Client Overview
The company partners with municipalities and shelters across the US and Canada to provide pet-related services. Their SaaS platform handles regulated payment data and integrates with city and county systems, supporting thousands of partner-specific tenants. With customer contracts that require ongoing PCI compliance and a security operations team of just two, they need a PCI ASV they can actually rely on.
The Challenge
A PCI Program That Needed Real Validation
As an organization that processes payments and supports municipal partners, the company must maintain PCI compliance and provide attestation reports to customers, insurance carriers, and partner cities. Many of their contracts spell it out: quarterly PCI scans are not optional.
But after stretches of compliance reports that surfaced no issues at all, the team grew uneasy. With a small two-person security operations function and a platform that kept evolving, they wanted confidence that quarterly scans were actually validating their environment, not just rubber-stamping it.
"We needed a better system to make sure," said the company's Information Security Analyst. After vetting roughly ten vendors, they chose Halo Security.
The Solution
A PCI ASV You Can Actually Get on the Phone
The team turned to Halo Security as their PCI Approved Scanning Vendor, then quickly expanded the relationship to include External Attack Surface Management, application scanning, and manual penetration testing.
What stood out during evaluation was something deceptively simple: the ability to reach a real person. "A lot of [vendors] want you to trigger things right through the support role, like just here's an email, send it to them, chat. Sometimes I like to talk to somebody over the phone, figure it out right away, and then follow up through support."
Onboarding required a real conversation. The initial scan returned hundreds of subdomains across the company's multi-tenant architecture, and Halo's team helped scope the engagement to focus on what actually mattered.
The platform itself reinforced the decision. "What stood out was how easy things were to acknowledge as false positives, how detailed the report was, and how easy the executive summary was for the C-levels to read."
The Results
After nearly three years with Halo Security, the team has built a PCI program that works for both their internal stakeholders and the partners who depend on them.
- Cleaner attestations that close more deals. The compliance documentation has become an enabler for the sales team. "A trusted source makes it a lot easier for our salespeople to close the deal when they say here's our attestation that we're good," the analyst shared. "[Our partners] want to make sure that the company they're dealing with is safe."
- Real findings, not rubber stamps. Halo's scans consistently surface issues worth addressing, giving the team confidence that compliance reports reflect actual security posture. "I know my system is being protected."
- Continuous EASM coverage beyond quarterly scans. The platform also drives the team's day-to-day vulnerability management work, with findings flowing directly into the engineering team's Jira queue for fast remediation.
The Halo Difference: Real Humans, Real Findings
For this customer, the differentiator is the relationship with the Halo team. In a category where most vendors push customers toward ticket queues and chatbots, the company's analyst has a direct line to a Halo support engineer who knows their environment.
"We've got a good rapport. We tell each other the way it is, we laugh, we've got good jokes. Support is two million percent."
That responsiveness extends across the entire Halo team. For organizations that need a PCI ASV to be more than a quarterly report generator, the analyst's recommendation is direct: "I would recommend [Halo], especially if you're looking for something in PCI compliance or even vulnerability management. The support is amazing."
