Skip to content
case study Technology / Finance Industry

How a Fintech Streamlined PCI DSS Requirement 6.5 and Increased Developer Engagement

Mexico’s first payments unicorn replaced check-the-box video training with hands-on lessons, rolled out in under two weeks.
Region
North America
Users
1,000
Company Size
Mid-Size
Industry
Financial
Compliance
PCI
01 · The Company

Mexico’s first payments unicorn

Based in Mexico City, this fintech holds the title of the first payments unicorn in Mexico, the world’s 12th largest economy.

It offers a wide range of payment solutions that make digital payments simple and accessible, democratizing financial services across Mexico.

02 · The Challenge

Training was completed. The code said otherwise.

Every developer had completed video-based secure coding training to satisfy PCI DSS Requirement 6.5. But a security test showed some hadn’t grasped the content.

The final report revealed concerning patterns in coding practices. Part of the team had missed simple steps that would have eliminated some vulnerabilities.

Checking the compliance box wasn’t enough. The company needed better application security, and that meant a better training solution.
security-test --report final
training_completed100%
content_retainedpartial
simple_vulns_missedyes
verdictreplace training
03 · The Requirements

Seven criteria for a replacement

PCI DSS-specific content. Fintechs that handle card payments and store PII must comply with the PCI Data Security Standard.

Simple compliance tracking and reporting. Administrators shouldn’t spend tens of hours chasing developers to finish on time.

Engaging and effective. Engineers had called the previous video training boring and repetitive.

Language support. Hundreds of developers work across a broad range of programming languages.

Comprehensive coverage. Beyond the OWASP Top 10, the business needed API and mobile security lessons.

Ease of deployment. A busy information security team needed something simple to set up.

Engineering buy-in. InfoSec would choose the solution, but engineering would take the training.
04 · The Solution

Rolled out in under two weeks

After evaluating Security Journey’s secure coding training platform, the company found it met every requirement. During the proof of concept, both the security and engineering teams became fans.

Setup was simple: single sign-on brought every user in, and mandated courses were already assigned when developers logged in.

rollout --org fintech
authSSO
courses_assignedpre-configured
languagesall supported
time_to_rollout< 2 weeks
05 · The Results

Developers asking for more training

One user found he had access before the official launch and finished the training before it rolled out. Busy developers kept making time for it, and some asked for modules that weren’t required.

Reporting made compliance easy. A visual shows who hasn’t started, reminders go out through the Slack integration, and a downloadable completion report with names and dates provides audit evidence.

Even though our developers are very busy, they are making the time to complete the training. I even have people approach and ask for access to other training modules that are not required.

InfoSec Lead, Fintech Company
The Results

Fast rollout, real engagement, audit-ready evidence

<2 wks

From kickoff to full rollout with SSO

1,000

Users trained on one platform

7/7

Selection criteria met

Download the Case Study

See how they streamlined PCI DSS 6.5