Private Equity/Govern
Pen tests. Active attacks. Deal timelines. We fix what's broken.
Multiple PE-backed companies needed security work done fast — pen test remediation, vulnerability assessments, credential hardening, DDoS mitigation, and a zero-downtime cloud migration. All under deal or audit pressure.
- Client
- PE Portfolio Companies
- Engagement
- Multiple engagements
- Focus
- Security & Compliance
- Compliance
- HIPAA, SOC 2

01
The work
Multiple private equity-backed companies across healthcare, benefits administration, and proptech. Each facing security and compliance requirements tied to due diligence, audits, or active threats — on platforms serving millions of members and processing sensitive financial and health data.
What was getting in the way
- Pen test findings blocking a deal. The internal team didn't have the capacity or expertise to remediate before the compliance deadline.
- A separate company needed a full vulnerability assessment before an acquirer's technical team started reviewing their systems.
- Multiple TPA platforms storing passwords in plain text. HIPAA violations sitting in production, serving millions of members.
- An active DDoS attack hitting payment links on a member portal. Revenue collection and member access down.
- A proptech company needed to migrate from AWS to Azure — lower costs, better security — without any downtime on a live platform.
02
What changed
Scope it tight. Fix what matters. Document everything.
Each engagement started with the specific risk event: a pen test report, an upcoming diligence review, an active attack, a migration requirement. We scoped remediation to the timeline and the threat, not a generic security assessment.
03
What we built
For the pen test and vulnerability work, we prioritized by severity and deal impact, remediated the findings, and delivered audit-ready documentation that satisfied compliance reviewers. For the credential issues, we eliminated plain text passwords, implemented secure hashing, and rolled out MFA across affected platforms.
The DDoS response was immediate — identify the attack vector, mitigate, restore service, protect against recurrence. The AWS-to-Azure migration was planned and executed with zero downtime, improving security posture while cutting infrastructure costs. Every engagement delivered the technical fix and the paperwork to prove it.
04
How it works
- PE portfolio companies cleared audit and compliance requirements within deal timelines
- Full vulnerability assessment completed and remediated before due diligence exposure
- Plain text passwords eliminated across multiple TPA platforms. MFA deployed. HIPAA credential requirements met.
- Active DDoS attack mitigated. Member portal and payment processing restored without data loss.
- AWS to Azure migration completed with zero downtime and reduced infrastructure costs
- Audit-ready documentation delivered alongside every technical remediation
05
Business impact
- engagements
- 5
- engagements
- Pen test remediation, vuln assessment, credential hardening, DDoS response, cloud migration
- downtime
- 0
- downtime
- AWS to Azure migration executed with zero service interruption
- audit pass rate
- 100%
- audit pass rate
- Every remediation cleared compliance within the deal timeline
“We had pen test findings that needed to be resolved before the deal could close. AppStream got it done on our timeline, not theirs.”
06
What’s next
Security work that can't wait
If you have pen test findings, an audit deadline, or an active threat and need it handled now, we've done this across multiple PE portfolio companies.
Team
- Justin TannenbaumSolutions Architect
- Lukasz ChmielewskiLead Engineer
- Bartek BienkowskiDevOps & Security
- Piotrek SzyperskiEngineering
Stack
Azure · AWS · .NET · SQL · WAF
More work
Keep reading.
Healthcare/Engineer · Operate
A scheduling engine on a legacy EMR books 250,000 appointments a year.
Read the case studyHealthcare/Engineer
AI scores reimbursement likelihood before a medical device ships.
Read the case studyProptech/Engineer
A 50-state buy-side marketplace, with search that understands intent.
Read the case study