About Noveva Software Group
Noveva Software Group brings together a family of technology businesses serving the NHS, local authority social care teams and the voluntary sector across the UK. The businesses themselves are long established, with more than 20 years of delivery into UK health and social care between them, but they have operated under a single Noveva brand only since early 2025.
Backed by Tern Capital, the group has grown through an active acquisition strategy and now supports NHS trusts and health boards in England, Wales and Scotland, over 100 local authorities, and more than 1,000 charities and voluntary organisations. It comprises CCube, cloud-based electronic document and records management for NHS organisations; SchoolScreener®, which digitises delivery of the 0-19 Healthy Child Programme including vision and hearing screening, the National Child Measurement Programme, immunisations and health needs assessments; Mind Of My Own, co-produced apps that help children and young people communicate their views, wishes and feelings to the professionals working with them; and Charitylog, case management and reporting for the voluntary sector.
Noveva operates an ISO 27001 and ISO 27701-aligned ISMS across the group, and bringing each newly acquired business up to that single standard is now a defined part of onboarding.
Challenge: Bringing Security Testing Together Across a Growing Group
Each business in the group arrived with its own established testing arrangements, shaped by the tender requirements, procurement frameworks and contractual obligations of its own market. As Noveva brought new businesses into the group, holding each of them to a single group standard became a defined part of onboarding and that meant consolidating security testing onto one consistent footing rather than four separate ones.
Mike King, Head of Product Development at Noveva, explained that choosing a single testing partner took longer than expected, because the team wanted more than a one-off compliance exercise.
“We wanted a partnership we could use every year, one that understands our products and understands the new ones as we bring them on.”
Mike King, Head of Product Development, Noveva Software Group
That approach was put into practice when CharityLog, one of the group’s more recent additions, was brought into scope and successfully tested alongside the rest of the portfolio.
Why Noveva Chose OnSecurity
1. A genuine partnership, not a one-off transaction
Having spoken with several providers, Mike was looking for ongoing engagement rather than a single annual delivery. OnSecurity’s approach of understanding the products being tested, including new businesses as they are acquired, stood out.
“It’s a joint approach. It’s not just choosing someone to run a pentest, it’s understanding the product, talking about the product, and then testing it properly.” – Mike King
2. Automatic ticketing that fits developer workflows
“The whole structure of how the platform works was one of the main things that stood out. Raising tickets automatically sounds basic, but developers already have enough systems to be working on. They don’t need more, and it raises Jira tickets automatically for us and saves us hours of manual work.” – Mike King
3. A rolling model of assurance, not a one-time sign-off
OnSecurity’s block-of-hours model, allowing testing to be used flexibly across the year rather than as a single fixed engagement, matched how Noveva wanted to work.
“It isn’t just a sign-off of the system today, think of it like an MOT. Passing your MOT confirms your car is roadworthy on that day, but the certificate doesn’t mean the car stays that way. A part can fail the next morning but the MOT just isn’t retested until next year. It’s the same with a pentest, the report confirms your system was secure at that point in time, but new vulnerabilities can appear the moment something changes. That’s why a single annual pentest leaves you blind for months at a time. Using OnSecurity’s block-of-hours model means we’re testing throughout the year, rather than getting one snapshot and hoping nothing changes in between.” – Mike King
4. One platform for a multi-business group
With responsibility spanning several business units, Mike found real value in managing all of Noveva’s testing from a single platform, rather than juggling separate providers and processes for each business.
“It’s just so much easier managing several test engagements across different businesses. I can let the team get on with it and go into one platform to see the results. Anything sensitive stays in OnSecurity, and if it needs to be shared, it’s shared from there. Which is incredibly important for sensitive information.” – Mike King
Solution: A Single Platform Across the Group
Testing across Noveva’s businesses, spanning document management for health records, school screening services, the group’s child-voice platform, and CharityLog’s administrative platform, is now managed through OnSecurity’s platform. Findings are raised automatically into the team’s existing Jira workflow, and results are kept securely within the platform rather than circulated by email.
Members of the CharityLog team found the depth of testing was matched by how straightforward it was to manage, a marked change from previous years.
“The depth of this engagement was significant, but it was still straightforward to manage. Each issue came with clear evidence and reproduction steps, so we could move straight to remediation.” – Nye Price, Development Manager, Noveva Software Group
Alper Selvi, Software Developer at Noveva, pointed to how quickly the team was able to act on what came back.
“The test identified issues that mattered, and the clear reporting and automatic ticket generation meant the team could move to remediation quickly. The retest gave us prompt confirmation the fixes had landed.” – Alper Selvi, Software Developer, Noveva Software Group
Ed Perkins, Software Developer at Noveva, had used OnSecurity independently before joining the group, and found the platform just as valuable from the inside.
“The platform was great, really easy to go back in and check details. With automated ticket creation, it lets us focus on the technical decision-making of how we’re going to fix things rather than tracking issues ourselves. The free retest came back quickly too, so the whole process was low friction.”
Ed Perkins, Software Developer, Noveva Software Group
Impact: A Consistent, Time-Saving Approach Across the Group
✓ A single platform for managing testing across multiple business units
✓ Automatic Jira ticket creation, reducing manual admin for developers by days
✓ Sensitive pentest data kept securely within the platform, shared only when needed
✓ Deeper, more actionable findings than previous testing providers
✓ Free retesting, reducing time and cost spent confirming fixes
✓ A flexible, rolling model of assurance that scales as new businesses join the group
Asked to quantify the impact, Mike pointed to the time saved by having one consistent process across the group.
“It’s days and weeks that add up over a year. With multiple products and teams to support, that makes a significant difference for us.” – Mike King
Would Noveva Recommend OnSecurity?
Mike noted that security testing represents a meaningful investment, and was candid that it requires real trust in a provider’s thoroughness.
“It’s a significant investment, so you have to put a lot of trust in the people doing it. A test that comes back light can give you a false sense of security. We wanted a partner who would dig in and tell us plainly what they found, and that’s what we’ve had.” – Mike King
For Nye, the value showed in how the group standard translated into practice.
“Bringing Charitylog up to the group standard meant a broader scope than we’d worked to before. Running it through the same platform as the rest of the group made that straightforward.” – Nye Price
From onboarding newly acquired businesses to running consistent annual testing across the group, Noveva’s experience with OnSecurity has centred on one thing: a partnership that grows alongside them.
Start your security partnership with OnSecurity today. Get an instant quote today.
