Read summarized version with
About project
Working time:
2025 – ongoing
Industry:
Consumer applications, collectibles
The service:
Managed Security Services, Managed Services
Overview
Collectr is a Toronto-based app that tracks the value of collectibles for more than 10 million users and over 13 million daily sessions. Its catalogue is the product, which makes it the target: at peak, an estimated 28 per cent of the app’s requests came from scrapers harvesting it. Dedicatted runs Collectr’s AWS security operations around the clock and treats every abuse wave as a security incident, with detection, response and a root cause like any other.
The challenge
- Abuse at scale. Scrapers adapted every time they were blocked, inflating compute costs and degrading the app for real users during card releases.
- Problems found by users. With no operations or security team, up to ten major issues a week were discovered by customers before anyone at Collectr knew.
- No security baseline. Detection, logging and access had grown account by account, with no single view of what was happening across the estate.
Want to get your copy of case study?
Download it here.
By submitting this form, you agree with our Terms & Conditions and Privacy Policy.
The solution
A governed estate. AWS Organizations with AWS Control Tower separates production from the Log Archive, Security Tooling and Forensics accounts. Amazon GuardDuty, AWS Security Hub (AWS Foundational Security Best Practices and CIS), Amazon Inspector, AWS Config, Amazon Detective and Amazon Security Lake run organization-wide under delegated administration, and every finding is routed by Amazon EventBridge to the Dedicatted on-call rotation.
Abuse handled as an incident. AWS WAF on Amazon CloudFront enforces AWS managed rules, Bot Control and per-URI rate limits before traffic reaches AWS Lambda. Request telemetry from Amazon API Gateway, Lambda and CloudFront flows into Security Lake. When an abuse alarm fires, the on-call engineer opens an incident, Amazon Bedrock analyses the request logs and proposes new detection rules, and an engineer reviews them before they are deployed. Blocks on attacking addresses expire automatically, so an emergency rule never outlives the wave.
Response on a clock. A critical incident is acknowledged within 15 minutes and contained within the hour, at any time of day; every major incident closes with a root cause analysis whose actions change the baseline.
The results
- Malicious traffic at peak fell from about 28 per cent to under 3 per cent, with about 400,000 malicious requests blocked every week at the edge before they reach compute.
- Zero priority 1 or 2 incidents over three months, down from up to ten major issues a week.
- Release-day spikes of seven times normal load absorbed without degradation.
“Before Dedicatted, every spike felt like an emergency.” Muhammad Rashid, COO, Collectr.
AWS services used
AWS WAF, Amazon CloudFront, Amazon GuardDuty, AWS Security Hub, Amazon Inspector, AWS Config, Amazon Detective, Amazon Security Lake, Amazon EventBridge, AWS Organizations, AWS Control Tower, AWS Lambda, Amazon API Gateway, Amazon Bedrock.
