From launch to conclusion, Include Security uses SendSafely to protect all phases of the client engagement

The challenge

Include Security, a leader in cyber security consulting, specializes in uncovering software vulnerabilities for high-profile clientele, ranging from Fortune 500 companies to emerging tech startups. Their mission is to safeguard organizations by delivering top-notch security services, penetration testing, and tailored offensive assessments. The company sought a secure file solution to protect all aspects of their client engagements, from project launch to conclusion.

Given the sensitive nature of their work and the expectations of their elite clients, the solution had to be both highly secure and user friendly. A solution for protecting highly confidential information such as exploitable application vulnerabilities was needed to comply with contractual obligations and compliance regulations such as SOC2 Type II, where encryption at rest and in transit is mandated.

Include Security was previously using legacy PGP to encrypt their deliverables, however, approximately 40% of their clients struggled with this complex encryption, leading to delays and frustration in communications within the project delivery process. The desired solution needed to reduce this friction in the engagement communication process as much as possible.

The solution

Include Security implemented multiple SendSafely features into their client engagement workflow, streamlining their secure file management and client communication processes from project start to finish.

Phase I: Project launch

At the outset of every engagement, Include Security uses the Dropzone secure file upload to facilitate the smooth collection of client assets and artifacts.

Phase II: Execution

During project execution, internal teams use Workspaces to store sensitive assets required for engagement execution, including the SOW, credentials, and other software artifacts. A Workspace is created for each client engagement, provisioned for "need to know" team members and bookmarked to an engagement chat channel for easy access. Team members trust everything they need to execute on the engagement can be found in the Workspace.

Additionally, a custom integration built using the SendSafely Python SDK automates the collection of client artifacts needed for the security assessment. The automation gathers artifacts from 3rd party systems and stores them in a SendSafely Workspace. This automation eliminates manual steps and reduces the amount of handling applied to the source code.

Phase III: Conclusion

At the conclusion of the engagement, Include Security uses the secure transfer Send feature to send deliverables which often contain highly confidential vulnerability information to the client easily and securely.

Finally, it is an easy clean up at the end of the project. The Workspace is deleted, and Include Security has assurance that client data is purged from their systems.