Driva

Driva is an Australian-founded fintech that makes it easier to get vehicle and personal loans in Australia, New Zealand and the United Kingdom. Customers get personalized loan options from a panel of more than 40 lenders in under a minute, with no hidden fees. Driva’s team moves quickly, which is great for customers but means the cloud environment behind the product has to keep up.

Challenge

Driva grew quickly, and its AWS environment grew with it. In the early days, engineers added resources when they needed them, and it was difficult to keep a central record of how they were set up. By the time Driva moved out of startup mode, the team couldn't say for certain which resources were exposed, or to what.

They needed to find out, and they needed to know where to start. Any cloud environment produces findings at every severity level - Driva’s team had to work out which ones to fix first.

"We were growing fast and out of startup mode, so we needed to get a handle on what was good and bad in our AWS environments. We had no record of what was exposed to where." - Tim Bailey, Solution Architect, Driva

Solution

"We wanted a security-focused application that could pull the risks and present the most important items to fix. There are always many levels of issues, and we need to focus fast on the most important." - Tim Bailey

Plerion connected to Driva's AWS accounts and mapped what was exposed and to what. It ranked each finding by how much risk it posed and showed attack paths, so the team could see which issues led somewhere that mattered. Engineers now start at the top of the list and work down.

Key benefits

• A clear view of what's exposed: The team can now see which AWS resources are reachable, and from where.
• Priorities, not a backlog: Findings are ranked, so engineers start with the ones that matter.
• Room for other teams to experiment: Driva's BizOps team is building AI solutions and vibe coding in AWS. Plerion lets engineering see what those projects expose, so they don't have to block them.

"Plerion allows us to be more confident in allowing our BizOps team to play around with implementing AI solutions and vibe coding in AWS, with an ability for us to keep an eye on what they are exposing." - Tim Bailey

Results

The first scan turned up staging resources that were open to the internet and shouldn't have been. Nobody at Driva knew about them. The team locked them down.

Since then, Driva's risks and attack paths have been trending down.

Driva is now rewriting all of its AWS infrastructure in AWS CDK. The team is relying on Plerion to check that new resources are configured securely as they're created, so the migration doesn't bring in new risks.

"When we first configured Plerion, we discovered we had some staging resources public on the internet that were not supposed to be like that. Locking that down was a great win that we didn't know about." - Tim Bailey

Want to learn more? Book a demo and see what it’s like to have real help, not just another dashboard.