How Tucafi validated its CRM in a single cycle and keeps remediating its critical systems without slowing down operations

About Tucafi

Tucafi is a Mexican financial company that provides loans and financial services to entrepreneurs, merchants and micro-business owners. Its entire lending operation runs on production systems: a financial core, a CRM and a contracts and digital signature application used by its loan advisors.

• Industry: Financial services
• Product: Lending solutions, run on a financial core, a CRM and a contracts and digital signature application used by its loan advisors

‍

Context and challenges

For Tucafi, security can't be separated from operations. Its lending systems and its financial core are fully in production: any change to them has a direct impact on the business. That's why every security finding raises a second question that matters just as much as the first: how to fix it without disrupting what's working.

"The project really is fully in production, and making any change has an impact on operations. That's why we're very careful about making any change to that system."
Tucafi Team

In 2025, after evaluating three offensive security vendors, the team chose Strike. For the quality of the service and, above all, for the way of working: an approach close to that of a real attack, with an ethical stance that gave them the confidence to open up their most sensitive assets.

"You're among the most ethical, and among those who work just as if it were a real hack."
Tucafi Team

After validating its financial core, Tucafi decided to move on to its CRM, one of the company's most operationally intensive systems, while it moves forward in parallel with the migration of that core.

‍

Working with Strike

[01] An exercise wrapped up ahead of schedule

The first thing the Tucafi team highlighted was time. The CRM was fully assessed in a single cycle, and the exercise was closed much faster than with the model they had been working with before.

Part of that speed comes down to AI. In Strike's model, Continuous Hybrid Validation combines AI-powered Threat Emulation with an expert team that validates every finding before it reaches the client: AI accelerates coverage, and human judgment defines what is real and what matters.

"The artificial intelligence update helped a lot to speed up the processes."
Tucafi Team

The fact that Tucafi adopted this model without friction is no small detail: the company is also exploring its own artificial intelligence projects, and found in Strike a solution aligned with its technology agenda.

The result: More speed, without losing depth.

‍

[02] A hassle-free platform migration

Over the past year, Strike took a leap in its model: it moved from project-based security assessments to a Continuous Hybrid Validation platform. On it, AI agents and Strike's team of certified ethical hackers test every asset continuously, and every critical finding is validated before it reaches the client.

The platform brings together attack surface mapping, Threat Emulation (simulated attacks that replicate real-world techniques) and remediation prioritization and tracking.

For clients who were already working with Strike, like Tucafi, this change meant migrating to the new platform. For Tucafi, that step was quick. The team was able to log in shortly after confirming the continuity of the service, and found that most of the previous information had already been migrated.

They also highlighted that setting up and launching an assessment became simpler as well: less data required and a more intuitive experience than on the previous platform.

"The change was almost immediate and we were able to get in right away. It's much more practical, less data, it's more intuitive."
Tucafi Team

The result: Less friction to get started, more time for what matters.

‍

[03] Remediating without putting operations at risk

In the CRM exercise, Strike identified critical and high severity vulnerabilities. For Tucafi, finding them is only half the job. The other half is fixing them in a production system, where a change can affect business operations. That's why the team is moving forward with remediation gradually, prioritizing what gets fixed first.

To keep up with that pace, its program with Strike includes four retests per year. Each one allows them to confirm that the fixes already applied are working and to keep a close eye on what is still pending. They can also adjust the focus of each cycle (the prompt that guides the assessment) to steer it toward the risk or area that needs it most at that moment.

"I liked this exercise, I like the fact that there are four retests and that we can modify the prompt."
Tucafi Team

The same logic applies across its different systems. With a credit-based model, Tucafi decides which asset to assess at each stage: first it was its financial core, then the CRM, and now it's considering using the remaining credits on its infrastructure or on the contracts and digital signature application used by its advisors.

In Strike's model, this continuous validation and remediation approach delivers, on average, 44% less mean time to remediation.

The result: Orderly remediation, at the pace operations allow.

‍

[04] Support every step of the way

Switching platforms in the middle of an active security program could have been a point of friction. For Tucafi it wasn't, and much of that is explained by the support from the Strike team, one of the aspects they valued most. They highlighted the availability and close follow-up during the adoption of the new platform. This gave them a go-to person to move forward at every step, from first access to setting up the new assessments.

"We've had support, availability. Always hand in hand with her, moving forward."
Tucafi Team

That support doesn't end at kickoff. In Strike's model, the platform is only one part.

On one side, the Customer Success team, which supports each client day to day: platform adoption, planning of assessment cycles and follow-up on retests. On the other, the Hacking Team, the team of certified ethical hackers that oversees every assessment, validates critical findings and helps prioritize what to fix first.

For a company like Tucafi, which has to make fixes carefully on production systems, having that human backing is what allows it to move forward without improvising.

‍

Tucafi runs lending systems that are central to its business and sensitive to any disruption. With Strike's Continuous Hybrid Validation, it combined speed and continuity: it assessed its entire CRM in a single cycle and sustains remediation with four retests per year, prioritizing asset by asset without slowing down operations.

‍