Reflectiz

““I said it would be really useful to have all of the pages in one report, so I could see that aggregate. Within a few weeks, it was added.””

““Our QSA was very familiar with Reflectiz already. He said it was a good tool, he knew other companies were using it, and he knew it did what was needed. He was happy to see we were capturing evidence of the approvals, he liked the dashboard, and he was comfortable with how we were tracking behaviours.””

““Once I provided that list, it was pain-free. It was as simple as sharing a table of our information. It was all just taken away and done for me. Hassle-free. It was actually quicker than I needed it to be.””

““That smart approval is critical for me. With multiple pages per customer, all running different versions of the same pages, I can’t imagine being able to track the scripts any other way. It wouldn’t be manageable.””

““We gave them page names and URLs, and we were given a dashboard, and it was all there. Easy to navigate, easy to access, and it required no developer intervention from our side. That was really the sum of it. It was easy.””

““I liked the reduced risk of not having another set of code running on our pages that could interfere with service.””

““To make a change to the code base for all our customers is a challenge. A year ago, if we needed to introduce something across all of our sites quickly, the way to do that was agentless. Having this external scan was a big tick in the box.””

“I've been really happy and pleasantly surprised with the level of support that we've got from Reflectiz and the team. Supporting us not just at implementation, but post-implementation and beyond.”

“The nice thing with Reflectiz is our ability to bundle insights and recommendations and share them with third parties. We can then monitor the rate at which the identified issues are addressed through Reflectiz.”

“We wanted a lightweight tool that could give us security insights into the code and applications deployed at all our key sites and I didn't see too many out there. We looked at Reflectiz and thought, well, that's going to be something that can give us that ability to rapidly and easily get us that continual oversight”

““Achieving PCI compliance isn’t about ticking a box, it’s about building repeatable, resilient processes. Reflectiz gives us confidence that we’re not just compliant, but continuously protected,””

““Reflectiz gives us the visibility we lacked. If a Facebook pixel suddenly starts doing something different, we know. That kind of behaviour protection is what really sets it apart from the other tools we evaluated. If you’re struggling with how to meet the new PCI DSS v4.0.1 on-page script monitoring requirements, Reflectiz is the answer. It removes the blind spots without disrupting your platforms or teams””

““What I like is that we haven’t had to change anything on our websites. No code deployments. No new accounts. We simply provided the URLs, and within two days the platform was scanning and monitoring our assets. That was the magical part””

““Our existing setup didn’t allow us to demonstrate compliance with these requirements in a streamlined way,” said Keyur Lavingia. “We needed a solution that would give us visibility over all scripts running on our websites, particularly third-party ones, without placing a heavy burden on our already lean security operations team.””

“It gives us visibility, awareness, and most importantly, actionable insights that improve our processes.”

“Our security shouldn’t be limited just to the scope of PCI. We want visibility across our entire ecosystem. Benchmarking with similar companies is also interesting. The exposure rating tool is useful.”

“Working with Reflectiz allowed a more comprehensive visibility and more streamlined processes .”

“After evaluating several approaches, it’s great to see that with Reflectiz we found one and we’re now free to focus on moving forward in advancing our PCI compliance.”

“The onboarding was very smooth, and we even had a chance to explore Reflectiz before the official onboarding. We gained visibility, and the tool is easy to use. The hardest part for us was identifying and assigning ownership for each script.”

“Our main focus has been PCI, so that’s where we use it most, but we expect to expand into other areas soon. I would definitely recommend Reflectiz to other businesses, and if I had to summarise its strengths, I would say, simplicity combined with effortless visibility. That’s important to us. In a company with hundreds of engineers, simplicity is essential for managing complex environments. Reflectiz delivers that.”

“I’d have to say it’s the simplicity. Reflectiz shows us exactly what we have, in a clear and manageable way. The smart approval workflow is great. Once you approve a script, there's built-in logic to manage it going forward. It turns visibility into something actionable.”

“Instead of enforcing everything through a tool, we decided to reverse our approach and monitor everything we have. That’s what led us to Reflectiz, and it worked. It immediately gave us awareness. The UX is simple, and it made the whole process manageable.”

“It’s almost like having an additional security analyst on site. I now have peace of mind that there is a system constantly watching for anything abnormal on the third-party website. This solution plugged into my existing security setup with ease and was ready to go. It also revealed hidden supply chain risks that I didn’t know were there.”

“A lot of systems out there say they’re really good security products. But in most cases, what they do is they create so much noise from alerts that you end up running the risk of not being able to see when you do have an issue, or as we put it, ‘You can’t see the woods for the trees’. With this tool, we can spot problems quickly and act on them, reducing a lot of the time and effort spent on false alarms.”

“There were a lot of third parties that had too much information, and there were no security headers. All the basic things that you would have expected to be in place as part of a retail website weren’t there. With this tool, I was able to show them. I could send them proof that I didn’t have before, even though I’m not a developer. I don’t have to jump between programs. I can just export information about what I’m seeing and tell them what to fix so that my risk level reduces.”