An Independent Mortgage Lender, Locked Out of Its Own Firewall

The situation walking in

On paper, IT was covered: one internal person and a platform administrator. In practice the environment had outgrown them. The firewall guarding the company's connection to the internet was years past support, its security subscription lapsed, and nobody could log into it. Every gap beyond that got its own vendor, until nobody held the whole. The bill arrived as audits: failed, repeatedly, with the fines budgeted in as a cost of doing business.

What we did

Core · Posture, provable

Replaced the abandoned firewall with supported equipment we can actually sign into. Then built the posture regulators ask about: rotating admin credentials with records to prove it, screening in front of everything, every computer watched around the clock, a cyber warranty behind it all.

System · The gaps, closed

Consolidated the vendor patchwork into one accountable partner. Then built the tools the lending platform did not ship with: one screen that shows the pipeline the way the branches actually run it, and the pieces around the platform that had been living in spreadsheets, connected to the systems that already held the data. The platform stayed theirs. The work between it and everything else became ours.

Logic · Audits, boring

Made compliance automatic instead of heroic. Credential rotations, expirations, and audit answers run on a schedule and land on our desk, not on a loan officer's sticky note. The annual questionnaires get answered by the people who built the posture.

Intellect · In confidence

Actively advising on where AI belongs in the operation: use cases, policy, and the guardrails a regulated lender needs. The specifics stay under confidential agreements; the seat at that table is the point.

Month one, as it ran

D+1 · The walkthrough. Headquarters, the branches, and every login in between. The abandoned firewall surfaced on day one, and the notes from that walkthrough became the working document.

D+9 · The verdicts. Every line of the inventory got one of four verdicts: keep, fix, kill, defer. The firewall led the fix list. The vendor patchwork led the kill list. Nobody argued with either.

D+14 · The map. One page. What connects to what, who owns it, what it costs, what happens if it fails. The first time anyone had seen the whole operation at once.

D+30 · The seat. The plan moved to a standing rhythm: leadership touchpoints on the calendar, the compliance calendar owned, and exactly one place every problem goes.

Asked at the start

"We keep failing audits. Can you actually fix that?"
Not with a promise, with a method. Build the environment so what auditors ask for is what already happens automatically, every day, with records. You don't prepare for audits; you operate so audits are boring. The fines stopped.

"Do you actually know this industry?"
The right question. Mortgage lending isn't a place for a provider to learn on the job. The agency connections, the credential rotations, the audit cycles, the platform the whole business runs on: you have to already speak the language. We staffed like it.

"Our platform runs the whole business. Are you going to make us replace it?"
No. The platform was never the problem; the work around it was. We built the tools it did not ship with and connected them to the systems already holding the data, so the platform kept doing its job and the re-typing around it stopped. Their vendor relationship stayed theirs.

"What happens to the people we have?"
They had people who cared and were outmatched by the size of the problem, not the effort it deserved. We walked in and took the weight. The goal was never to assign blame for the past, just to make it stop repeating.