Case Studies
Sanitised case studies from SecByte penetration tests and security assessments across fintech, SaaS, healthcare, retail, public sector and industrial environments.
6
Engagements published
6
Critical findings reported
22
High findings reported
None
Client data disclosed
A grey-box API assessment across 180 endpoints exposed a broken object-level authorisation chain that allowed full merchant account takeover without user interaction.
Authenticated testing across four tenant personas confirmed strong perimeter controls but revealed cross-tenant data leakage through an export job and a background webhook worker.
A carefully constrained internal assessment achieved domain administrator access in under two days through legacy credential reuse, without disrupting a single clinical system.
A structured review of identity, network and data controls across three AWS accounts identified over-permissive roles and forgotten public resources left behind by seasonal campaigns.
Pre-launch testing of a citizen identity portal focused on authentication, session handling and document upload paths, with all findings closed before go-live.
Segmentation testing between corporate IT and plant OT networks proved that a single engineering workstation bridged both environments, contradicting the documented architecture.
Client names, hostnames, identifiers and exploit detail are removed before publication. Case studies are only published with written client consent, and never contain material that would help an attacker reproduce a finding against the original environment.
