Payments Company Protects the Infrastructure Behind Billions in Daily Transactions With Ollandi
A payments company carrying billions in daily transaction value uses Ollandi to identify attacks on its infrastructure before they reach payments, alongside its existing fraud engine.
Summary
A payments company whose platform carries billions in transaction value every day deployed Ollandi to detect the attacks that precede fraudulent payments. Account takeover and API abuse campaigns are now identified while the attacker is establishing access, and the fraud and security teams work from a single case.
Before Ollandi
- The fraud engine scored individual transactions but did not see the campaigns behind them.
- Credential stuffing, partner API abuse and misuse of support accounts were recorded in separate systems.
- Attacks reached the fraud engine only after the attacker had established access.
- Fraud and security teams reconciled separate alerts manually.
After Ollandi
- Weak signals across identity, API gateways, cloud and endpoints are correlated into one threat sequence per attack.
- Each payment path is followed from customer access through authorization, settlement and record.
- Cases touching customer accounts are shared with the fraud team so rules can be tightened before transactions are attempted.
- Containment actions, such as revoking sessions, rate-limiting API keys or forcing re-authentication, are recommended by Ollandi and approved by an operator.
- Each action is verified to have taken effect without disrupting legitimate payments.
Deployment
- Product: Ollandi, deployed alongside the existing fraud engine. Transaction decisions remain with the fraud engine.
- Coverage: identity, API gateways, cloud workloads, endpoints and payment channels.
- Operating control: Assisted Response.
By the numbers
Measured across Glemad's production deployments and published in the the earlier model research research paper:
- Mean time to detect: 0.8 minutes, against an industry average of 287 minutes.
- False positive rate: 1.2%, against an industry average of 23.5%.
These figures come from environments with mature telemetry and defined policy baselines. Results depend on the quality of the telemetry available.
