CASE STUDY
ÉTUDE DE CAS
ISO 27001 certification unlocked enterprise sales and freed Metluma's engineers to build product instead of manage compliance
"You can't win enterprise work unless you have ISO. So you almost have to invest in getting ISO so that you can go and start winning all the work."
TL;DR
- Challenge: Metluma needed ISO 27001 certification to win enterprise deals with corporate employers and health and life insurers, but managing compliance manually — as Georgie had experienced at a previous company — consumed weeks of effort, required a full-time CISO, and pulled engineers away from building product.
- Solution: Metluma deployed Vanta's automated compliance platform with ISO 27001 and Trust Center, integrating tools like Employment Hero to automate tracking across team members and create a single source of truth for security posture.
- ROI: Metluma achieved ISO 27001 certification in March 2026, hired a fractional CISO instead of needing a full time resource, saved weeks of manual effort, and unlocked enterprise sales conversations with major corporates, insurers, and superannuation funds and was just recognised as part of the AFR’s Fast Starters 2026.
The company
A doctor-led women's health platform built to win enterprise trust
Metluma is an Australian digital health company co-founded by Georgie Drury and Dr. Nicole Avard that delivers doctor-led perimenopause and menopause care through telehealth consultations, a 12-week coaching program, and ongoing support. The company sells its platform to corporate employers, health insurers, and superannuation funds — a B2B model where data security isn't a differentiator; it's a prerequisite. From day one, Metluma's leadership understood that winning enterprise deals in a post-Medibank breach environment meant holding security to a higher standard than most startups its size.
The challenge
Manual compliance and full-time security overhead threatened Metluma's ability to compete for enterprise contracts
For a sub-20-person healthtech company selling into large corporates, ISO 27001 certification isn't optional — it's the price of admission. Without it, enterprise procurement teams won't engage, and no amount of clinical credibility closes that gap.
What Metluma tried first: Georgie had lived the alternative at her previous company, Springday, where ISO 27001 compliance ran entirely through SharePoint — no automation, no integrations, and no visibility without digging through shared drives. It required a full-time CISO to hold the whole system together.
Metluma's pivot point: That model created compounding risks: weeks of manual effort, a single point of failure if the CISO left, and engineers pulled off product work to fill compliance gaps. For a small team where every hour of engineering time has direct product impact, that tradeoff wasn't sustainable. Add the heightened scrutiny on health data following Australia's wave of cyber breaches, and the stakes were clear — Metluma needed a compliance infrastructure that could scale without scaling headcount. As Georgie put it: "We've had so many cyber breaches, like with Medibank. Health is now under scrutiny, so we have to be punching well above our weight."
Why Metluma chose Vanta: A direct recommendation from a peer in Georgie's female founders forum pointed her to Vanta. She needed a platform that automated the heavy lifting, gave her real-time visibility into compliance status without requiring deep security expertise, and freed her CTO and engineers to stay focused on building product. Vanta met all three criteria.
{{quote-2}}
The Vanta impact
From SharePoint chaos to certified and enterprise-ready in under a year
Vanta set up Metluma with an automated, transparent system that gives Georgie confidence in her security posture and gives enterprise buyers confidence in Metluma's data practices. They never lost an enterprise deal due to compliance, because they could show they were working towards certification from day one.
Here's how Metluma deployed Vanta:
Metluma now enters enterprise sales conversations with a certified security posture and the infrastructure to maintain it without diverting engineering resources — a structural advantage that lets a sub-20-person team compete credibly against much larger vendors. As the company scales its B2B pipeline with corporate employers, insurers, and superannuation funds, Vanta remains the compliance foundation that makes those conversations possible.
{{quote-3}}
