Meet CWS, the team your security team calls. Founded in Montreal in 2018 by cyber engineers who ran enterprise security programs and knew exactly what great outside help should look like, so they built it. CWS deploys, tunes and runs security so it does what it was bought to do, then sticks around to take it from working to scalable, with expertise in BFSI (banking, financial services and insurance), health tech and AI-native companies across the United States and Canada. Fun to work with. Serious about the outcome.
A Case Study – An 8-Figure AppSec Deal. Zero Internal Capability. One Week to Delivery.
How CWS turned an impossible timeline into a permanent new service line for a national VAR with 300+ employees and no application security practice.
The problem
A national VAR was pursuing an 8-figure AppSec transformation deal with one of the largest gambling companies globally. The end client needed comprehensive application security: tool selection, program architecture, vulnerability assessment processes, and ongoing delivery across a complex, multi-org environment.
The partner had no AppSec capability. Not a thin bench. No bench at all. No practitioners on staff. No methodology. No prior delivery experience. And the customer expected delivery to begin immediately.
How we did it
Within seven days of signing the partner agreement, CWS was on discovery calls with the end client. Over the next three weeks, we owned technical discovery and presales, validated Snyk as the core platform, and identified additional tools that expanded scope and added product resale revenue for the partner. Phase 1 delivered the AppSec program across the main organization, covering code review processes, CI/CD integration, and vulnerability detection. Phase 2 deepens the implementation with additional tooling and broader coverage, with rollout to 10+ portfolio organizations planned.
Why this worked
The partner owned the client relationship but had no AppSec bench. CWS filled that gap with senior practitioners and a proven methodology, putting expertise in front of the customer within days with no ramp up. Because we ran presales and tool selection, every technical decision also grew the partner’s resale line. We built a program designed for multiple phases and organizations rather than a one time assessment, turning a single deal into a recurring revenue stream. And we did it on our first project together, for a large global enterprise, under significant reputational risk and active vendor pressure.
Results
CWS turned AppSec into a new revenue engine for our VAR partner. We preserved an eight figure deal and delivered the full engagement without a single internal AppSec practitioner on the partner’s side, moving from introduction to delivery in seven days, the fastest activation in the partnership’s history. The program generated $500K+ in services revenue for the partner across Phase 1 and Phase 2, with additional phases planned, and is built to scale across 10+ portfolio organizations under the client’s umbrella. Our tool selection expanded scope further, driving incremental product resale for the partner. AppSec went from a capability they could not sell to a permanent revenue line.
—————-
Who we support
CISOs and security leaders at large enterprises, mostly in banking, financial services and insurance, fintech, health tech and AI-native companies across the United States and Canada, where engineering runs at a scale no security team can review by hand.
What’s different about CWS?
The approach is programmatic. CWS does not arrive with a tool to install. It starts from the organisation as it actually is: what is exposed to the public, which compliance frameworks apply, and what the business needs to ship. From that it works out what application security the company actually needs, scores current practice against NIST SSDF and OWASP SAMM, and sequences tools, process and measurement into a roadmap leadership can fund and engineers can execute. Then CWS delivers it: deploying the tooling, winning over the engineering teams, fixing the process, and defining the KPIs with the client and running the program against them.
