- During campaigns and peaks the system is overwhelmed by bot traffic
- Security is a checklist remembered at the end of a release
- Authorisation rules are inconsistent between services
07
Reliability & Security
Application & API Security
We protect the application and everything it exposes to the outside world in layers, against malicious traffic, excessive load and unauthorised access.
Scope
What we take on
We move security out of the checklist at the end of a release and into the development flow itself. We work by priority: not every finding, but the ones that genuinely carry business consequence.
Workstreams
- Vulnerabilities caught before release rather than during an audit
- Authorisation working by the same rules across every service
- Malicious and overload traffic stopped before it reaches the application
- Suspicious traffic throttled according to where it comes from
- Security controls built into the release process itself
When you need this
If these signs
look familiar.
Where we applied it
Development and infrastructure work on the Invicti (Netsparker) DAST platform; Cloudflare WAF, rate limiting and challenge flows at Obilet.
Results in production
Which platforms
have we applied this on?
%20lower cloud cost, same workload
Travel Distribution Platform
Multi-supplier inventory came together in one model, and the same volume is now served at 20% lower cloud cost.
Obilet’s bus, air and rail inventory was fed by suppliers that each had their own data model and their own failure behaviour, so every new integration put the search and booking flow at risk of regression. We normalised the inventory into a single internal model, solved station matching through geographic proximity and GIS, isolated supplier-side failures and reworked resource usage on AWS. The platform now runs independently of any one supplier, holds predictable performance through peak season, and serves the same workload at roughly 20% lower cloud cost.
Read the case study →
Self-servicedealer pricing, stock and ordering channel
B2B Commerce & Dealer Portal
Dealer ordering that ran on phone calls and email moved to a digital channel.
At Penta, dealer orders came in by phone and email, and price and stock information was verified by hand on every transaction. We brought dealer-specific pricing, stock visibility and order management together in the Bayinet B2B portal, integrated it with ERP and supplier systems and added content and document management (CMS/DMS). Dealers now reach price and stock information directly and place their own orders, and the sales team is free of that operational load.
Platform →Related platforms
Which platforms
does this discipline come into?
Let’s work together
Let’s look at a need you have around application & api security.
Tell us where you are today and which constraints matter most; we will define a clear starting point together.