Assuring secure communications at scale for UK public sector
Challenge
The public sector organisation needed proof that a new cloud-based patient communications platform would remain secure, resilient and compliant under realistic peak usage
Approach
We applied a Total Quality assurance model, combining penetration testing with realistic stress and load testing, then retesting to check fixes.
Results
Issues were identified and fixed pre-launch and we proved that the platform stayed secure under load, giving confidence to proceed with a national rollout.
For citizen-facing health services, digital transformation is not simply about modernisation. It’s about maintaining trust at scale.
When a government health service writes to a patient, that communication often contains appointment details, test results, referral information or sensitive clinical correspondence. Citizens expect that information to be accurate, private and accessible, every time.
As part of a nationwide cloud-first transformation programme, a national government body was preparing to launch a new third-party digital communication platform to deliver secure online health correspondence.
The ambition was to:
- reduce reliance on paper
- improve accessibility and convenience
- enable faster, more efficient communication
- build a modern, scalable digital health service
But when services handle highly sensitive medical information, modernisation must never compromise confidentiality.
Before rollout, the organisation needed certainty that the platform would remain secure and resilient. Not just under ideal conditions, but under real-world population usage.
The challenge: Learning from international experience
The platform that was chosen for deployment had already been rolled out in other countries. In one case, weaknesses were exposed when the system experienced sustained high user volumes.
These issues were not caused by a cyberattack, but by how the system behaved under pressure, showing how performance, resilience and security are closely linked in complex digital environments.
For a government health service operating under strict data protection laws, this made the next step clear: before a national rollout, the platform had to be tested under realistic, high-volume conditions to confirm that the same risks would not occur.
The organisation needed to be confident that the system would stay:
1
2
resilient under stress
3
compliant with data protection obligations
4
safe to scale progressively to a large-scale roll-out
Traditional penetration testing on its own would not provide sufficient assurance. The platform had to be proven secure not only against attack, but under operational load.
Our approach: A Total Quality assurance model
Resillion was brought in to provide coordinated assurance across both cyber security and system performance – using a Total Quality approach that integrated multiple disciplines in a structured sequence.
Rather than treating security and quality as separate workstreams, we brought them together to provide holistic assurance ahead of go-live.
Phase 1: Security Assessment
We undertook a comprehensive penetration test of the third-party digital communication platform, assessing:
- authentication controls
- data access boundaries
- configuration security
- integration points
- potential attack vectors
This established a clear baseline security posture and identified areas requiring remediation.
Phase 2: Stress and load testing under realistic conditions
To address the risks that had been identified in other non-UK deployments, we designed a structured stress and load testing programme that mirrored realistic user behaviour and traffic patterns.
This involved:
- detailed front-end scoping to model expected adoption rates
- designing traffic volumes aligned to projected population usage
- simulating authentication and message access journeys
- sustained and peak load testing scenarios
- monitoring system behaviour, data handling and session integrity under stress
The testing was designed to mirror the real-world conditions where issues had previously appeared in other countries.
During testing, additional performance and configuration problems were found and fixed before rollout, making the platform more robust.
Most importantly, the testing confirmed that the system remained secure and that heavy user load did not weaken core security controls.
Phase 3: Remediation verification
Following remediation activity, we conducted structured retesting to check that the issues that we’d identified had been fully resolved and that no new risks had been introduced.
This provided documented, defensible assurance before the go-live.
Why this mattered
The platform supports secure digital communication between the health service and citizens, handling highly sensitive personal information.
If vulnerabilities had emerged after large-scale deployment, consequences could have included:
Exposure of sensitive data
Regulatory scrutiny
Operational disruption
Reputational damage
Loss of public trust in digital healthcare services
By proactively testing under the same conditions that had exposed weaknesses elsewhere, the organisation reduced the likelihood of similar incidents occurring in its own rollout.
A true Total Quality engagement
This work demonstrated Total Quality in action.
A conventional penetration test may not identify issues that only appear when things scale up. A conventional performance test may not interpret system behaviour through a security lens.
By bringing together both disciplines, we delivered:
1
A coordinated view of confidentiality, integrity and availability
2
Validation of system behaviour under realistic operational conditions
3
Reduced risk of cross-disciplinary blind spots
4
Clear assurance reporting for senior stakeholders
5
Confidence to proceed with phased national rollout
Total Quality means combining assurance activities to reflect real-world risk.
Results: Secure, scalable digital health communications
Through a coordinated assurance programme, the government gained:
- confidence in the security and resilience of its digital communication platform
- validation of performance under realistic stress conditions
- reduced risk prior to national scale-up
- stronger regulatory assurance
- a robust foundation for continued cloud-based transformation
For citizen-facing health services, digital transformation is not simply about modernisation – it is about maintaining trust at scale.
Total Quality ensures that trust is engineered in from the outset – not tested after the fact.
Related Insights
Providing solutions in a unified, structured approach across all critical domains to enable end-to-end quality.
Get in touch
Providing solutions in a unified, structured approach across all critical domains to enable end-to-end quality – Because we’re the only ones who can.
