People and process first: Ivo’s playbook for crowdsourced security success
Company: Ivo
Industry: AI / SaaS
Stage: Series B
Headquarters: San Francisco Bay Area
Security focus: Customer Trust, GRC, Vulnerability Management
Challenge
When Saurabh Gupta joined Ivo, a Series B AI company based in San Francisco, he stepped into a role as the lead for Customer Trust and GRC at a company still in the early stages of building its security function.
Fifteen years in customer trust had taught him a fundamental truth: the worst time to learn about a vulnerability is when a customer or prospect is the one telling you about it. The goal was to get ahead of that dynamic entirely.
Gupta had worked with Bug Bounty Programs before and knew the destination he wanted to reach. But the security culture, the internal processes, and the relationship between security and engineering needed to be built. What he needed was not just a platform, but a partner who could walk with Ivo through every stage of that journey, in the right sequence.
Gupta initially reached out to a provider he had used at a previous company. That relationship had meant a lot to him. But his recent experience with the same vendor left him wanting more. As such, further research took him to Intigriti.
I got connected with the Intigriti team, and we hit it right off the bat. They understood the scope really well, the kind of size we are, what we are trying to do and achieve. They understood what I was looking for. The team is approachable, empathetic, and that's what drew me to them. It's the humbleness, it's the drive, the willingness to actually see what a prospective customer is going through and how to help them.
Saurabh Gupta
Director, Customer Trust and GRC at IvoStep one: Understanding objectives and culture
From the first conversation, the Intigriti team invested time in understanding where Ivo was as a business: a Series B company with finite resources, a lean internal security team, and a product moving fast. The question was focused on "what does the right program look like at this stage, and what needs to be in place before it can succeed?"
That conversation quickly surfaced a core principle that Gupta has built his career around: the People-Process-Technology (PPT) methodology. Intigriti aligned with that philosophy from day one. Before any external testing or researcher engagement could make sense, the internal foundation had to be laid. Security awareness across the organization, not just within the security team, had to come first. Developers, product managers, and leadership all needed to understand why crowdsourced security mattered and what their role in it would be.
Intigriti's team recognized that at the Series B stage, building a culture of security internally was the prerequisite to everything that would follow. They worked with Gupta to ensure that by the time the first submission arrived, the internal team was not just operationally ready but culturally prepared.
I have always followed the people process technology (PPT) methodology. It's first the people, then the process, and then the technology, in that order. Having the technology in place, but not having people know how to use it or not having that security mindset is not going to work. You have to start with the people, then the process, build the process around it, and then bring in the technology. You do it in that order, and things will work.
Saurabh Gupta
Director, Customer Trust and GRC at IvoStep two: Launching the VDP
With the internal groundwork in place, the next priority was setting up a public Vulnerability Disclosure Program. Intigriti moved fast, and within 14 working days, the program was launched.
But speed did not come at the expense of structure. Intigriti helped Ivo define a clear scope and set expectations for researchers. For a Series B company with a small security team, unfiltered submissions landing directly in the internal queue could have been overwhelming. Intigriti's triage team covered this: reviewing every submission, validating whether findings were in scope, assessing severity, and matching against CVSS before anything reached Ivo’s internal team.
The weekly rhythm with the customer success team became a cornerstone of the relationship, not just a status check, but a genuine working partnership where Intigriti helped Ivo interpret what the incoming data meant and how to act on it.
If I email Intigriti, they are quick to respond. We have a weekly meeting set up. Things are going well.
Saurabh Gupta
Director, Customer Trust and GRC at Ivo
Step three: Flexible assessments for a fast-moving company
With the VDP up and running, the conversation naturally expanded. For Ivo, customer-specific or compliance-driven security assessments were becoming a recurring need. But committing to a fixed quarterly pentest cadence made little sense at this stage. What the team needed was flexibility: the ability to run targeted assessments when a new feature launched, a customer asked for assurance, or a regulatory milestone approached.
Intigriti's on-demand PTaaS capability delivered through a network of CREST-certified, OWASP-aligned researchers gave Ivo exactly that. Rather than negotiating separate statements of work for every engagement, they gained access to a pool of vetted researchers who could be sourced when needed, on terms that fit the business.
Step four: Security part of the development lifecycle
A VDP and PTaaS surface findings, but findings need to be fixed. One of the most persistent challenges Gupta identified was the gap between the security team and engineering. Closing that gap required the right operational integration.
Intigriti's platform and triage process helped enable this bridge. Because triaged findings arrived validated and prioritized, rather than as raw unverified reports, the engineering team could engage with them more efficiently. The result was a faster feedback loop. Intigriti's customer success team also worked with Ivo to think through how the program data could feed directly into the CI/CD pipeline over time, reinforcing that shift-left philosophy Gupta was advocating internally.
One of the things that is constantly on my mind is bridging the gap between the engineering and security team. Having a conduit helps us ingest security into engineering at every stage, where every new release and every change is being tested. The security team is constantly involved in everything engineering is doing. Building that CI/CD pipeline, thinking of that shift-left technology, and methodology is very important.
Saurabh Gupta
Director, Customer Trust and GRC at IvoStep five: Building the private Bug Bounty Program
With the VDP running smoothly, triage functioning as a force multiplier, pentests delivering targeted assurance, and the engineering relationship maturing, the conditions were right for the next step: a private Bug Bounty program.
But here Intigriti advised deliberate sequencing rather than a rushed launch. This meant that instead of opening the program publicly before internal processes were ready, Gupta elected to start with a private program where researchers were invited from Intigriti's core community to get first access. The scope was defined tightly, and the program grows as the security team's capacity to handle and route findings to engineering grows with it. The goal has always been to be ahead of issues, not managing them reactively.
The private bug bounty program is now in active preparation, with Intigriti supporting scope definition and researcher selection, the final piece of a layered security strategy that has been assembled step by step, in the right order.
What gives me peace of mind is having a proactive program that is working in our favor and letting us know what the vulnerabilities and bugs are. This definitely brings peace of mind, especially when it comes to the assets that we offer to our customers and within our own infrastructure. I represent customer trust, and I would hate to receive a report from a customer that shows critical bugs that need to be remediated in 48 hours. It just creates such an unnecessary rush.
Saurabh Gupta
Director, Customer Trust and GRC at IvoStep six: AI-specific security coverage
As Ivo continues to deploy AI and the regulatory landscape evolves, including the EU AI Act, the security surface is changing. Traditional vulnerability classes remain relevant, but new attack vectors specific to AI systems are emerging. Intigriti offers access to researchers who specialize in AI vulnerabilities, giving Ivo a path to security coverage that keeps pace with the product it is building.
For a Series B AI company, being able to test not just for traditional web vulnerabilities but also for elements like prompt injection, model inversion, data leakage, and other AI-specific risks, via AI specialist researchers, is necessary in order to not play catch-up.
The AI landscape is changing pretty much every week. But one thing is for sure: you have to stay on top of it and see what's new and the latest and the greatest, and how it would impact the scope of a company is very important.
Saurabh Gupta
Director, Customer Trust and GRC at Ivo
Why Ivo chose Intigriti
A team that listened first, understood the objective, and helped build each layer of the security strategy in the right sequence, from internal culture through to Bug Bounty.
The right fit for a company at Series B stage, building security maturity from the ground up, where every step needed to be intentional and sustainable.
Access to on-demand penetration testing through CREST-certified, OWASP-aligned researchers, giving the Ivo team an option for customised assessments without committing to a fixed quarterly cadence.
Support for bridging the gap between security and engineering, enabling a shift-left approach that gets security embedded into the development lifecycle.
A path to AI-specific security coverage, with researchers who specialize in AI vulnerabilities. A critical step for an AI-native company navigating an evolving regulatory landscape.
Final verdict
Gupta’s advice to any security leader considering the same move to crowdsourced security is simple: do it as soon as possible. But the story of Ivo shows that ‘as soon as possible’ does not necessarily mean ‘all at once’. It means starting with the right foundation and focusing on people and culture, and layering on capability in the right sequence, with a partner who understands what it takes to build security maturity from the ground up at a high-growth company.
For Series B and high-growth companies building on their security, the lesson is clear: the right partner does not just supply a platform. They help you sequence the journey: culture first, then process, then technology, so that every layer of your security strategy is built on solid ground. That is the difference Intigriti made for Ivo, and it is the approach that defines how they work with every high-growth company they partner with.
For more information and other customer journeys with Intigriti, visit Customer Stories.
Having a VDP and a Bug Bounty program will only make things better. Do it as soon as possible. That's my advice. This is something that puts you on the map for being proactive. It not only shows that you have a mature security program, but that you take security seriously and take a proactive approach.
Saurabh Gupta
Director, Customer Trust and GRC at Ivo
