(929) 590-5818 [email protected]
en
en

GCP security audit for PCI DSS readiness

Client:
International fintech company
Industry:
FinTech
Focus:
Cloud security audit on the GCP platform
Main challenge:
Protection against unauthorized access to administrative resources and personal or financial data leaks
Market:
International
Services provided:
Cloud penetration testing, cloud security assessment
Key Takeaways
  • PCI DSS compliance achieved.
  • Risk of unauthorized access reduced by 90%.
  • 12 vulnerabilities identified and remediated.
  • Project completed ahead of schedule in 4.5 weeks.
  • Robust resource monitoring and event logging implemented.
    • 12
    vulnerabilities identified
    90%
    risk reduction
    4.5-
    week audit duration
    GCP security audit for PCI DSS readiness
    Apr 25, 2026
    3 min
    Can a fintech’s cloud infrastructure be prepared for regulatory requirements in 4.5 weeks? Yes, it can! The Datami team conducted a White-box pentest and Google Cloud security assessment, identifying 12 vulnerabilities, and resolving these reduced unauthorized access risk by 90%.

    The client is a fast-growing fintech company specializing in real-time transaction analytics and fraud detection for digital payment platforms and neobanks, serving approximately 200,000 users. 

    The company processes millions of financial events daily, leveraging Google Cloud infrastructure for data analysis, regulatory compliance management, and machine learning-driven risk assessment.

     

    Tasks and challenges
    To enhance infrastructure security and prepare for PCI DSS certification, the client engaged Datami for a GCP security audit. 
    The company needed to identify configuration and access vulnerabilities for early remediation and to improve its cybersecurity level. 
     
    • Conduct a comprehensive White-box security audit of the Google Cloud Platform environment. 
    • Identify and prioritize risks that could lead to unauthorized access or data leaks.
    • Assist in preparing the infrastructure for regulatory compliance.
    icon
    Object
    Audit GCP security: console, Organization, Folders, IAM, storage, network, and monitoring
    icon
    Standard
    Assess configuration compliance with PCI DSS requirements
    icon
    Result
    Technical report including vulnerabilities and a remediation plan
    Datami methodology for GCP audit

    Our approach

    In this project, we conducted White-box penetration testing and cloud security assessment of the Google Cloud Platform environment. Both automated and manual checks were used. 

     

    For the cybersecurity audit, Datami specialists used Google Cloud Console, IAM & Admin, Security Command Center, Cloud Identity, Policy Analyzer, Cloud NAT, Cloud Armor, Cloud Run, and Artifact Registry.

    White-box

    White-box

    Full-access testing approach for deep system analysis
    Key work stages and solutions

    The project began with a kickoff meeting to align GCP audit priorities and obtain a test account.

    Communication was organized through a real-time chat, where the client received interim progress reports. This ensured rapid data exchange and allowed all testing stages to be completed ahead of schedule.

    • Preparation
      Studying GCP structure and documentation, obtaining access, and setting up tools.
    • Testing and security assessment
      Automated scanning and manual search for vulnerabilities in IAM  configurations and network objects.
    • Result documentation
      Analyzing results and checking PCI DSS compliance. Preparing the final report with recommendations.
    Cybersecurity starts with action
    How we can help you?

    Every cybersecurity case study we solve involves deep analysis, tailored solutions, and measurable results.
    Datami has already helped over 600 companies strengthen their digital defenses — and we can do the same for your business.
    Ready to take action?

    Let’s start with a free consultation!
    Results and Recommendations

    Results and Recommendations

    Project tasks were completed in 4.5 weeks. The security audit reduced the risk of unauthorized access by 90%. 

    During the pentest, Datami specialists identified 12 vulnerabilities: 1 high, 5 medium, and 6 low. 

    The client received a clear action plan to strengthen cybersecurity, specifically recommending the following:

    • configure two-factor authentication (2FA) for all accounts, especially privileged ones; 
    • enable resource monitoring and event logging for timely detection of suspicious activity; 
    • update software library versions and remove unnecessary dependencies. 

    The fintech company's Google Cloud infrastructure became a managed, secure environment, and compliance levels, following the implemented measures, align with cloud security best practices.

    Key Project Results

    Default cloud settings can become entry points for attacks. As this cybersecurity case study demonstrates, risks often stem from basic gaps rather than complex attacks. 

    Through the pentest and security assessment, the client avoided confidential data leaks, preventing potential financial and reputational damage, and prepared for regulatory audits.

    Indicator
    Pre-project
    Post-project
    Risk level
    High
    Low / managed
    Compliance with standards
    Low (PCI DSS)
    Aligns with cloud security best practices
    Vulnerabilities
    Unknown / unassessed
    12 vulnerabilities identified and remediated
    Unauthorized access risk
    High
    Reduced by 90%
    More success stories with Datami
    Browse other project case studies
    Azure Audit for a Government Business Platform
    Azure Audit for a Government Business Platform
    • ISO/IEC 27001 and GDPR compliance achieved
    • Infrastructure set up for the website update launch
    Services:
    Azure Security Audit (White-box)
    Mar 5, 2026
    AWS Security Audit for a Recruiting Platform
    AWS Security Audit for a Recruiting Platform
    • Threat detection time reduced to 20 minutes.
    • Full compliance with GDPR requirements ensured.
    Services:
    AWS cloud environment security assessment (White-Box)
    Mar 3, 2026
    Mobile App Security Outstaff Audit
    Mobile App Security Outstaff Audit
    • Identified dangerous configurations and data leaks
    • Strengthened security before product launch
    Services:
    Nov 20, 2025
    Back to home page
    Security image
    Ready to assess your project's security?
    Contact Datami — we’ll help you identify risks, strengthen your cybersecurity, and confidently pass certification.
    Datami articles
    Top 3 Industries with the Highest Number of Critical Cybersecurity Vulnerabilities from Datami Practice Oleksandr Filipov
    Oleksandr Filipov
    Top 3 Industries with the Highest Number of Critical Cybersecurity Vulnerabilities from Datami Practice

    Which industries face the highest concentration of critical cybersecurity risks? Based on an analysis of the Datami project results, we identified three sectors where the average number of critical vulnerabilities discovered per project is the highest.

    Mar 31, 2026 15 min
    Top 4 Most Vulnerable Industries According to Datami Oleksandr Filipov
    Oleksandr Filipov
    Top 4 Most Vulnerable Industries According to Datami

    Does the level of cyber risks depend on the industry? Datami analyzed the relationship between the number of vulnerabilities and the business sector of companies and identified the top industries with the highest concentration of weak points.

    Mar 27, 2026 10 min
    Types of Cybersecurity Vulnerabilities: The Most Common and Critical from Datami’s Practice Oleksandr Filipov
    Oleksandr Filipov
    Types of Cybersecurity Vulnerabilities: The Most Common and Critical from Datami’s Practice

    In this article, we outline the main types of vulnerabilities. Based on the results of our projects, we have also compiled top lists of the most common and the most critical ones.

    Mar 7, 2026 15 min
    Show all articles
    Order a consultation
    By submitting this form, I confirm that I have read and agree to the Privacy policy
    We value your privacy
    We use cookies to enhance your browsing experience, serve personalized ads or content, and analyze our traffic. By clicking "Accept All", you consent to our use of cookies. Cookie policy