Xygeni Logo White
Start Free
Book a demo

Banco Serfinanza cuts finding management time by around 90% and automates its secure development controls with AI

Case Study

Banco Serfinanza logo

Case Study

Download Case Study PDF

About Banco Serfinanza

Banco Serfinanza S.A. is a Colombian financial institution headquartered in Barranquilla, specializing in consumer banking, retail financing and financial solutions for small and medium-sized businesses.

As part of its growth and digital transformation strategy, the Bank has built its own technology capabilities to speed up the launch of digital products and services. Its software development rests on two pillars: an in-house software factory and a group of specialized strategic partners who also write code for the Bank.

The Challenge: built-in security across distributed development

When development speeds up and is also split between an internal team and several external partners, security control can no longer rely on manual reviews. Every delivery is a chance for a code vulnerability or an insecure infrastructure configuration to reach production without anyone spotting it in time.

And detection was not the problem. With periodic reviews, the security team received volumes of findings that had to be classified by hand, deciding one by one which deserved a developer's time, and then assigning them. That classification work, not the analysis, was the bottleneck. Banco Serfinanza identified three specific needs:

• Continuous, consistent visibility into the risk of all code entering the Bank, whether written by its internal factory or by a partner.
• Automatic prioritization, not manual triage. Deciding what to fix first should not depend on someone reviewing lists one by one.
• Control inside the development cycle, not after it. Analysis should run on every commit and every pull request, not as a periodic review that leaves gaps between one round and the next.

The underlying goal was not to add another analysis tool: it was to strengthen secure development governance with automated, measurable evidence.

Our challenge was not detecting vulnerabilities, it was doing it at the speed at which our internal development team and our external partners move. The fast pace of the business means a constant increase in the code entering the Bank, and with manual controls that was not sustainable.

Leonell Santiago Sanandres

Director of Operational Risk

The Solution: a platform aligned with the digital transformation vision

The Bank adopted Xygeni after a thorough evaluation of the alternatives available on the market.

The first contact took place at 18ENISE, the event organized by INCIBE in León, Spain, where the Banco Serfinanza team discovered Xygeni's approach to managing security in software development.

From there, a proof of concept was run to validate two things: that the platform integrated with the processes and tools the Bank already had in place, and that the results it produced were actionable without adding workload to the security team.

Xygeni covers the full cycle from a single platform, with analysis of proprietary code, open source dependencies, running applications, APIs, exposed credentials and infrastructure as code, plus software supply chain protection and an ASPM layer that consolidates both its own findings and those ingested from other tools into a single risk model.

From that platform, Banco Serfinanza deployed four capabilities, chosen for their fit with the Bank's priorities: AI SAST on proprietary code, CI/CD Security on the pipelines, IaC Security on infrastructure as code, and the platform's artificial intelligence layer, which automates the triage and prioritization of everything the other three detect.

The integration was done on GitLab, adding analysis to the existing pipelines. Repositories were onboarded progressively, in phases and according to the Bank's priorities, instead of switching on analysis across the whole estate at once. That decision avoided the usual effect of a security rollout: an initial volume of findings so large that development teams ignore it.

The results showed strong alignment with the organization's goals, especially in automation, risk visibility and stronger secure development controls.

Xygeni products used

Although Banco Serfinanza has tested all Xygeni products, increasing analysis coverage and issues detection, the focus and validated benefits during the PoC were concentrated on the following:

CI/CD Security

Pipelines are analyzed as code, at the same cadence as application code. Xygeni checks pipeline definitions and SCM settings for insecure configurations, excessive permissions, unprotected branches and risk in the build process, mapped to the OWASP CI/CD Top 10. For a bank with distributed development, the pipeline is as critical a control point as the code itself: it is where everything entering the Bank converges, whether it comes from inside or outside.

AI SAST

AI-powered static analysis of proprietary code on every commit and pull request. It detects insecure patterns such as SQL injection or cross-site scripting and uses the repository’s own context to separate what is exploitable from what is theoretical, so developers only see what matters. The same standard applies to code from the internal team and from strategic partners, and when a finding is confirmed, AI Auto-fix proposes the fix directly in the pull request.

IaC Security

Insecure configurations in infrastructure as code are detected before they are provisioned, across Terraform, CloudFormation, ARM, Bicep, Kubernetes, Helm and Dockerfiles, plus the container images they build. Guardrails in the pull request and the pipeline stop a risky change before it reaches the cloud, and AI Auto-fix proposes the corrected template. The fix happens when it costs minutes, not after deployment, when it costs a maintenance window.

The Results

90% less time spent identifying, prioritizing and assigning security findings
The savings do not come from detecting faster, but from no longer classifying by hand. Analysis went from a periodic review to running automatically on every commit and every pull request, and the AI layer delivers risk already ordered by real context instead of theoretical severity. What used to be a recurring task for the security team, reviewing lists and deciding what to assign to whom, now arrives already resolved. The jump to that 90% coincides with the introduction of the artificial intelligence layer. Continuous detection was already solved with AI SAST, CI/CD Security and IaC Security; what was missing was eliminating the manual work that piled up after each analysis.

Governance over code that the Bank's own team does not write

Security control applies equally to development from the internal factory and from strategic partners. The Bank moved from trusting each supplier's practices to requiring the same verifiable standard, with automated evidence that it is met on every delivery, across more than 100 repositories under continuous analysis. This is the result with the most long-term reach in the whole deployment. A standard that is checked on every delivery does not depend on each partner's maturity or on the commercial relationship with them, and it gives the Bank a different position in its conversations with suppliers.

Early detection of weaknesses before production deployment

Code vulnerabilities and insecure infrastructure configurations are identified within the development cycle, where fixing them costs a fraction of what it costs later. Today, all critical and high findings are resolved before they reach production.

From finding to fix: the cycle is measured in hours, not days

A weakness that could previously go undetected until the next scheduled review now appears within minutes, inside the same pull request where it was introduced, and is fixed while the context is still fresh for the developer. Fixing stops being an interruption and becomes part of the work already in progress.

Automatic prioritization: from a volume of findings to a short list

Triage is no longer a task for the security team. The platform's artificial intelligence orders risk by real context and reduces the noise that reaches development teams. The effect is not only technical: it improveAutomatic prioritization: from a volume of findings to a short lists the relationship between security and product, because what developers are asked to fix is justified.

Implementing Xygeni has allowed us to significantly strengthen our secure development processes by automating controls and detecting vulnerabilities early.

We have cut the time we spent managing and prioritizing findings by around 90%, and today most of them are resolved before reaching production. Beyond the platform's technical capabilities, we value its team's commitment to continuous improvement, innovation and close support throughout the whole process.

Xygeni has become an important enabler within our digital transformation and technology risk management strategy.

Leonell Santiago Sanandres
Director of Operational Risk, Banco Serfinanza S.A.
Download Case Study PDF

Secure your Software Development and Delivery

with Xygeni Security

Watch Video Demo
Book a Demo