At a glance
In ten working days, Biz Secure Online took an AI-built HR and safety platform from “it works on our screens” to a working platform with fixes landing throughout the engagement, and a clear, prioritised list of the remaining issues to fix before its first customer release. We brought our own testing method, security scanning and reporting, so the founders did not have to hire or manage a testing team.
- Client: Workplace Automate, an HR and safety platform for construction businesses
- Engagement: functional, exploratory and application security testing, plus daily vulnerability scanning of the live website
- Result: fixes landed during the engagement, a clear path to the first customer release, and an A+ client review
The client and the challenge
Workplace Automate helps businesses run HR and payroll, with a suite of template documents for industrial relations, in one place. Like any HR and safety platform, it looks after sensitive information, and different people in a business need to see different parts of it.
The product was built over several months, leveraging AI development tools. Before selling it, the founders wanted independent answers to three questions: does every workflow work for every kind of user, does each user see only what they should, and is the website secure?
The founder’s problem
AI development tools have changed how fast a founder can build software. They have not changed the software quality requirements for a commercial solution handling sensitive personally identifiable information (PII). Business customers expect a product’s features to work out of the box, every time, and to make their work quicker and easier to do.
Most early-stage SaaS companies have no testing function, because traditional consultancy companies can be expensive and often require long contracts that make buyers pay for more services than they need. Consequently, founders test their own product, usually as the administrator, along the paths they designed. This can miss priority issues that customers will see first:
- The other roles. A workflow that works for the administrator can behave differently for everyone else.
- The hand-offs. When one person submits, another approves and a third acts, every hand-off is a place for something to go wrong.
- The view from outside. Founders rarely see their product the way a true customer would.
Our approach: a turnkey testing service
We brought everything the project needed. The founders gave us access to the product and its user documentation guides. We supplied the software testing methods and expertise, the tools, the reporting and the customer care.
A commercial testing method, not ad hoc clicking. Our founders have decades delivering commercial software testing, and we use the methodologies professional testing consultancies use for large clients. We turned 70 pages of user guides into 111 test cases, ranked by business risk. Alongside them, experienced testers explored the product on desktop and real phones to verify visual design and feature functionality.
Our own security scanning, from day one. Our website vulnerability scanner checked the live website every day, the way an outsider would, and turned each result into a score out of 100 with plain-English fixes.
Reporting that keeps founders in control. Progress went to the client’s own Teams channel every day. Every issue came with steps to reproduce, a screenshot and a severity rating, and we retested fixes as they arrived.
What we found
We found and documented 75 issues, each ranked so the founder knew what to fix first. Our value to the founder was in the test case execution for workflows across multi-page and multi-role start and finish points. These were complex tests that required an understanding of how systems will record and use information stored in the database across user roles, with restrictions on what each role can see. This significantly improved the user experience over the testing period.
Much of the product was already in good shape. The core forms, records and documents worked as designed, the product held up well on a real phone, and customer accounts stayed separate from one another in every test. We were able to provide solid feedback for improvements to page layouts and screen designs.
Why testing and scanning belong together. Some issues only appear when a real person logs in and works through a process. A security scan looks at a website from the outside, so it cannot see them. That is why we run both, and why this engagement found things neither would have found alone.
Your findings stay yours. We share the shape of what we found, never the details. Every finding was reported privately to the client, and the specifics stay between us and them.
The outcome
Our conclusion: over the 10 days of the testing engagement, fixes landed as we found issues, and the platform was brought much closer to a commercial production state. We finished with the remaining issues documented and ranked, and the founder planned to fix them before launch, so they could onboard their first subscriber customers with confidence. We had built up a body of test documentation and experience with their solution, so that ongoing testing project work could be done in much smaller time allocations, helping them keep costs as low as possible leading up to launch.
What the client received:
- 111 documented test cases to reuse for every future release
- 75 issues ranked by severity, each with steps to reproduce and screenshots
- Daily security scores with plain-English fixes
- A release recommendation, with every asset in one shared folder
The plan we left them with:
- Fix the remaining highest-priority issues before launch, then work through the security scan recommendations.
- Run a short set of release checks on the critical workflows at every update, and automate them over time.
- Put the product in front of friendly customers for acceptance testing, and turn their feedback into the next round of improvements.
The client’s verdict
“As a new founder coming from a workplace relations background rather than a technical one, building Workplace Automate meant taking on a large and complex system in a space where I was still very much learning. Having Andrew come on board for testing and security review gave me real confidence at a point where I needed it most. … I came away not only with a more secure and robust platform but also with a much better understanding of where things stood and what mattered.”
Emilie Ryan
Managing Director, Workplace Automate Pty Ltd · Rated the engagement A+
What happened next
After the engagement, Workplace Automate chose Biz Secure Online to manage and secure its Microsoft 365, as our first managed services client. The same team that tested the product now looks after the IT office suite operations it runs on.
What this means for founders
A product that passes a security scan can still have serious issues, and a product that works for its founder can still fail for its customers. Security scanning sees your product from the outside. Software testing sees it from the inside. You need both before you sell.
Is this for you?
- You built your product quickly, perhaps with AI tools, and want an independent check before you sell it.
- Your product handles money, personal information or your customers’ compliance.
- You have a launch, a major customer or an investor demonstration coming up.