Full Cybersecurity Program for Haiqu: Case Study

About Project

Haiqu builds a full-stack Agentic OS for quantum R&D teams, software that moves quantum applications through prototype and into production on real hardware. The platform runs on IBM, AWS, IonQ, and Rigetti backends and serves enterprise teams in finance, aerospace, automotive, and life sciences through a multi-tenant SaaS model. Enterprise buyers expect accredited, evidence-backed security before they sign, and for a deep-tech startup selling into enterprise procurement, that proof is a revenue dependency. To build it, Haiqu partnered with TechMagic to run security as one program, now in its second year.

Context and Challenge

Haiqu's platform executes customer workloads under a multi-tenant model, and that execution extends into customer-owned quantum and HPC environments. The immediate trigger was Microsoft's SSPA/DPR supplier program, which required formal attestation, while ISO 27001 and SOC 2 preparation were needed to satisfy the wider enterprise pipeline. Each of those frameworks carries its own documentation, controls, and evidence to produce. On the program side, Haiqu was starting with nothing in place: no ISMS, no dedicated security leadership, and none of the policies, risk processes, or vendor-management practices that certification depends on. The technical surface was equally demanding, covering the web application, APIs, and both external and internal network perimeters, each calling for a different testing approach. Findings could not simply be logged; they had to drive prioritized remediation and stand up to audits, mock assessments, and a formal retest cycle. Certification also had to stay valid long past issue day, which meant continuous monitoring, control health checks, and standing security leadership were part of the requirement from the start.

What Made This Engagement Different

Multi-tenant isolation is the product promise

Customers submit and manage quantum workloads through the SDK and cloud back-end. Cross-tenant access to data, jobs, or results would break the platform's core guarantee, so isolation had to be tested adversarially rather than assumed.

The platform reaches into customer environments

Execution happens inside customer-owned quantum and HPC infrastructure. The platform cannot be allowed to become a pivot point into those environments through its integration pathways.

Three frameworks, one small team

Running SSPA/DPR, ISO 27001, and SOC 2 in parallel would have consumed the engineering organization. Haiqu needed a partner to own the program, the calendar, the documents, and the audits, not just hand over a specification.

Talk to our security team

“At Haiqu, we move fast – but never at the expense of product or user security. That’s why having our security buddies at TechMagic is so valuable. They quickly became a reliable part of our team, helping us achieve ISO 27001 certification, prepare for SOC 2, run audits and penetration tests, harden our cloud, and share security incident stories that are much funnier when they happen to someone else.”

Yurii

Lead Engineer, Haiqu

TechMagic's Approach: Govern, Validate, Build Securely

TechMagic ran the engagement as one program with three reinforcing workstreams, expanding its role as the partnership matured.

vCISO: a security program with an owner

Acting as Haiqu's fractional CISO, TechMagic took ownership of the security program end to end: building the ISMS and its documentation, preparing the Statement of Applicability, running the risk assessment, standing up vendor management, drafting the Business Continuity Plan and awareness materials, running the internal audit, chairing the management review, and backing Haiqu through the external certification audit.

The order was deliberate. SSPA/DPR was the initial driver, and since Microsoft accepts a valid ISO 27001 certificate in place of DPR Section J on security, certification led the way, supported by focused privacy work on the data-handling requirements. Haiqu earned ISO 27001 certification roughly three months after kickoff, the accredited anchor every enterprise assurance conversation depends on.

The same operating model now carries SOC 2 forward: a TSC-aligned risk methodology, the documentation suite, readiness assessments and mock audits, and auditor coordination. Controls are implemented and evidenced, with the Type 2 observation window committed through the end of 2026.

CREST-accredited penetration testing: independent proof

Certification shows the program exists. Testing shows the platform holds. TechMagic designed a combined engagement to validate the risks that matter most for Haiqu's model, from both an external attacker's perspective (black-box) and an authenticated one (grey-box).

The focus areas were tenant isolation and access-control correctness (no cross-tenant access to data, jobs, or results, even under authenticated misuse), authorization across role boundaries (BOLA, IDOR, privilege escalation, unsafe admin access), API abuse controls (key scoping, leakage, rotation, rate limiting, replay resistance), business-logic abuse across job-lifecycle flows, and external and internal network assessment for segmentation and lateral-movement gaps.

Testing aligned to the OWASP Top 10 and OWASP API Security Top 10 and ran non-disruptively against a production-like environment. It produced a customer-ready evidence package: a report with severity-rated findings, reproduction steps, and realistic attack paths, a readout with engineering, a 60-day retest window for remediated findings, and an attestation letter Haiqu can hand to customers and auditors.

CREST-accredited penetration testing: independent proof

Secure SDLC: engineering the environment and keeping it clean

TechMagic migrated Haiqu's infrastructure to AWS, designing the architecture to best-practice standards with controls aligned to CIS Controls v3.0, then hardening toward full CIS compliance and audit-ready shape.

The real test came when AWS Inspector was switched on across Haiqu's multi-account environment, roughly ten accounts, running AI-powered detection at scale for the first time. Within hours, more than 300,000 findings surfaced. Volume was only half the problem: Inspector rates severity as if an attacker can already reach the vulnerable package, which is often wrong for hardened, isolated workloads, so taking the ratings at face value would have burned remediation capacity on noise.

A five-step triage method cut through it. Critical findings came first, narrowing 300,000-plus items to roughly 10,000. Prioritizing by account concentrated the effort: the two top accounts held around 3,000, and because container images were shared, fixing one set reduced findings everywhere. Root-cause analysis traced most to vulnerable base Docker images with OS- and package-level CVEs. Deploying Docker Hardened Images dropped the set to roughly 500 and left a hardened-image pipeline as standing practice. Finally, findings owned entirely by AWS under the Shared Responsibility Model were suppressed by rule, with client sign-off, leaving under 100 items needing genuine client-side action.

Secure SDLC: engineering the environment and keeping it clean

Vulnerability Findings

In under a week, the environment went from more than 300,000 raw findings to under 100 client-actionable items, meeting the vulnerability-management requirements for SOC 2. That critical-first, root-cause-driven approach is now part of how the environment runs, backed by quarterly vulnerability scanning.

Get in touch

300K+

initial findings

~10K

after critical-first filter

~3K

top two accounts

<100

final state

Key Outcomes

ISO/IEC 27001 certified in roughly three months

The accredited proof Haiqu's enterprise deals required. Microsoft's DPR also accepts this certificate in place of its own security section, so one certification cleared two requirements at once.

SOC 2 moving on the same foundations

The controls are implemented and evidenced, with the Type 2 observation window committed through year-end 2026, built on the program already in place.

Independent validation of the core promise

Tenant isolation, API-key handling, and job-lifecycle logic tested by a CREST-accredited team, with an attestation letter Haiqu shares with customers and auditors.

300,000+ findings cut to under 100 in a week

Whether pressure, false policy citations, or multi-turn escalation could force an unwarranted approval

A partnership that compounds

Year 2 continues the vCISO program, annual penetration testing, and quarterly vulnerability scanning, the same partner across strategy, testing, and engineering.

Business Impact for Haiqu

001

Haiqu's security program went from missing to marketable in under a year, clearing enterprise procurement instead of stalling on it.

002

The compliance stack was sequenced for reuse: ISO 27001 first, then SOC 2 built on the same controls, policies, and evidence.

003

TechMagic owned the program, the audits, and the finding triage, so Haiqu's engineers stayed on the product roadmap

004

The platform's core promise, safe multi-tenant execution, is now backed by accredited testing instead of self-assertion.

Why Choose TechMagic for a Full Cybersecurity Program

One team across compliance, testing, and engineering

TechMagic is a CREST-accredited security practice that combines compliance leadership, penetration testing, and DevSecOps engineering in a single team. The same partner that chaired the ISMS committee also tested tenant isolation and rebuilt the container pipeline.

The frameworks enterprise buyers ask for

TechMagic works to the standards that carry weight in procurement and audit: ISO/IEC 27001, SOC 2 TSC, Microsoft SSPA/DPR, CREST, PTES, and OWASP. Each one is applied in practice rather than cited for effect.

Proven across regulated, high-stakes platforms

TechMagic has delivered security work for SaaS, fintech, and healthcare platforms across Europe and North America, where accredited proof is a condition of doing business.

Get in touch