Case studies
What the engagements actually looked like
The trigger, the constraint, what was delivered and in what order. Anonymised by default, and without a number we have not confirmed.
How we write these
Cloudgap case studies describe the trigger that started the engagement, the constraint that shaped it, what was delivered and in what sequence. Client names appear only with written permission, and outcome metrics appear only where they were measured rather than estimated. Everything else is anonymised by sector.
Published
Written up in full
- Insight3 min
Supplier Assurance After a Breach
A supplier was breached and the board asked which other suppliers could do the same. The questionnaire programme could not answer, and the reason is structural.
- Insight3 min
Scoping the EU AI Act for a SaaS Platform
A UK software company with EU customers had to establish which parts of the AI Act reached it, and by when, before it could answer a procurement questionnaire.
- Insight2 min
Securing a Fintech Scale-Up
A London payments company needed certification inside six months to close a banking partnership, with no internal security team. What the engagement covered.
Sectors worked in
Six further engagements, pending verification
These are real engagements. Their write-ups carry specific outcome figures which are being confirmed as measured rather than estimated before they are published. The sector and the shape of the work are accurate now.
Global media
Cloud migration and Zero Trust architecture
Logistics and critical infrastructure
Rapid technical security audit
Payments and fintech
Certification programme, managed vCISO
Healthtech
AI governance framework and data residency
Education technology
Web and mobile penetration testing
Central government
Supply chain assurance at scale
[Client input required · Q9]
Per case study: confirmation that each stated outcome was measured rather than estimated, and that each attributed pull-quote is genuine and cleared for publication. Also Q3 - the fintech engagement is written up as ISO 27001 on one page and SOC 2 Type II on another.
Want to talk to someone who ran one of these? We will put you in touch with a reference where the client has agreed to it. Ask for a reference.
Start
Three ways in, depending on how close the deadline is.
- Book it
Book a discovery call
Thirty minutes, no deck. We work out whether there is a real engagement here, and say so if there is not.
- Go
Check the EU AI Act applies
Six questions, a dated list of the obligations that reach you, and a calendar file so the deadlines land somewhere you will see them again.
- Go
Request a roadmap
You know the obligation and the deadline. We scope the sprints, the deliverables and the dates.
Or just email a human: hello@cloudgap.ai
We reply within24 hours