CAPCO

A leading enterprise leveraged CISO View to gain real-time insights into their security landscape, enabling proactive risk management. By integrating container security and native security tools, the organization streamlined threat detection and compliance monitoring across cloud and on-prem environments. This enhanced visibility allowed the CISO to make data-driven decisions, reducing vulnerabilities and improving overall security resilience.

Industry Recognition

One Platform. 
Company-Wide Benefits

"Contextualized and unified references with application architecture."

Comprehensive coverage and real-time threat detection. It helps manage compliance requirements and can integrate with other tools especially feeding SIEM. Certain tasks such as vulnerability scanning and patch management can be automated through scheduling. Depending on use case its checks on ACT risks and API deploy are valuable to check for errors or patterns.