Case Study

How Varo Bank Used Continuous Pentesting to Demonstrate Security Readiness

To become a full-fledged bank, Varo had to show regulators its testing trends and how quickly it addressed findings. Synack365 testing scrutinized each software release, and Synack Platform data gave Varo the evidence it needed to demonstrate its security readiness.

Industry:: Financial services
Region:: United States
Solutions:: Synack365, Synack Red Team

Download the case study Start Free Sara AI Pentest Trial

First page of the Varo Bank case study, titled How Varo Bank Used Continuous Pentesting to Demonstrate Security Readiness

Release-aligned testing Each software release scrutinized by Synack researchers

Custom GraphQL missions For a newer technology in Varo’s stack

Remediation data Showing regulators how quickly findings were addressed

Proving security to regulators

To earn a banking charter, Varo had to show regulators it ran a secure operation.

01 · The challenge

Point-in-time testing fell short

Automated scanning and point-in-time pentests could not keep up with rapid growth or show regulators testing trends.

02 · The approach

Continuous Synack365 testing

Synack mapped Varo’s cloud resources for agile pentesting and assigned custom GraphQL missions to the SRT.

03 · The outcome

Evidence regulators could see

Platform data showed regulators testing trends and how quickly Varo addressed findings.

From app-based bank to chartered bank

Varo Bank was founded in 2015 as Varo Money, an app-based online bank operating within the US Bancorp sponsorship system. Its goal was to grow until it could operate on its own as a fully-fledged bank.

To earn a banking charter, Varo had to show regulators a secure operation as specified by the Federal Financial Institutions Examination Council (FFIEC). As its customer base grew, so did its infrastructure and the effort required to keep it secure.

Pentesting solely in-house was not a long-term option, given the shortage of qualified candidates. Varo was also using GraphQL, a relatively new technology with fewer years of security testing to harden it.

Why Synack stood out

Varo reviewed several vendors for continuous pentesting capabilities, and Synack stood out with its Synack365 offering.

Release-aligned testing

Synack maintained a map of current cloud resources, keeping pace with Varo’s frequent app updates so each release was scrutinized.

Custom GraphQL missions

Synack assigned custom missions to SRT members specifically to test Varo’s use of GraphQL.

Thorough reports

Reports were more thorough than Varo’s previous pentesting, and pentest results were used by developers and QA.

Direct access to researchers

Varo could talk directly with Synack researchers about reports and remediation.

“We particularly liked being able to interact with researchers on our schedule when we had questions. With a regular pen test, we would have lost access to the testers when the test was over.”

Sal Dazzo, Director of Engineering, Varo Bank

What Varo achieved

Testing trends regulators could see

Vulnerability Burndown charts in the Synack Platform demonstrated testing trends, something point-in-time testing could not show.

Proof of remediation speed

Platform data showed regulators how quickly Varo addressed findings.

Consistent results for stakeholders

Pentest reports with consistent results showed internal stakeholders how the security team was performing.

Fewer security bugs

Developers and QA used pentest results, and related security bugs steadily reduced in number.

Milestone: a national bank charter

In August 2020, Varo became the first U.S. consumer fintech to receive a national bank charter from the OCC, in part due to Synack testing data.

Questions about the Varo Bank case study

Who is Varo Bank?

Varo Bank was founded in 2015 as Varo Money, an app-based online bank. In August 2020 it became the first U.S. consumer fintech to receive a national bank charter from the Office of the Comptroller of the Currency.

Which Synack solution did Varo use?

Synack365 continuous pentesting, with the Synack Red Team scrutinizing each software release.

How did Synack help Varo demonstrate security readiness?

Vulnerability Burndown charts and platform data showed regulators testing trends and how quickly Varo addressed findings, which point-in-time testing could not demonstrate.

How did Synack test GraphQL?

Synack assigned custom missions to Synack Red Team members that specifically addressed security testing for GraphQL.