CUSTOMER STORY / TELECOMMUNICATIONS & TECHNOLOGY / NEW ZEALAND

How Devoli Built a More Flexible Security Testing Programme With Capture The Bug

CREST-certified penetration testing for evolving technology platforms, with context-aware assessments, tailored reporting and direct collaboration with skilled pentesters.

350+

MSPs, ISPs and enterprise brands served by Devoli

15–30 days

Typical length of the traditional engagements Devoli had used

The business: Supporting security assurance for a complex technology business

Devoli is a New Zealand telecommunications wholesaler and technology company providing network, connectivity and automation solutions to more than 350 managed service providers (MSPs), internet service providers (ISPs) and enterprise brands across New Zealand and Australia.

Its technology enables service providers to deliver and manage broadband, mobile and voice services without building their own physical infrastructure.

With an evolving technology environment and a team delivering new features regularly, Devoli needed a penetration testing partner able to understand its systems, adapt to changing requirements and provide reliable security assurance. It partnered with Capture The Bug to establish a more flexible, expert-led approach that could work alongside its engineering delivery processes.

The challenge: Traditional pentesting wasn't built around how Devoli operated

Penetration testing was already an established part of Devoli's security practices. The challenge was finding an approach that could accommodate the complexity of its environment, provide meaningful results and align with its development cycles. Testing schedules didn't always match release cycles, and traditional engagements could take 15–30 days, which left little flexibility when new functionality or individual modules needed assessment.

Testing individual modules without retaining knowledge from previous engagements could lead to repetitive findings that didn't reflect the application's purpose and existing controls. Reports arrived in different formats from different providers, creating extra work for internal stakeholders and auditors. And waiting until every finding was remediated before retesting introduced unnecessary delays for a team fixing issues alongside ongoing development.

How Capture The Bug delivered

Testing that understands the application, not just the vulnerability

Capture The Bug's pentesters used knowledge from previous assessments when planning and conducting testing on new modules and functionality. That let the team consider existing behaviour, relevant business processes and earlier findings, and focus on technically valid vulnerabilities Devoli's engineers could act on.

Security assurance tailored to Devoli's requirements

Penetration testing reports were customised around the needs of Devoli's internal stakeholders and auditors, giving a more consistent way to communicate findings, severity and remediation information without extensive restructuring.

Closer collaboration between pentesters and engineers

Capture The Bug's PTaaS platform gave Devoli visibility into confirmed findings as testing progressed. Engineers could review vulnerabilities, seek clarification and discuss severity directly with the pentesters, and submit individual findings for retesting as fixes became available.

The outcome: A more practical approach to ongoing security assurance

Testing that accommodates evolving applications.

Devoli gained a more flexible way to assess new functionality and modules, supported by knowledge retained from previous engagements.

More relevant, actionable findings.

Context-aware assessments helped reduce unnecessary repetition and supported findings that reflected the application's functionality and business environment.

Reporting designed for internal stakeholders.

Customised reports reduced the need to rework technical documentation for Devoli's internal reporting and assurance requirements.

Visibility throughout, and flexible retesting.

Devoli's team could review findings during an engagement, collaborate directly with the pentesters, and request retesting of individual findings to coordinate verification with development work.

Together, these improvements helped make penetration testing a more integrated part of Devoli's approach to ongoing security assurance.

WHAT DEVOLI SAYS

“What we've valued about Capture The Bug is their ability to understand our environment and adapt to how our engineering team works. We needed more flexibility around testing, reporting and remediation, rather than a standard pentest engagement. Their team has been responsive, and the ability to work directly with the pentesters, see findings as they come through and request targeted retesting has made the process much better aligned with our delivery cadence.”

Jan Behrens

Chief Technical & Product Officer, Devoli

Security testing that works with your business

Devoli's experience highlights an important consideration for technology organisations: effective penetration testing requires both technical expertise and an understanding of the environment being assessed. As applications evolve, security testing needs to stay relevant to changing functionality, business processes and engineering priorities.

Build confidence in what you ship

Whether you're managing complex applications, releasing new functionality regularly or strengthening an ongoing security assurance programme, talk to Capture The Bug about a penetration testing approach suited to your environment.

Talk to a Security Expert