
Elena Vasquez
Chief Information Security Officer at Meridian Financial

A bank built through acquisitions
Meridian Financial is a regional bank serving the upper Midwest, grown through a decade of acquisitions into a $42B institution with 1,800 employees. Like most banks of similar size and history, its data environment reflected its corporate history — multiple core banking systems, several customer data platforms, and a long tail of analytics tools that had been adopted independently across business units.
Why the inventory wasn't enough
The compliance team maintained a data inventory, but the inventory was maintained the way most are: a spreadsheet updated quarterly through interviews with system owners. It was good enough for routine examinations, but inadequate when the SEC's four-day disclosure rule went into effect. Internal incident response simulations showed the team could not reliably hit the materiality determination window using existing tools.
The bottleneck was always the same — emailing six system owners, waiting for them to run queries, and reconstructing what data was actually exposed. By the time the picture came together, the four-day clock would have run out.
What deploying Argus looked like
Meridian rolled out Argus across core banking systems first, then extended to the analytics warehouses and customer-facing SaaS platforms over the following quarter. The continuous discovery surfaced sensitive data in three systems the security team hadn't known about, including a deprecated reporting platform that still held production customer records.
Classification reconciled the regional and acquired-bank inventories into a unified view, with policy overlays that respected the differences in regulatory scope across the bank's business lines.
Where it landed
Incident response simulations now run end-to-end in under a day, including the data exposure assessment that previously consumed most of the timeline. The team uses Argus during quarterly audit prep instead of treating audit prep as a separate project. Most importantly, when regulators ask specific questions during examinations, the answers come from live data rather than reconstructed inventories.
Protect YOur Data