How Deserve Achieved 360-Degree Visibility with Traceable

Download Case Study
Software & Technology
North America
Henric Andersson
CISO, Deserve

Henric Andersson is the Chief Information Security Officer for Deserve. In charge of all security – platform, infrastructure, physical, etc – Andersson’s role spans both IT and security.

Executive Summary

Deserve is a leading mobile-first, API-driven modern credit card platform and one of . As a cloud-based company – Deserve is a docker-based, container-based solution. Without a single monolithic app, they have a high volume of API calls, and previously used only AWS Cloud Trail to maintain a view of their APIs.

Without an API Security platform, Deserve had limited insights into their API activity. Lacking a comprehensive view, it was time-consuming for their team to identify potential threats or vulnerabilities, increasing their risk of facing negative outcomes.

We don’t want to first have an issue, and then implement the security that we should have had from day one.– Henric Andersson, CISO, Deserve

Needing to proactively address API security, Deserve sought a solution that would address all of their concerns.

Traceable means time savings. It also means we scale as a platform. Had we not had something to cut down the time our engineers would have to spend on this, we would have to have more DevSecOps people to handle it, and at the end of the day we would probably be burning them out. Traceable prevents burnout while offering scalability and security.

Case Study Highlights


Deserve Inc. is a leading mobile-first credit card platform built on a cloud-native and API-enabled architecture, which allows partners to offer superior personalized experiences for cardholders.

Deserve’s mission is to modernize the credit card stack through a mobile-first, API-driven, configurable platform.

  • Lacking 360 ° API visibility = Limited view into APIs and activity
  • Insufficient WAF
  • Time-consuming alternatives
  • Abundant data with inaccessible insights
  • 865 – threats blocked/week
  • 3.8 mil – traces/day
  • 360 ° visibility of APIs
  • PCI-DSS Compliance Visibility
The Challenge

Life at Informatica Before Traceable

APIs = Universal attack vector but WAF’s don’t protect layer 7

Deserve, a container-based cloud solution, requires comprehensive API oversight for effective scaling. Amazon’s CloudTrail falls short in providing this view. According to Henric Andersson, it lacks an overall platform perspective. Deserve aims to enhance security, understanding that attackers can bypass conventional protections through vulnerable APIs. Traditional security technologies like WAF may become ineffective once an attacker gains access.

No Visibility into the big picture - Needed a 360 ° view.

Deserve faced challenges in monitoring North-South-East-West traffic, leading to an inability to spot true threats amidst numerous CloudTrail alerts and false positives. Scaling their approach and tracing API activity became impossible. This lack of visibility posed significant risks to data security and compliance. Deserve required a comprehensive, context-aware platform to monitor API activity and obtain a holistic view of system interactions.

Impossible analytics. Data with no insights.

Desiring a more efficient and automated solution, the team sought a specialized tool for API insights. They needed deep visibility into API traffic history and user behavior analytics to detect incidents and uncover potential vulnerabilities. The goal was to integrate this tool with their WAF for immediate threat mitigation. Their elastic SIEM with machine learning capabilities was insufficient for these specific requirements.

We have an elastic charged SIEM. However, it is more like a blunt tool – a generic instrument which doesn’t specialize in API insights.
Obvious concerns hitting the FinTech industry

Henric Andersson’s team prioritized API security due to the rising attacks and the extensive attack surface APIs create. Securing APIs was crucial for Deserve’s customer-facing mobile app and platform interactions. They recognized that API security not only protected sensitive data but also helped identify potential issues for debugging and improving the user experience. A comprehensive tool was necessary to ensure secure data flow and enhance the development process.

Many product claims were insufficient.

Deserve explored other API security options but found them invasive for their AWS Fargate setup. When they saw Traceable’s demo, they were impressed by its capabilities and flexible implementation. Being able to run in parallel with existing tools like Automatic Cloudflare rules and leverage machine learning for proactive reactions was a key selling point. They sought a tool like Traceable to enhance immediate security response and reduce the risk of delays or outages caused by security issues.

The Transformation

Life After Deploying the Traceable platform

With Traceable, Deserve now has a comprehensive view of their attack surface, with full North-South-East-West visibility into their API activity and insights into all of their API activity. They’re able to stay ahead of industry concerns, remediating API vulnerabilities and threats without bottlenecking their platform or their productivity. The team also enjoys the added benefits of a total API Security Platform, with visibility into erroneous data or data-sharing, and detection of buggy behavior.

It was interesting to come to engineers from security and say ‘hey, you most likely have a bug here.
Fewer WAF alerts and concerning alerts, all buttoned up.

With Traceable, Deserve’s Security team gains a comprehensive view of their API attack surface, prioritizing flagged issues and preventing data exposure. Traceable identifies vulnerable API endpoints handling sensitive data, allowing the team to focus on enhancing security controls. Automatic detection and remediation of vulnerabilities save time and increase confidence in API protection. Engineers can review decisions and rely on automation to shut down risky requests, resulting in fewer alerts to investigate and more efficient security management.

We are now seeing fewer Cloudflare alerts or Traceable alerts that must be investigated because automation is there to close the loop.
The fact you have something that stitches all the API calls together gives you that level of confidence, we actually are not afraid to tie it back to Cloudflare and let it automatically shut down requests
Total visibility = time saved

Traceable produces customizable reports of API vulnerabilities, facilitating quick reactions and improved platform visibility. The analytics engine offers a comprehensive understanding of API traffic history, enabling post-mortem analysis, threat-hunting, and fraud detection. Traceable’s API data lake enhances security by preventing data breaches and optimizing API usage for efficiency. The centralized dashboard saves time, providing valuable insights in one place and allowing the team to focus on solutions rather than manual work.

Traceable’s Machine Learning helps Deserve to scale securely.

Traceable extensively monitors API behavior and user access, establishing a baseline for quick anomaly detection. Its AI/ML capabilities provide additional protection against API fraud, setting it apart as the best choice for the team. Generic pen-testing tools like Burp Suite and Nessus lack platform awareness, hindering gap identification. Traceable’s depth and cost-effectiveness eliminate the need for additional hires. Fewer and more meaningful alerts free up time for other priorities, reducing the burden of sifting through data for investigations.

Easier compliance and debugging, amazing support.

Traceable offers value beyond API security, assisting with compliance visibility and debugging, while providing excellent support. In the FinTech sector, Traceable simplifies PCI DSS compliance visibility for the team, impressing auditors with its comprehensive monitoring. The platform benefits both security and development teams, providing a debug console for the whole infrastructure. Andersson appreciates the support, which ensures successful product adaptation and helps Traceable flourish as a truly great solution.

I can use Traceable for my whole infrastructure. I don’t need to go around and instrument individual things; I can look at the whole picture, see what went wrong and where it went wrong.