Human-Led FinTech Penetration Testing to Meet Banking Security Requirements

Lendesk needed to replace its penetration testing provider while meeting banking security reviews, SOC 2 requirements, and a tight testing deadline. The team chose Software Secured for manual testing, accurate scoping, and direct collaboration with testers.

A FinTech Platform Under Increasing Security Scrutiny

Lendesk Technologies is a Canadian technology company that builds mortgage products and infrastructure for brokers, financial institutions, and partners. Its flagship products Finmo, Jupiter, Lender Network and Lender Spotlight support the entire mortgage lifecycle across both Canada and the US.

At the time of the engagement, Lendesk had approximately 70 employees, including a 27-person engineering team.

For Lendesk, penetration testing is part of doing business. Its banking customers require annual third-party security assessments before placing client data on the platform, while Jupiter testing supports Lendesk's SOC 2 Type 2 requirements.

In 2026, several pressures converged. Lendesk's contract with its previous provider was ending, and internal penetration testing resources were no longer available. The company also had a hard deadline. Lendesk therefore needed a partner that could test both applications, take a more practical approach to scoping, and provide the human expertise its security team expected.

Looking Beyond Automated Testing

Security Engineer Joseph Manduca wanted more than automated testing. While he used AI tools in his own security work, he viewed them as one tool among many. For compliance testing, he wanted human testers who could exercise judgment, understand the application, and discuss findings directly with his team.

Direct communication was part of that requirement. Lendesk asked to work with the testing team through Slack, allowing engineers to discuss questions and vulnerabilities as the assessments progressed.

The Pentest 360 engagement also included a review of application logs to assess whether Lendesk's security controls could detect and capture the testers' activity. Separately, read-only GitHub access enabled code-assisted testing, helping the team investigate vulnerabilities more deeply, identify related instances, and understand underlying code security risks.

Choosing Testing Quality Over the Lowest Price

Lendesk evaluated several providers, including one that submitted a significantly lower quote. Despite Software Secured's higher price, the team chose it for quality.

For Lendesk, meeting the security requirements of major financial institutions meant that testing depth and credibility mattered more than the lowest available price. The decision came down to testing quality and depth, along with the ability to work directly with the people performing it.

Getting the Scope Right Before Testing Began

Before testing began, Lendesk and Software Secured worked together to establish a more accurate view of the applications.

Lendesk's review showed that many endpoints described as APIs were actually internal calls made by the application's front end. The teams therefore distinguished those internal application calls from the publicly documented APIs.

Rather than treating the original number as fixed, the engagement surfaced a substantially larger application surface for Lendesk to understand and assess.

Turning Two Pentests Into a Security Baseline

The sequence of the two engagements provided value beyond the individual reports. Because the applications share some common components, the team could use the first assessment to understand which vulnerabilities were common across the products and which were specific to each application.

For Lendesk, this created a consistent cross-product baseline of security vulnerabilities that can carry forward into future assessment cycles.

Code-assisted testing added another layer of depth to the assessments. With read-only GitHub access, testers could work with additional application context from the beginning, particularly when assessing cross-tenant access controls and AI features.

Both engagements were completed within Lendesk's deadline. Testing ran on schedule for both applications, the environment was ready on time for each kickoff, and the checklists were submitted ahead of schedule, with communication throughout via Slack as Lendesk requested.

Lendesk now has current penetration testing documentation for both applications, supporting the security review requirements associated with its banking customers and its SOC 2 Type 2 program.

The engagement also includes remediation support and retesting rounds, giving Lendesk a defined path from identifying vulnerabilities to validating fixes.

"We wanted more than just what AI agents could do on their own. We chose Software Secured for human-led testing, and the depth of their work showed we'd made the right call." — Joseph Manduca, Security Engineer, Lendesk