Book a callBook a callA Conversation with Founder and CEO David Fry
How a fractional CISO helped Paays clear bank vendor security questionnaires and land a multi-year deal with a major Canadian bank.
For ambitious fintechs, landing a major bank or large enterprise customer is transformational. But most founders don't understand how much work goes into earning that trust before a contract is ever signed. In the case of Paays, working to win a Big 5 Canadian Bank as a customer for their identity verification platform, David describes it this way: "From an enterprise or bank perspective, the downside of partnering with the wrong vendor is significantly larger than the upside. A mistake can be extremely costly, financially, reputationally, and operationally." Because the stakes are so high, enterprises have a thorough vetting process, and it often starts with a 500-row Excel spreadsheet called a Vendor Security Questionnaire (VSQ), also known as a Vendor Security Assessment, a Third Party Risk Assessment, or a vendor due diligence questionnaire. The aim of the document is to understand a vendor’s security posture through a set of people, process and technology-based requirements. The process is owned by the enterprise's Third Party Risk Management (TPRM) team, also referred to as Procurement or Vendor Risk, and it is rigorous by design.
For a fintech founder without a deep security background, receiving a VSQ is like being handed a map written in a completely foreign language. You can see it contains the directions you need, but without someone to interpret it, you simply cannot move forward. "We were only 20 rows in and we were already overwhelmed," David recalls. Every enterprise's VSQ is also unique, shaped by their own risk history and the backgrounds of the people who built it, meaning there is no single template to prepare for. Popular compliance tools like Vanta and Drata don't solve this either; they automate tasks but don't define the strategy or translate the VSQ. The key challenge is how to deliver on the requirements of a major enterprise without exploding a limited startup budget. What David needed was a fractional Chief Information Security Officer (CISO).
After recognizing the gap, David was referred to Jeff Taylor at OTH Security. "I needed someone to lead the initiative and own the security process, and I needed to be confident that things were being handled properly," David explains.
The missing piece wasn't just having someone who had filled out a VSQ before. It was the deep expertise that only comes from working through many VSQs, across many different enterprises, over many years. No fintech could build that kind of experience on their own. That is exactly what Jeff and OTH Security bring to every engagement.
Jeff mapped VSQ requirements against established security frameworks, identified gaps, and developed a comprehensive end-to-end plan covering policies, processes, and vendor vetting. Crucially, Jeff didn't just work behind the scenes. He joined calls directly with the enterprise's TPRM team, combining technical fluency with business leadership on behalf of David's company, accelerating progress and significantly increasing the likelihood of closing.
Part of that work involved negotiating and right-sizing requirements that weren't appropriate for a company at Paays' stage. This is a place where many startups give up leverage they don't realize they have. A major bank is evaluating an outside vendor precisely because they aren’t in a position to build this capability in-house. That's the startup's seat at the table, and a good security leader knows how to hold it.
As a result, Paays landed a multi-year deal with a major Canadian bank. Paays has implemented their identity verification solution at auto dealerships where the bank provides financing, helping to reduce fraud losses from auto loans, saving money and headaches for dealerships as well as the bank. "We wouldn't have got it without Jeff," David says. "That's not an exaggeration."
In another engagement with a major global bank, Jeff brought the same energy and proactivity, navigating complexity that David's team could not have worked through alone and translating principles-based requirements into concrete, executable actions. Each engagement builds on the last, making every subsequent VSQ faster and more effective.
Thirty minutes with Jeff. No slide deck, no discovery-call script.