Built for FinTech Speed, Slowed by Security Backlog
Wayflyer is the Dublin-based fintech reshaping how fast-growing small businesses access the working capital they need to grow. Through revenue-based financing and data-driven underwriting, analyzing real-time sales, marketing, and bank-feed data to deliver funding in as little as 24 hours, and deploying billions to fast-growing brands worldwide. It’s a business where trust, speed, and the secure handling of sensitive financial data are inseparable from the product itself.
Before adopting Orca, the team managed findings through GitHub Advanced Security, with code-level issues assessed by CodeQL scans slow enough to greatly reduce delivery speed. The result was a persistent, fluctuating backlog of open findings. The result was a high volume of open findings that each required significant manual reasoning to assess correctly: Was this dependency actually used? Did the issue reach production? Would the fix break CI? For a complex finding, that investigation could stretch to a full day. Without a repeatable way to apply that context at scale, working through SAST findings systematically was, in the team’s words, ‘almost a full-time job in itself.’
Choosing Orca: Unified Platform Instead of Duplicated Findings
After an extensive proof of concept, the team moved to the Orca Cloud Security Platform. Several capabilities stood out during evaluation: granular policy control, simple ignore and snooze workflows, and, critically, CI diff scans that dropped from roughly 15 minutes to under a minute. Just as important was consolidation. Instead of reconciling duplicated findings across GitHub Advanced Security, Vanta, and other sources, Orca gave the team a single place for both CSPM and shift-left security.
Embedding AI into Wayflyer’s security workflow was a deliberate goal and one their previous tooling couldn’t support. Orca’s MCP made it achievable: the team built a workflow in which a Claude agent analyses each finding and proposes fixes, with every change planned and approved by an engineer before any code is touched. Because remediation followed the same repeatable pattern every time, it made sense to formalize it as a reusable Claude skill: a playbook, or recipe, for fixing issues at scale.
A Remediation Workflow Built for Trust
The team designed the workflow to behave like a disciplined engineer rather than a black box. At its core is Claude, grounded by a custom knowledge base built from OWASP cheat sheets, the OWASP Web Security Testing Guide, and other authoritative sources scraped into searchable Markdown. A single command kicks it off. The agent first reads and reasons about the entire codebase, validates each finding against the knowledge base, then devises a plan with a separate pull request for each security category and type (SAST-XSS, SAST-SQLI, SCA-Python-Packages, and so on). That plan goes to a human for review and approval before a single line of code is touched.
The knowledge base is the primary safeguard against hallucination. Rather than relying on the model’s training alone, the agent looks up how each risk is actually exploited and what accepted fixes look like. Crucially, it can also use repo context to spot when an upstream function already mitigates the issue which is the exact nuance a regex-based SAST scanner routinely misses. The per-category PR structure keeps every change reviewable. As the team put it: “Rather than producing a mega PR that’s meant to fix everything … it follows better dev practices too.” The plan-and-approval step lets a human validate what is being fixed and how, catching subtle but costly mistakes. “It’s saved my skin a few times,” the team notes.
From a Six-Month Backlog to Zero
The impact was immediate and measurable. In a single 30-day window, the reviewed-and-approved workflow (every change planned by the agent and signed off by an engineer before any code was touched) cleared the SAST backlog, the same context-heavy class of findings that, without a systematic approach, each require deep manual reasoning to assess and prioritize correctly. By the team’s own estimate, clearing that volume manually could have taken six months or more, particularly for smaller teams, all while stalling their ability to ship new tooling and functionality.
Instead, the backlog dropped to zero.
“The backlog dropped to 0, and now we’re able to manage it and really hit meaningful SLAs as a business.” — Andrew Orr Ewing, Senior DevSecOps Engineer, Wayflyer
That shift, from manual one-at-a-time triage to a managed process with real service-level targets, changed what the security function could even attempt next.
A Force Multiplier for a Lean Security Team
Perhaps the most telling part of the story is who is running this workflow. The operator works in security and can code, but isn’t a full-time engineer fluent in Python, Java, TypeScript, Bash, CDK, and Terraform all at once. The AI bridges those language gaps, adding domain and repo-level knowledge, letting a single security-minded generalist operate with the breadth of a far larger engineering team.
With the backlog under control, that capacity has been redirected to higher-value work: malware scanning to counter the relentless wave of supply-chain attacks, including incidents like Shai-Hulud monitored by the company’s supply-chain risk function, along with threat modeling, team networking, and proactive, project-oriented security.
What’s Next
The team plans to keep refining the approach: fine-tuning the agent, expanding the knowledge base, and extending remediation beyond SAST toward more CSPM issues through code-to-cloud mapping.
Asked whether the combination of Orca and an MCP-driven AI workflow was worth it, the answer doubles as advice to any lean security team drowning in findings:
“It’s been a value add for the business — identifying and addressing a class of issues that a lean team would otherwise struggle to work through at scale.” — Andrew Orr Ewing, Senior DevSecOps Engineer, Wayflyer
Chat with an Orca Expert