AXIOMIO

Financial Services · King & Shaxson

King & Shaxson Ships Only CIS-Verified Images

King & Shaxson is a London-based investment firm offering investment advisory, portfolio management, bond and money market trading, and safe asset custody. It is widely recognized for its specialized division, King & Shaxson Asset Management, which pioneered tailored ethical, sustainable and socially responsible investment (SRI) portfolios for institutional clients and high-net-worth individuals worldwide.

Results at a Glance

  • 95%+ CIS Pass Rate
  • 80%+ Hardening Effort Cut
  • <24 h Drift Remediation
  • 100% Changes Audited

The Challenge

King & Shaxson runs its client-facing and internal applications on Amazon EC2, and its EC2 images were hardened by hand. An engineer launched an instance, ran Ansible playbooks aligned to the CIS Benchmark, created an image and shared it for use.

This created three problems:

Hardening depended on the individual engineer, so it wasn't applied consistently.

Images were never verified against the benchmark before deployment, so a missed step could reach production undetected.

Running instances drifted from the hardened baseline, and the deviations only surfaced during periodic audits.

As a regulated investment firm under Financial Conduct Authority supervision, King & Shaxson needed continuous, evidenced control over its compute configuration rather than a point-in-time checklist.

Our Solution

AxiomIO built a CIS-gated golden image pipeline on EC2 Image Builder. The customer's Ansible playbooks were refactored into a single version-controlled hardening role. Before any image is released, Amazon Inspector scans a test instance against the CIS Amazon Linux 2023 Benchmark. An AxiomIO-built gate releases the image only if it meets the approved baseline. If it doesn't, the gate maps each failed check to its Ansible task, rebuilds the image and verifies it again.

After deployment, weekly Amazon Inspector CIS scans check every running instance. Low-risk drift is fixed automatically by re-applying the same Ansible role through AWS Systems Manager. Fixes that could affect a running workload wait for a named King & Shaxson approver. Engineers are notified through Amazon SNS at every step, and each fix is re-scanned before it's closed.

Results

The engagement replaced manual, unverified hardening with an automated baseline that is checked before release and maintained after deployment.

Key outcomes included:

  • No EC2 image reaches production without passing the CIS Benchmark gate.
  • Hardening applied identically to every image through version-controlled code rather than engineer by engineer.
  • Configuration drift detected by scheduled assessment and fixed automatically or after named approval.
  • Engineers informed of every drift event, fix and approval decision as it happens.
  • Continuous, attributable evidence of hardening compliance for regulatory and audit purposes.
  • Exceptions managed as time-boxed, owned decisions rather than silent deviations.