How a global payments firm cut Linux audit prep from weeks to a single export
An anonymised European financial services firm facing a DORA compliance deadline with no Linux identity inventory. 412 servers. Complete privilege map delivered.
Client Overview
Financial Services — Global Payments Processing (anonymised)
2,000–5,000 employees, processing €50B+ annually
An anonymised European financial services firm operating cross-border payment infrastructure across multiple jurisdictions, subject to DORA and NIS2.
This customer is anonymised at their request. Every figure, finding and quotation below is reported unchanged from the engagement.
Engagement
Design partner deployment, Q4 2025 — 412 Linux servers across 3 data centres and hybrid cloud environments. Reported anonymised at the customer's request.
Compliance Frameworks in Scope
The Challenge
Imminent DORA compliance audit with no existing Linux identity inventory. Legacy estate of 412 Linux servers with no continuous privilege monitoring. Service accounts proliferated without ownership assignment over 6+ years of growth.
What We Found
Risk-scored findings prioritised by exploitability and compliance impact.
Orphaned Accounts with Active Sudo Rules
247 user accounts belonging to former employees retained active sudo configurations, including 12 with unrestricted root access via NOPASSWD.
247
instances identified
Critical Sudo Escape Vectors
4 environments contained sudo rules granting shell-escape-capable commands (vi, less, find) without password restriction, enabling trivial privilege escalation.
4
instances identified
SSH Keys Exceeding NIST Rotation Thresholds
68% of SSH keys had not been rotated within the NIST SP 800-57 recommended period. 31 keys were shared across multiple service accounts.
31
instances identified
Unowned Non-Human Identities
183 service accounts had no designated owner in any identity governance system, representing a complete blind spot for access review processes.
183
instances identified
Interactive Shell Access on Service Accounts
Service accounts on 38% of servers retained /bin/bash as their login shell, enabling interactive login when credentials were compromised.
Outcomes
DORA compliance evidence delivered
Complete ICT risk management evidence pack covering all 412 servers, mapped to DORA Articles 8, 9, 10 and 28 — submitted to supervisory authority before the compliance deadline.
3 critical remediations before audit date
All 247 orphaned accounts disabled and sudo rules revoked within 10 days. Shell-escape vectors eliminated across all 4 environments. Critical findings resolved before regulatory review.
Privileged access model rebuilt
Service account ownership assigned for all 183 unowned identities. SSH key rotation programme established. Least-privilege sudo policy deployed across core payment infrastructure.
SOC 2 Type II evidence package
Audit output repurposed as SOC 2 logical access evidence, eliminating the need for a separate assessment and reducing audit preparation time by an estimated 3 weeks.
Further reading
The same audit produces the evidence other frameworks ask for: the SOX evidence produced from the same audit, and the PCI DSS access evidence from the same audit.