VeUP
← All case studies
Security Foundations · GRC SaaS Security
A multi-tenant GRC SaaS providerIdentity protected

A GRC SaaS closes 55 prioritized risks with a hub-and-spoke move on AWS

Well-Architected ReviewAdvisoryHigh-risk-issue remediation roadmapBlast-radius & tenancy isolation reviewResilience-gap assessment (RTO/RPO)Observability-gap assessmentCost-optimization deep diveManaged billing & resellCommitment & RI optimizationStanding cost-optimization mechanismRightsizing & instance-family modernizationLog & telemetry cost tuningPer-service spend attribution
55
prioritized risks, each paired with a concrete fix
~$600/mo
avoidable IPv4 cost with a clear elimination path
One move
hub-and-spoke closes attack surface and cost together
Amazon EKSAmazon RDSAWS OrganizationsWell-Architected Tool

Shared anonymously — the customer’s name is held by VeUP and available on request.

A security-first SaaS provider asked the hard question of its own platform: how much risk had organic growth quietly accumulated? VeUP ran a six-pillar AWS Well-Architected Review across ~60 customer environments on Amazon EKS and RDS — and came back with 55 prioritized risks, a ~$600/month cost leak, and a five-move remediation roadmap toward a multi-account, hub-and-spoke target state.

The challenge

The platform had grown the way successful platforms do — one customer environment at a time, ~60 of them, all inside a single AWS account. That meant one compromise could reach every customer. The root account had no MFA. Every EC2 instance carried a public IP, with no NAT Gateways — a wider attack surface and an avoidable IPv4 bill. Observability stopped at Route 53 health checks and manual error review; recovery meant nightly snapshots restored customer by customer, by hand, with a 24-hour RPO; OS patching was manual just as AWS Inspector Classic headed for retirement.

For a company that sells governance, risk, and compliance software, the ask was fitting: an objective, prioritized read of its own risk — across security, resilience, cost, and operations.

The solution

VeUP ran the full Well-Architected Review — all six pillars, stakeholder interviews paired with hands-on scoring — and turned the findings into a roadmap ranked by what would hurt most if left alone. Five moves lead it:

  • Hardware MFA on root, then multi-account isolation via AWS Organizations
  • Hub-and-spoke network; instances into private subnets behind central NAT egress
  • CloudWatch metric filters and one fleet-wide dashboard
  • Automated restoration plus cross-region snapshot copies
  • Patch Manager automation before Inspector Classic retires

The review also gave credit where it was due: a CI/CD pipeline with dry-run security checks, broad Multi-AZ coverage, and managed Amazon EKS and RDS were strengths worth building on, not rebuilding.

Architecture

Target-state AWS architecture: an AWS Organizations multi-account hub-and-spoke design with a hardware-MFA root account, centralized NAT Gateway egress from a network account, and spoke accounts isolating each customer environment behind private subnets running Amazon EKS and Amazon RDS Multi-AZ.
The target state the review points to — multi-account hub-and-spoke, every customer environment isolated in its own spoke, private-subnet EKS and RDS, one controlled way out to the internet.
Previous-state architecture: a single AWS account holding ~60 customer environments with public-IP EC2 instances, no NAT Gateways, and manual snapshot-based recovery.
Where the platform started — one shared account, ~60 customer environments, public-IP instances, manual operations.

What the review surfaced, pillar by pillar:

Security
  • Hardware MFA on root; AWS Organizations isolation
  • Private subnets only — no public instance IPs
  • Federated IAM, no shared credentials
Reliability
  • Cross-region snapshot copies with automated restore
  • RDS Multi-AZ retained as an existing strength
  • CI/CD dry-run checks gate the remediation sequence
Operational Excellence
  • CloudWatch metric filters and a fleet-wide dashboard
  • Top-5 roadmap run as a sequenced runbook
  • Patch Manager automation

Production outcomes

KPIResult
Review outcomesAll six pillars assessed and risk-rated. 55 prioritized risks — 39 High, 16 Medium — each paired with a concrete fix. Security, Reliability, Cost, Operations, and Performance came back High-risk; Sustainability Medium. A ~$600/month avoidable IPv4 cost surfaced with a clear elimination path, and the Top-5 roadmap ranks every move by business impact against effort.
TimelineA focused review in February 2026, executive summary in the customer’s hands the same day. Remediation is now the customer’s forward roadmap.
Cost postureThe Cost Optimization pillar found ~$600/month of avoidable IPv4 spend — every EC2 instance public-IP’d, no NAT Gateways — and the hub-and-spoke redesign eliminates it while shrinking the attack surface in the same move.
Lessons & continuationSingle-account multi-tenancy is the dominant structural risk for an organically-grown GRC SaaS — multi-account isolation and Root MFA lead the roadmap; a hub-and-spoke / NAT Gateway egress redesign closes attack surface and removes IPv4 cost in one move; sequence remediation by business impact and effort so a security-first customer can act immediately.
AWS services in production
AWS Well-Architected ToolAmazon EKSAmazon RDSAmazon EC2Amazon VPCNAT GatewayAWS OrganizationsAmazon CloudWatchAWS Systems ManagerAmazon Route 53AWS IAM