<h2>Key Takeaways</h2>
<ul>
<li>ICONOMI, a Slovenia-founded digital asset investment platform with a UK entity registered with the FCA, cut onboarding drop-off by 15% across more than 100,000 users after QAwerk ran a testing pass covering registration, password validation, identity verification, VPN detection, cross-browser compatibility and localisation.</li>
<li>The case study calls this a &#8220;security testing pass,&#8221; but most of what actually drove the result, unresponsive buttons, misleading error messages, input validation loopholes, is general functional and UX quality assurance. Only identity verification and VPN detection are genuinely security or compliance-adjacent, and QAwerk has no publicly evidenced formal security-testing accreditation, unlike CREST-accredited penetration testing firms.</li>
<li>VPN detection on a crypto platform is a real compliance control, not just a UX nicety: crypto firms are treated as virtual asset service providers under anti-money-laundering rules and must prevent users from masking their location to evade sanctions and geo-blocking, so this one element of the testing genuinely does belong in a security and compliance conversation.</li>
<li>By ICONOMI&#8217;s own published account, ICONOMI LTD has held FCA cryptoasset AML registration (Firm Reference Number 927859) since 2021, one of the earliest cohort to do so, at a time when the FCA has rejected the large majority of applicants, only around 14% of applications resulted in registration in the years following the regime&#8217;s 2020 start. That&#8217;s a genuinely notable regulatory achievement worth separating from the onboarding UX story.</li>
<li>Against industry benchmarks putting crypto KYC/onboarding abandonment at roughly 25% for well-optimised flows and considerably higher for poor ones, a 15% cut in drop-off is a real, credible improvement, but not an exceptional one, and it&#8217;s consistent with fixing basic UX friction rather than requiring specialised security expertise.</li>
</ul>
<p>There&#8217;s a habit in vendor case studies of reaching for the word &#8220;security&#8221; whenever a testing engagement touches anything adjacent to login, identity or compliance, even when the actual work is closer to conventional quality assurance. ICONOMI&#8217;s onboarding fix is a good example, genuinely useful, genuinely measurable, and worth a UK C-suite understanding precisely, rather than accepting the framing the case study gives it.</p>
<h2>What ICONOMI actually did, and what QAwerk actually found</h2>
<p>ICONOMI needed to stop losing users during onboarding, a critical drop-off point for any cryptocurrency investing platform, while also making sure the security layer, password setup, identity verification, VPN detection, held up without making the experience painful for the diverse audience the platform was trying to serve. QAwerk ran comprehensive manual testing across registration flows, password validation, identity verification with document uploads, VPN detection, cross-browser compatibility, mobile responsiveness, localisation and edge cases, working through the platform the way a real, frustrated new user might. &#8220;We appreciate the work put into identifying and documenting potential issues, classified by severity. This has been valuable in enhancing our understanding of potential user experience improvements. We found your testing effort useful for fine-tuning our product, and we appreciate the attention to detail shown by your team,&#8221; said Pedro Martins, QA &#038; Project Manager at ICONOMI.</p>
<p>User drop-off during onboarding fell 15%, an improvement felt across more than 100,000 users on the platform. The testing also surfaced a run of critical bugs, unresponsive buttons, input validation loopholes, inaccurate search results, attachment removal issues and misleading error messages, all caught and fixed before they reached production. Read that list of bugs again: unresponsive buttons, inaccurate search results, misleading error messages. That&#8217;s a description of thorough, valuable functional and UX quality assurance. It is not, on its own, a description of a security audit.</p>
<h2>Why &#8220;security testing&#8221; is the wrong label for most of this, and the right label for one part of it</h2>
<p>Of the areas QAwerk covered, registration flows, password validation, cross-browser compatibility, mobile responsiveness and localisation are standard functional QA territory, valuable but not specialised security work. Identity verification and VPN detection sit in a genuinely different category. VPN detection in particular is a real compliance control on a platform like ICONOMI&#8217;s, not a UX nicety: crypto firms are classified as virtual asset service providers under anti-money-laundering rules and are required to prevent users from masking their true location to evade sanctions screening and geographic restrictions, VPN and proxy detection exists specifically to stop that evasion, working alongside IP-based geo-blocking and broader transaction monitoring. That part of the testing genuinely does belong in a security and compliance conversation.</p>
<p>What&#8217;s worth a C-suite noting is that QAwerk itself, a Ukraine-based outsourced QA vendor with a substantial track record across hundreds of projects, has no publicly evidenced formal security-testing accreditation, no listing on CREST&#8217;s accredited-firm directory, the body that credentials UK penetration testing providers, and no documented certification comparable to what a dedicated security testing firm would carry. That doesn&#8217;t make the work QAwerk did any less useful. It does mean a board reading &#8220;security testing pass&#8221; in a case study like this one should ask a specific follow-up question: was this quality assurance that happened to touch a security-relevant feature, or an actual security assessment performed by a credentialed security specialist. In ICONOMI&#8217;s case, the honest answer looks like the former for most of the engagement, and something closer to the latter only for the narrow VPN detection and identity verification slice.</p>
<h2>The genuinely impressive fact in this story isn&#8217;t the one the case study leads with</h2>
<p>ICONOMI LTD, the UK entity behind the platform, states it has held Financial Conduct Authority cryptoasset AML registration since 2021, Firm Reference Number 927859, making it one of the earliest crypto firms to clear that specific bar, according to the company&#8217;s own published account. That&#8217;s worth real weight, because the FCA&#8217;s cryptoasset registration regime, introduced under the Money Laundering Regulations in January 2020, has been notably difficult to pass: reporting has put the rejection rate at roughly 87% of applications in 2024, up from 85% the year before, against a general rejection average across all financial firms closer to 36%, and industry data has put the share of applications resulting in registration at only around 14% in the years since the regime began, though more recent figures suggest that pass rate has since improved. Set against that backdrop, ICONOMI clearing FCA registration in 2021 is a genuinely more significant regulatory achievement than the onboarding drop-off figure, and it&#8217;s worth being precise about what it actually means: AML registration is a real, meaningful compliance bar, but it is a lighter-touch status than full FCA authorisation, and it does not extend consumer protections like the Financial Services Compensation Scheme or Financial Ombudsman access that come with an authorised firm. A UK C-suite considering this platform, or citing it as an example, should know the difference between &#8220;registered&#8221; and &#8220;authorised&#8221; before treating the two as interchangeable.</p>
<h2>Is 15% actually a strong result?</h2>
<p>Industry data on crypto and fintech onboarding gives a useful yardstick here. Well-optimised KYC and onboarding flows in crypto typically see abandonment rates around 25%, with poorly built flows running considerably higher, sometimes into the 50 to 80% range, and general digital KYC benchmarks across fintech span a similarly wide range depending on how much friction the flow carries. Against that spread, a 15% cut in drop-off across more than 100,000 users is a real, credible, worthwhile improvement. It&#8217;s also consistent with fixing exactly the kind of basic friction the bug list describes, broken buttons, confusing errors, cross-browser failures, rather than requiring the kind of specialised security expertise the case study&#8217;s framing implies. Genuinely useful work, correctly sized: this reads like a platform that had real, fixable UX debt and fixed it, not a platform that uncovered and closed a serious security gap.</p>
<h2>What a UK C-suite should actually take from this</h2>
<p>ICONOMI&#8217;s story is a good one, both halves of it. The onboarding fix was real, measurable and worth doing. The FCA registration is a genuinely hard-won regulatory credential most crypto firms never clear. The useful discipline for a board is keeping those two achievements separate rather than letting a case study&#8217;s &#8220;security testing&#8221; label blur functional QA into something more specialised than it was. The next time a vendor pitch or case study uses the word &#8220;security&#8221; to describe testing that mostly consists of button responsiveness and error message clarity, the right question isn&#8217;t whether the result is real, it usually is. It&#8217;s which specific part of the work actually required security expertise, who provided it, and whether that person or firm can show the credential to prove it.</p>


ICONOMI Called It a Security Testing Pass. Most of It Was Quality Assurance, and That’s Fine, If You Know Which Is Which

<h2>Key Takeaways</h2>
<ul>
<li>iSTORM®, a small, CREST-accredited UK penetration testing and security audit firm based in Stratford-upon-Avon, replaced its static, emailed PDF report workflow with an interactive web portal built by Codevate, giving clients real-time access to findings and a searchable vulnerability database.</li>
<li>The case study itself offers no quantified figures at all, no turnaround-time percentage, no client count, no revenue impact, only qualitative claims about improved client experience and competitive differentiation, which is worth a C-suite noting as a genuine gap in the evidence rather than assuming it away.</li>
<li>This is not a new category. NCC Group, Pentest People and other established UK penetration testing firms already run comparable interactive reporting portals as part of a recognised &#8220;Pentest-as-a-Service&#8221; model; iSTORM&#8217;s move is a reasonable catch-up to an existing industry standard, not the invention of one, and the case study&#8217;s framing as a point of differentiation deserves scrutiny on that basis.</li>
<li>A portal that aggregates live, unremediated vulnerability data across multiple clients is, by its nature, an unusually high-value target, a point with real precedent: RSA&#8217;s 2011 SecurID breach and the 2023 MOVEit Transfer breach both show what happens when a vendor&#8217;s own client-facing infrastructure becomes the single point of failure for many organisations&#8217; security postures at once. The case study says nothing about the portal&#8217;s own security architecture, testing regime or accreditation, which is the first question a rigorous board should ask before treating &#8220;we built a portal&#8221; as a differentiator.</li>
<li>Codevate, the development vendor, is a genuine, Companies House-registered UK software house with a decade of trading history, but there is no independent evidence it holds specific <a rel="nofollow" href="https://www.networksjournal.com/cyber-security">cyber security</a> credentials of its own, worth knowing given what the portal it built is now responsible for protecting.</li>
</ul>
<p>There&#8217;s a specific irony worth sitting with in any story about a security company building new client-facing software: the thing being built to demonstrate security expertise is also, immediately, a new piece of attack surface that has to be defended to the same standard the company sells to everyone else. iSTORM&#8217;s move from static PDF reports to a live web portal is a small, sensible operational decision on its own terms. It&#8217;s also a useful lens for a UK C-suite to look through when a vendor, security-focused or not, pitches a new platform as a point of differentiation, because the interesting questions aren&#8217;t about the client experience improvement. They&#8217;re about what the case study doesn&#8217;t say.</p>
<h2>What iSTORM actually built</h2>
<p>iSTORM®, a penetration testing and security audit provider, used to deliver every client report as a static PDF sent by email. That created version-control problems: clients, prospects and even competitors could end up working from outdated copies, and updates meant resending the whole document. Codevate built iSTORM a web portal that replaced the PDF workflow with an interactive report builder, a searchable vulnerability database and real-time client access to findings as they were added. The system runs on a PHP Symfony backend with a TypeScript and React frontend, backed by PostgreSQL and hosted on AWS. &#8220;Codevate really understood what we wanted to achieve and the feedback from our clients, prospects and even competitors has been excellent,&#8221; said Richard Merrygold, Director at iSTORM®.</p>
<p>iSTORM is a genuine, CREST-accredited business, independently confirmed on CREST&#8217;s own approved-supplier directory for both CREST Membership and CREST Penetration Testing, a leading UK accreditation body, based in Stratford-upon-Avon, Warwickshire. Third-party business databases estimate the company at roughly 11 to 50 employees, a boutique firm rather than a major player, though that headcount figure comes from business-listing aggregators rather than a Companies House filing and should be read as an estimate. Codevate Limited, the vendor, is a real, Companies House-registered UK software developer, incorporated in July 2013 and based in Birmingham, working primarily as a generalist bespoke software and mobile app development shop for SMEs. Worth noting plainly: nothing in the public record suggests Codevate carries cyber security-specific accreditation of its own, which matters given what it was hired to build.</p>
<h2>The portal cut turnaround time and improved the client experience, by iSTORM&#8217;s own account, with no numbers attached</h2>
<p>The portal cut the time iSTORM spends producing reports, improved the experience for clients reviewing findings, and gave the company a point of differentiation against competitors still working from static PDFs, according to the case study. Every one of those three claims is plausible, and none of them comes with a figure. No percentage reduction in report turnaround time, no client retention or satisfaction number, no count of how many clients have actually moved onto the new system. That&#8217;s a genuinely thinner evidence base than most comparable case studies, and it&#8217;s worth a C-suite reading this the same way it would read any vendor pitch with strong adjectives and no attached metric: directionally credible, not yet independently measurable. None of that means the underlying decision was wrong. It means the specific claim of differentiation is asserted rather than demonstrated.</p>
<h2>That differentiation claim is also worth checking against what the rest of the industry is already doing</h2>
<p>The case study frames the portal as a point of differentiation against competitors still working from static PDFs. That&#8217;s a harder claim to sustain than it first appears, because interactive, web-based penetration test reporting is already an established pattern among larger UK firms, not a novelty iSTORM introduced. NCC Group runs a Cyber Services Portal with real-time interactive reporting, prioritised vulnerability lists and trend dashboards. Pentest People built its entire commercial model, branded Pentest-as-a-Service, around a portal called SecurePortal offering the same real-time findings access and vulnerability drill-down. Bulletproof and Redscan, now part of Kroll, run comparable structured web platforms for their testing services. None of that diminishes the genuine value of iSTORM moving off email-attached PDFs, which was a real operational weakness worth fixing. But a UK C-suite evaluating any vendor&#8217;s &#8220;we built a portal&#8221; pitch, security-focused or otherwise, should treat that framing as catching up to an existing category, worth doing, rather than a novel competitive edge, since the companies iSTORM competes against for enterprise clients have largely already made this move.</p>
<h2>The question the case study doesn&#8217;t answer: who&#8217;s guarding the portal itself</h2>
<p>This is the point that matters most for a board evaluating any vendor, not just iSTORM specifically. A penetration testing firm&#8217;s client portal is not an ordinary piece of business software. By design, it aggregates live, often unremediated vulnerability data, exactly the information an attacker would want most, across every client using the system at once. That concentration of risk has real precedent, not hypothetical concern. RSA&#8217;s 2011 SecurID breach began with a spear-phishing attack on an RSA employee that let attackers steal SecurID seed data, compromising the token system&#8217;s integrity for RSA&#8217;s own customers, including a subsequent, documented attack on Lockheed Martin that traced back to the stolen data. More recently, the 2023 MOVEit Transfer breach saw the Cl0p ransomware group exploit a zero-day vulnerability in file-transfer software trusted by thousands of organisations, cascading into one of the largest mass data-exposure incidents in recent years. Both cases share the same underlying lesson: when a vendor&#8217;s own infrastructure becomes the aggregation point for many clients&#8217; sensitive data, that infrastructure inherits a level of attacker interest disproportionate to the vendor&#8217;s own size.</p>
<p>None of that is a specific allegation against iSTORM&#8217;s portal, which may well be built and operated to a high standard; there&#8217;s no evidence either way in the public record. That&#8217;s precisely the point. The case study describes the technology stack, PHP Symfony, TypeScript and React, PostgreSQL, hosted on AWS, in enough detail to sound thorough, but says nothing about the portal&#8217;s own penetration testing regime, access controls, encryption standard for stored vulnerability data, or whether it has itself been independently assessed to the standard iSTORM assesses its own clients against. For a UK board evaluating this vendor, or any vendor pitching a new client-facing platform as an improvement, that&#8217;s the first question worth asking directly, not &#8220;does the new system look better than the old one,&#8221; but &#8220;who has tested the thing that now holds all our findings in one place, and to what standard.&#8221;</p>
<h2>What this is actually worth to a UK C-suite</h2>
<p>Strip away the specific company and this is a genuinely useful pattern to recognise the next time any vendor, security-focused or otherwise, pitches a new client portal as a meaningful upgrade. Three questions are worth asking every time, regardless of how polished the pitch: what specific, measurable outcome changed, not just &#8220;improved experience&#8221;; is this actually ahead of what established competitors already offer, or catching up to a category that already exists; and what security standard does the new platform itself meet, given that centralising client data in one place is exactly the kind of decision that creates a new, concentrated target. iSTORM&#8217;s move off static PDFs was a reasonable operational fix to a real problem. Whether it&#8217;s the competitive differentiator the case study frames it as, and whether the portal itself has been held to the standard iSTORM&#8217;s own business depends on selling, are both open questions a board should ask before taking the framing at face value, of this vendor or the next one.</p>


iSTORM Built a Security Portal to Replace PDFs. Here’s the Question Its Case Study Doesn’t Answer

<p>Lambson Building Products, a supplier of building products, wanted to verify how well protected its customer data actually was, rather than assume its existing cybersecurity measures were adequate.</p>
<p>Think Cloud ran a comprehensive cyber risk assessment that included penetration testing, effectively hacking Lambson&#8217;s own systems to surface real vulnerabilities. Following the findings, Think Cloud moved Lambson onto cloud-based server infrastructure, deployed disaster recovery and backup solutions, and transitioned IT support in-house with a dedicated on-site technical team.</p>
<p>&#8220;It&#8217;s been a seamless transition. From taking over all of the IT function within our business, so everything from purchasing hardware, replacing parts, issues with connectivity, software, they&#8217;ve just done it all and it&#8217;s been seamless,&#8221; said David Bean, Operations Director of Lambson Building Products.</p>
<p>The penetration test surfaced vulnerabilities Lambson had not previously known about, which were then addressed through the wider infrastructure and backup overhaul, giving the company stronger data protection and a fully managed, on-site IT support model.</p>


Lambson Building Products Uncovers Security Gaps Through Penetration Testing Before Cloud Infrastructure Overhaul

<p>Portbury Wealth Management, a Principal Partner Practice of St. James&#8217;s Place serving high net worth individuals, previously shared its IT infrastructure with another firm, with internal line-of-business applications accessed remotely via VPN. In 2023, Portbury engaged Chalkline to build its own dedicated IT environment, aiming to increase its security posture, simplify its systems and lay a stronger foundation for future growth.</p>
<p>Lucy Moscrop, Operations Manager at Portbury, explained why the firm returned to a provider it already knew. &#8220;We had worked with Chalkline before and knew them to be professional, proactive and diligent. As a business that is both multi layered and required to meet strict industry guidelines for IT security, it was essential to have a partner we could trust.&#8221;</p>
<p>Chalkline built Portbury a brand new Microsoft 365 tenant with Business Premium licensing and an Azure Virtual Desktop instance that provides secure, simple remote access without needing a VPN client, all wrapped in Chalkline&#8217;s managed services. Alongside this, Chalkline provided managed connectivity with leased line and 5G backup, Microsoft Teams telephony, security services through its Security Bundle, Exclaimer email signatures, cloud backup and full IT procurement.</p>
<p>Lucy said the finished environment met the firm&#8217;s expectations. &#8220;Chalkline delivered exactly what we needed and we would not hesitate to recommend them. They are a great team and a pleasure to work with.&#8221;</p>


Portbury Wealth Management Builds Dedicated IT Environment to Strengthen Security Posture

<p>Allpack provides packaging solutions for blue-chip, multiple-line packaging users, established in 1994 and organised into four divisions, Packaging, Polymers, Corrugated and Equipment, all under the Allgroup brand. Since founding, the company has grown to employ around 50 staff, and with growth comes increased cyber security concerns, particularly as Allpack holds substantial customer data it must keep secure and GDPR-compliant. Keeping that data safe while monitoring the accounts of a growing number of individual users has become one of the company&#8217;s main challenges.</p>
<p>&ldquo;When we have new IT projects, we always try to work with Resolve as we have always been happy with the work they do. Resolve also share many of the same values as Allpack such as success, accountability, professionalism, teamwork and passion,&rdquo; said Claudio Calabresi, CIO of Allpack, describing the company&#8217;s long-standing relationship with its IT partner.</p>
<p>Dark web monitoring was a natural fit for what Allpack wanted to achieve, protecting numerous user accounts while ensuring the company&#8217;s sensitive data doesn&#8217;t get snatched up by hackers online. The service watches the dark web, the part of the internet not accessible through normal search engines, where hackers often sell or leak business information, generating alerts if it detects leaked data or unusual activity so Resolve can intervene before any assets are exploited. Setting up the service began with identifying Allpack&#8217;s highest-risk email domains, the ones most valuable to hackers, alongside personal email addresses of high-value user accounts such as heads of finance, the C-suite and board members. Implementation was straightforward: the chosen domains were shared with Resolve&#8217;s partners responsible for proactively scanning dark web locations, then linked to Resolve&#8217;s ticketing portal so alerts are automatically sent through as incidents for the team to act on.</p>
<p>&ldquo;The set up and installation of Allpack&#8217;s Dark Web Monitoring service was a great success. The automation of alerts is particularly useful for us. The overall project went well and to plan. Our relationship with Resolve is very good and we will continue to work with them on future projects,&rdquo; Calabresi said.</p>
<p>Since the dark web isn&#8217;t accessible through regular search engines, Allpack would previously have been completely unaware if its credentials were compromised. Now the company can find out immediately if valuable business data has been stolen, letting it lock down systems safely and quickly, while the automation frees Allpack to focus on normal operations without the constant worry of cyber security, and monitoring of individual user accounts helps prevent breaches caused by human error.</p>


Cyber Security