What the findings actually looked like.
Engagements written up the way we would want to read them: the flaw, why it mattered, how long it took to fix, and what changed afterwards. No vanity metrics.
These write-ups are illustrative. Client details are composited and anonymised, figures are representative of engagements of that size, and nothing here identifies a customer. We publish named case studies only with written permission.
One missing check exposed every tenant's payment mandates
A six-day API test on a Series B payments platform. The headline finding was not exotic: a single object-level authorisation check was missing on one endpoint, and it was enough to read and modify any other customer's direct debit mandates.
Read the write-upThe segmentation that existed only on the diagram
A PCI-DSS segmentation validation where the card data environment turned out to be reachable from the warehouse Wi-Fi through a forgotten management VLAN.
Read the write-upWe publish a write-up after most engagements
Anonymised, technically honest, and only where it teaches something. If you would like to see a write-up covering a specific discipline, ask and we will prioritise it.
Request a write-upWant to see what we would find in yours?
We will test one scoped target and hand you a single verified finding, written up to the same standard, at no cost and with no sales call first.