// CASE STUDIES
Engagement highlights
Anonymised, client-approved, with the numbers that mattered.
REGIONAL BANK - 2025
Banking web application assessment
Authentication bypass and IDOR chain to full account takeover across 40k customers; fixed and retested in 11 days.
3 critical - 8 high
Details
Challenge
Legacy stack, tight window, production-only environment.
Approach
Grey-box, two testers, three weeks, daily syncs with the SOC.
Outcome
All criticals fixed before the regulator's review; free retest confirmed closure.
TIER-1 BANK - 2025
Mobile banking app security review
Certificate pinning bypass, insecure local storage, and a business-logic flaw in transfers.
2 critical - 5 high
OIL AND GAS OPERATOR - 2024
Fortinet infrastructure hardening
HA FortiGate redesign, 1 200 to 310 policies, SD-WAN across 14 sites.
Policy count -74%
GOVERNMENT ENTITY - 2024
Cisco secure switch and network rollout
802.1X, segmentation and hardened baselines for 3 000 ports.
0 findings at retest
UTILITY - 2024
Network segmentation and OT hardening
IT/OT zoning, jump-host architecture and vendor access controls for a SCADA estate.
Purdue L2/L3 zoned
500+Assessments
$40M+Risk identified
98%Recommend us
11 dMedian fix-to-retest