FTCO Company Has Substantially Lowered the Number of False Positives with Invicti

Industry: Fintech

Company: FTCO (part of PSI Group)

Location: Cyprus

Product: Invicti Enterprise

Eugene Fateev, Lead Cybersecurity Specialist, PSI Group said that Invicti has substantially lowered the number of false positives, made remediation workflows more efficient, and enabled the generation of audit-ready reports that help address PCI DSS requirements and other regulatory obligations.

Company overview

PSI Group develops and operates white-label fintech solutions through FTCO, one of its subsidiaries, as well as through other companies within the group. Because PSI Group operates in a tightly regulated financial sector, it must meet demanding requirements established by PCI DSS, DORA, GDPR, and financial regulations in the United Kingdom. Cybersecurity is therefore more than an operational requirement. It is a fundamental element in protecting customers and preserving their confidence in the company.

PSI Group operates a hybrid infrastructure that combines on-premise data centers with Microsoft Azure and AWS environments. Customer-facing payment applications are central to the group’s business operations. As a result, PSI Group required a security solution capable of scaling across this complex infrastructure while continuing to deliver consistent and dependable results.

The challenge: Scaling security beyond open-source tools

As a fintech organization, PSI Group depends heavily on web applications as the main interaction point for its customers. Most of these applications are exposed to the internet, which makes them potential targets for a wide range of cybersecurity threats. A vulnerability or successful security breach could have serious consequences. These could include financial fraud, data exposure, reputational harm, regulatory sanctions, and a decline in customer trust.

Before Invicti was introduced, PSI Group did not use a dedicated enterprise DAST platform. Application security testing instead depended on open-source scanners. These tools were suitable for basic and early-stage testing, but their limitations became increasingly apparent as the environment expanded:

• Large numbers of false positives delayed vulnerability remediation
• Limited automation required manual involvement throughout the testing process
• Existing systems and infrastructure could not be integrated effectively
• Enterprise-level technical support and compliance-oriented reporting were unavailable

For a financial services organization subject to extensive regulatory requirements, continued dependence on open-source tools alone was no longer practical. PSI Group therefore needed a purpose-built DAST platform. The solution had to automate vulnerability detection, fit into existing operational processes, and support security testing across dozens of applications.

The solution: Enterprise-grade DAST from Invicti

PSI Group selected Invicti’s dynamic application security testing (DAST) technology. The deployment initially used the on-premise edition, while the organization is currently moving toward Invicti’s cloud-based platform. The implementation proceeded smoothly. Invicti’s technical specialists supported the process with clear instructions and practical examples.

Invicti was incorporated into PSI Group’s secure software development lifecycle (SDLC). This integration introduced greater automation and improved visibility throughout the vulnerability management process. Proof-based scanning increased the accuracy of security testing and significantly reduced false positives. As a result, remediation became faster and reporting became more precise.

The result: Efficiency, compliance, and visibility

Invicti’s DAST platform has become a core element of PSI Group’s cybersecurity framework. It also plays an important role in supporting compliance with requirements including PCI DSS, DORA, and GDPR. DAST enables vulnerabilities to be identified before applications reach deployment. It also contributes to ongoing and continuous application security testing.

Following the adoption of Invicti, PSI Group has achieved several measurable and operational improvements:

• Scalability and efficiency: Automated scans and proof-based findings have removed many hours of manual validation work. This saves at least 20 hours each month while also making the remediation process more efficient.
• Improved compliance: Invicti includes ready-to-use reports mapped to PCI DSS, GDPR, and other regulatory requirements. This helps simplify preparation for audits and compliance assessments.
• Greater visibility across environments: PSI Group operates infrastructure across both cloud and on-premise environments. Invicti DAST provides a consistent outside-in perspective on application risks before deployment across this hybrid infrastructure.
• Fewer false positives: Development teams can concentrate on resolving vulnerabilities that are actually exploitable instead of spending time reviewing irrelevant or incorrect findings.

Looking ahead

Invicti is now an important component of PSI Group’s overall security strategy. The platform helps strengthen the organization’s cybersecurity posture, supports regulatory compliance, and provides effective protection for its web applications. Through continued use of Invicti, PSI Group is further developing its cybersecurity framework and improving the security and reliability of the fintech solutions provided to customers. As part of its next stage of adoption, the group plans to explore additional Invicti capabilities. Particular attention will be given to API discovery and API scanning in order to reinforce API security.