CUSTOMER STORY / HR TECHNOLOGY / SINGAPORE

How FastCo Brought a Critical Security Finding Into View Within 24 Hours

A fast-moving HR technology company moved from delayed, end-of-engagement reporting to expert-led penetration testing with early findings, direct collaboration and a clearer route to remediation.

WITHIN 24 HOURS

Testing launched after scoping

WITHIN 24 HOURS

Critical finding identified after launch

LIVE VISIBILITY

Dashboard, Slack and Jira workflows

Customer

FastCo Pte Ltd

Industry

HR technology / SaaS

Location

Singapore; platforms serving Southeast Asia

Solution

Penetration Testing as a Service (PTaaS)

Partnership

Since March 2026

Securing the platforms that connect people to work

FastCo is a Singapore-based HR technology business behind FastJobs, a recruitment platform for non-executive roles, and FastGig, an app connecting people with flexible work. Its services support employers and jobseekers across Singapore, Malaysia and the Philippines.

The platforms process candidate and employer information as part of everyday hiring workflows. For a product team shipping new functionality, maintaining confidence in those systems calls for security testing that is both technically credible and practical to act on.

FastCo engaged Capture The Bug to bring penetration testing closer to its development workflow, with specialist-led assessments and a shared platform for seeing and discussing findings as work progressed.

The challenge: Valuable findings were arriving too late

FastCo was already investing in penetration testing. The difficulty was getting timely, actionable security insight from a process that often operated separately from the product team.

Long waits before vulnerabilities were visible

In previous engagements, FastCo could wait around seven to ten days from the start of testing before seeing findings. A final report delivered information, but did not help the team prioritise issues while testing was underway.

Too little context around findings

Earlier assessments had not consistently produced actionable results. Without direct access to the people conducting testing, clarifying impact or discussing severity could become a separate exercise.

Security work sat outside familiar tools

FastCo wanted a way to see what had been confirmed, ask questions and involve engineers without relying on a one-off report and disconnected email exchanges.

The requirement was not simply a faster report. FastCo needed credible testing, useful findings and an ongoing conversation between its engineers and the people assessing its platform.

The approach: Expert-led testing with feedback as it happened

Capture The Bug delivered FastCo’s engagement through its PTaaS platform, combining hands-on testing by security specialists with a collaborative workflow for findings and remediation.

1
1. Start quickly and share findings early
Following scoping, testing was initiated within 24 hours. Confirmed issues were added to the platform as they emerged rather than being held for a final report. A critical vulnerability was identified within the first 24 hours of testing, giving FastCo an early, concrete issue to investigate and address.
2
2. Make findings easier to understand and act on
FastCo could review submitted vulnerabilities through a live dashboard, discuss technical details with the testers and clarify questions about risk and severity. This placed the reasoning behind findings alongside the evidence the engineering team needed.
3
3. Connect testing to the engineering workflow
Slack and Jira integrations enabled findings and updates to reach the tools FastCo already used. Rather than treating penetration testing as an isolated delivery, the team could incorporate remediation discussions into its normal work.

The results: Earlier insight and more actionable assurance

The new approach changed how quickly FastCo could see security issues and what its engineering team could do with the information.

A critical issue surfaced on day one

Capture The Bug identified a critical vulnerability within 24 hours of launch. The result provided an early, actionable signal, without waiting for the full assessment to conclude.

Visibility during testing

Findings became available as they were confirmed, giving FastCo a more immediate view of the assessment than a traditional end-of-test report.

Direct dialogue with the pentesters

In-app discussion helped the team seek clarification and work through severity and remediation questions with the specialists performing the work.

An easier hand-off to engineering

Slack and Jira integrations helped bring security findings into existing channels for review, prioritisation and follow-up.

Security testing is most useful when teams can act while it happens

FastCo’s experience shows the value of pairing specialist testing with timely communication. Early visibility, clear technical context and a shared remediation workflow can make penetration testing a more useful part of an organisation’s everyday security work.

Make security findings easier to act on

Speak with Capture The Bug about expert-led penetration testing that fits your delivery workflow.

Talk to a Security Expert