About ParentPay Group
ParentPay Group is an international technology supplier serving the education sector. Their platform bridges the gap between schools and parents, combining payment processing, communications, and management information into a single integrated solution used across thousands of schools.
With a broad and evolving product portfolio, ParentPay’s security testing needs are far from straightforward. Managing a high volume of diverse engagements, across both planned annual requirements and on demand requests, ParentPay needs an offensive security partner that is capable of going beyond a traditional pentest.
The Challenge: Managing Scale and Complex Testing Without the Overhead
As ParentPay’s product portfolio grew, so did the scope of their security testing programme. Annual requirements needed to be met consistently, while ad-hoc engagements had to be spun up quickly in response to product changes, new features, or board, auditor and client obligations.
Managing this across multiple vendors was unsustainable. It introduced fragmented reporting, inconsistent tester quality, and significant coordination overhead. Elliott Lewis, CISO at ParentPay, needed a partner that could handle volume and variety from a single, well-organised programme, without the administrative burden that typically comes with it.
Crucially, ParentPay also had an internal penetration tester and security coordinator who sat between business requirements and external test suppliers. OnSecurity’s platform enabled complete visibility across the testing schedule, while our expert human testers provided context to findings and remediation guidance, paired together to provider a thorough testing experience.
Why ParentPay Chose OnSecurity
Human-Led Testing at Scale
The foundation of ParentPay’s decision was the need for genuine manual testing across a complex estate. Elliott shared:
“I was looking for a company that used experienced human testers to understand and test business logic when penetration testing, and this is not workable with automation alone.”
Automated tools cannot interrogate business logic, understand context, or identify the kind of nuanced application-layer vulnerabilities that matter most in a sophisticated platform like ParentPay’s. After evaluating the market, OnSecurity’s CREST-accredited team gave Elliott the confidence that manual expertise would be applied consistently, at volume, without a drop in quality.
A Platform Built for Programme Management
With over 160+ engagements spanning several years, programme management is just as important to ParentPay as the quality of individual tests. The OnSecurity platform gave them the operational structure they needed, while significantly reducing the administrative overhead by 30% that had previously come with managing a testing programme of this scale.
“We immediately liked the experience of the platform, the interface and capabilities are significantly better than alternatives. It enables much easier scheduling and, crucially, provides real-time findings, which allows us to move much more quickly.”
Rather than exchanging documents and chasing updates by email, ParentPay’s security team manages the full lifecycle of every engagement through the platform. Scheduling, scoping, active findings, and completed reports are all accessible in one place. For a team running a high volume of tests across a varied programme, that level of visibility is essential, and the time saved on coordination adds up quickly across a programme of this size.
Streamlined Scheduling for Annual and On Demand Requirements
ParentPay’s testing programme is not limited to a single annual cycle. Annual requirements must be met reliably, but on demand Delta Assessments are regularly required to support product releases, acquisition activity, and partner obligations. The OnSecurity platform accommodates both, making it straightforward to schedule planned tests well in advance and to mobilise new engagements quickly when the need arises so that ParentPay is protected between tests throughout the year.
For teams managing a recurring security programme, the administrative overhead of repeat testing can quietly become one of the biggest drains on a security team’s time. Rescoping the same assets, recreating documentation, and chasing progress updates across email threads adds up. The OnSecurity platform removes that friction. The ability to reference previous engagements, reuse scope definitions, and track progress across the full programme in one place means ParentPay’s team spends less time on coordination and more time on security outcomes.
Whether a test is planned months in advance or needs to be mobilised quickly to meet a partner deadline, the platform handles the operational side without adding burden to the security team.
A Partnership Built on Trust
ParentPay’s internal security coordinator plays a central role in managing the relationship with OnSecurity’s testing team. Elliott noted that this relationship has become genuinely collaborative over time:
“Over the years, he has built a great relationship with OnSecurity’s testers. He trusts their work and really appreciates their support, even outside of the testing runs.”
For enterprise security teams, this continuity matters. Having expert testers who understand the platform, the context, and the team’s way of working reduces friction on every subsequent engagement, and further cuts down the time spent getting new testers up to speed.
The Result: A Security Programme That Scales
After more than 160+ pentests with OnSecurity, ParentPay’s confidence has only grown. Elliott summarised the overall experience:
“We’ve used OnSecurity for much of our testing for several years now. I rest assured knowing that they have very capable testers doing true manual testing, with the context of the application in mind. It’s critical that a human head is thinking about business logic and finding flaws that automated tools can’t. We’re extremely happy with the service that OnSecurity provides.”
And on the broader programme:
“Along with all of the above, we are just generally very impressed by the flexibility, transparency and speed of testing. The full process is streamlined and we really do consider OnSecurity’s team as a valued partner. They’re always happy to help where they can, and each engagement is a pleasure.”
At a Glance
- 160+ pentests completed since 2021
- Human-led testing and on-demand requirements managed through a single platform
- Significantly reduced administrative overhead by 30% across the full programme
- Real-time finding alerts enabling faster remediation and integration into Jira for streamlined ticketing
- Strong tester-team relationships built over multiple years
- Platform visibility across the full testing programme
- CREST-accredited manual testing applied consistently at scale
