Federal & State Government
How Branch Uses Ares to Continuously Secure Its Workforce Payments Infrastructure
How Branch Uses Ares to Continuously Secure Its Workforce Payments Infrastructure
How Branch Uses Ares to Continuously Secure Its Workforce Payments Infrastructure
Ares continuously validates the public portals, agency applications, APIs, identity systems, payment flows, and mobile apps that federal and state missions now depend on before adversaries can exploit them. Ares also provides attack surface management and discovers Shadow AI running in your environment, with authorized testing of supported AI services and applicable MITRE ATLAS coverage.
Ares continuously validates the public portals, agency applications, APIs, identity systems, payment flows, and mobile apps that federal and state missions now depend on before adversaries can exploit them. Ares also provides attack surface management and discovers Shadow AI running in your environment, with authorized testing of supported AI services and applicable MITRE ATLAS coverage.
Branch’s infrastructure handles real-time wage disbursements, cashless tip payouts, and Mastercard-issued debit card transactions for hundreds of thousands of workers daily. Every API endpoint, every mobile session, and every white-label integration represents a potential entry point for adversaries targeting financial data.
Like most enterprises in regulated industries, Branch relied on annual penetration testing engagements—typically a two-to-three-week assessment conducted by an external consultancy once per year. But the pace of Branch’s product development had outstripped the testing cadence. New API endpoints, mobile app releases, and partner integrations were shipping continuously, while security validation happened on a static, annual schedule.
Jeff Buelt, VP of Security at Branch, identified three critical gaps:
Limited testing frequency that left new code unvalidated for months between annual assessments
Narrow scope that couldn’t keep pace with their growing integration footprint across new partners, enterprise white-labels, and new API surfaces
Slow remediation validation that created uncertainty about whether fixes actually closed the exposure—often waiting until the next annual cycle to confirm
Compliance pressure from PCI DSS requirements and financial partner audits demanding evidence of ongoing security validation—not just a single point-in-time report
After working with Assail to scope a proof of concept, Branch deployed Ares to deliver autonomous, continuous offensive security testing across its highest-risk assets. Ares operates as a multi-agent autonomous red team — coordinating specialized agents purpose-built for API testing, web application exploitation, and mobile client analysis, with a dedicated validation layer that confirms every finding is a real, exploitable issue before it ever reaches a human analyst. Ares chains vulnerabilities into complete kill chains the way a skilled human adversary would, and proves exploitability end-to-end rather than surfacing unverified findings for the security team to triage.
Branch directed Ares at its external attack surface — including the public APIs powering instant payments, earned wage access, and white-label partner integrations — and the Branch mobile application. Ares runs continuously against both production and staging environments, allowing the security team to validate new code, new endpoints, and new partner integrations as Branch's footprint expands. This continuous model complements Branch's existing annual third-party penetration testing engagement, providing offensive validation that moves in lockstep with engineering velocity and contributing evidence to support ongoing PCI DSS and financial partner security reviews.
During the initial deployment, Ares autonomously discovered a critical-severity vulnerability in Branch’s application within three minutes of engagement—a finding that the company’s previous third-party consultancy had failed to identify across multiple annual assessment cycles.
“What sold us was seeing Ares surface a critical vulnerability in three minutes that our annual consultancy couldn’t find in three weeks. That’s not an incremental improvement—that’s a fundamentally different capability.” — Jacob Ronald, Director of Security, Branch
Beyond the initial discovery, Branch now runs Ares continuously against its production and staging environments, enabling the security team to:
Validate remediations in real time rather than waiting months for the next annual pentest to confirm fixes closed the exposure
Test new API endpoints as they ship, keeping security validation in lockstep with development velocity
Maintain continuous offensive pressure across an attack surface that grows with every new enterprise integration and partner deployment
Strengthen compliance posture with continuous evidence of offensive testing for PCI DSS audits and financial partner security reviews
Branch’s infrastructure handles real-time wage disbursements, cashless tip payouts, and Mastercard-issued debit card transactions for hundreds of thousands of workers daily. Every API endpoint, every mobile session, and every white-label integration represents a potential entry point for adversaries targeting financial data.
Like most enterprises in regulated industries, Branch relied on annual penetration testing engagements—typically a two-to-three-week assessment conducted by an external consultancy once per year. But the pace of Branch’s product development had outstripped the testing cadence. New API endpoints, mobile app releases, and partner integrations were shipping continuously, while security validation happened on a static, annual schedule.
Jeff Buelt, VP of Security at Branch, identified three critical gaps:
Limited testing frequency that left new code unvalidated for months between annual assessments
Narrow scope that couldn’t keep pace with their growing integration footprint across new partners, enterprise white-labels, and new API surfaces
Slow remediation validation that created uncertainty about whether fixes actually closed the exposure—often waiting until the next annual cycle to confirm
Compliance pressure from PCI DSS requirements and financial partner audits demanding evidence of ongoing security validation—not just a single point-in-time report
After working with Assail to scope a proof of concept, Branch deployed Ares to deliver autonomous, continuous offensive security testing across its highest-risk assets. Ares operates as a multi-agent autonomous red team — coordinating specialized agents purpose-built for API testing, web application exploitation, and mobile client analysis, with a dedicated validation layer that confirms every finding is a real, exploitable issue before it ever reaches a human analyst. Ares chains vulnerabilities into complete kill chains the way a skilled human adversary would, and proves exploitability end-to-end rather than surfacing unverified findings for the security team to triage.
Branch directed Ares at its external attack surface — including the public APIs powering instant payments, earned wage access, and white-label partner integrations — and the Branch mobile application. Ares runs continuously against both production and staging environments, allowing the security team to validate new code, new endpoints, and new partner integrations as Branch's footprint expands. This continuous model complements Branch's existing annual third-party penetration testing engagement, providing offensive validation that moves in lockstep with engineering velocity and contributing evidence to support ongoing PCI DSS and financial partner security reviews.
During the initial deployment, Ares autonomously discovered a critical-severity vulnerability in Branch’s application within three minutes of engagement—a finding that the company’s previous third-party consultancy had failed to identify across multiple annual assessment cycles.
“What sold us was seeing Ares surface a critical vulnerability in three minutes that our annual consultancy couldn’t find in three weeks. That’s not an incremental improvement—that’s a fundamentally different capability.” — Jacob Ronald, Director of Security, Branch
Beyond the initial discovery, Branch now runs Ares continuously against its production and staging environments, enabling the security team to:
Validate remediations in real time rather than waiting months for the next annual pentest to confirm fixes closed the exposure
Test new API endpoints as they ship, keeping security validation in lockstep with development velocity
Maintain continuous offensive pressure across an attack surface that grows with every new enterprise integration and partner deployment
Strengthen compliance posture with continuous evidence of offensive testing for PCI DSS audits and financial partner security reviews
TALK TO ASSAIL
What would the evidence look like for you?
Talk with Assail about your attack surface, priorities, and assessment goals.
Your environment. Your objectives. A mission built around both.