What good testing actually changes.

The challenge

An enterprise SaaS vendor needed its cross-platform hybrid CRM client — shipped to customers who hold live customer records — validated across Android, iOS and Windows.

How it unfolded

1. Treated the shipped app as an archive, not a program — unpacked and read the binary.
2. Found hardcoded backend credentials compiled into the bundle.
3. Confirmed (read-only) they granted a live, authenticated session to an internal customer-data API.
4. Recovered the at-rest database key from device-derivable material (weak, unsalted key derivation).
5. Decrypted the offline data store; bypassed jailbreak detection with a single runtime hook.
6. Showed an MDM default silently disabled TLS pinning — enabling full session interception.

Impact

A motivated attacker with nothing but the public app could reach a live customer-data API and decrypt the offline store — on all three platforms.

Outcome

One Critical and five High issues with end-to-end runtime proof, a prioritised “rotate now” credential list, and concrete key-derivation, pinning and token-handling fixes. Testing stopped at proof — no customer records were exfiltrated.

The challenge

A retail bank wanted to test its resilience to phishing, and to an attacker who has obtained a standard domain user on a virtual-desktop host.

How it unfolded

1. Ran two phishing campaigns — one blocked at the gateway, one delivered but ignored by well-trained staff.
2. Switched to assumed breach: a standard domain user on a virtual-desktop host.
3. Enumerated the domain with living-off-the-land native tooling only.
4. Identified a Domain Admin service account with a password unchanged for over a decade, carrying Kerberos SPNs.
5. Kerberoasted it for offline cracking; found dozens of AS-REP-roastable accounts and a stale never-expiring admin.
6. Segmentation between the virtual desktops and on-prem directory meaningfully limited further reach.

Impact

A single ordinary account could put a path to full-domain compromise within reach — while the bank's email controls, staff awareness and network segmentation all held as defence-in-depth.

Outcome

A clear privileged-account-hygiene and Kerberos-hardening roadmap, plus independent validation that the bank's phishing, awareness and segmentation controls were genuinely working.

The challenge

A manufacturer wanted its small, heavily-firewalled internet-facing surface and identity exposure assessed.

How it unfolded

1. Mapped a genuinely tight, well-firewalled perimeter.
2. Found an internet-facing remote-access gateway running an out-of-support server OS as an AD authentication boundary.
3. Confirmed it leaked internal domain and host names via an NTLM challenge.
4. Detected an active external credential-stuffing campaign in progress against several cloud-mailbox accounts.
5. Confirmed breach-corpus passwords were present but already rotated (a defensive positive); handed over provider trace IDs for log correlation.
6. Found a B2B file-transfer listener still negotiating legacy weak ciphers without mutual TLS.

Impact

The company was one unpatched gateway, or one reused password, away from a foothold — and was already being probed while we tested.

Outcome

A prioritised remediation list (retire the end-of-life gateway, close the credential-stuffing exposure, add DMARC, mutual TLS and modern ciphers) plus actionable intelligence on an attack already underway.

The challenge

A manufacturer with a flat-ish network mixing modern Windows AD, end-of-life midrange systems and operational-technology devices wanted to know the blast radius from an on-network foothold.

How it unfolded

1. Poisoned name resolution (LLMNR/NBT-NS/mDNS) and captured cleartext credentials from a legacy HTTP-Basic service.
2. Found SMB signing disabled broadly and proved NTLM relay end-to-end — a relayed machine account authenticated to around ten hosts.
3. Found LDAP signing and channel binding not enforced on the domain controllers; relayed to LDAP for a full authenticated directory dump.
4. Enumerated the domain anonymously via null session — hundreds of users and the password policy — and mapped grossly excessive privileged-group membership.
5. Catalogued EOL and OT exposure (an unauthenticated AJP file read on an EOL server, cleartext protocols and SMBv1 on a legacy midrange OS, and a vulnerable OT controller line).

Impact

A chain from an unauthenticated on-network foothold to a path to full Active Directory compromise — with OT systems reachable on the same network.

Outcome

A layered hardening plan: enforce SMB/LDAP signing and channel binding, disable LLMNR/NBT-NS, clean up privileged groups, decommission EOL systems and segment IT from OT — with a scoped second window for delegation and AD-CS paths.

The challenge

A smishing campaign impersonating a national e-services / fine-payment portal was harvesting payment and identity data. The goal was attribution and takedown evidence — without touching victims or submitting any data.

How it unfolded

1. Collected and hash-sealed infrastructure and the live page kit for chain-of-custody.
2. Reverse-engineered the single-page-app kit and mapped the victim funnel and the full set of harvested fields.
3. Identified real-time exfiltration over a same-origin websocket, with the hosting server itself acting as the operator backend.
4. Assessed capability: live PIN and OTP relay indicated an interactive operator defeating SMS-2FA and 3-D Secure in real time — a high-capability kit, not a static dump.
5. Clustered the infrastructure and attributed it to a phishing-as-a-service operation reused across multiple countries and lures.

Impact

Active, scaled theft of payment cards and identity data from citizens, with two-factor authentication bypassed in real time.

Outcome

Hashed, court-ready evidence and multi-party takedown packages (registrar, hosting, national CERT, browser blocklists, certificate authority) suitable for law-enforcement handover. All analysis was retrieval-only — no data was ever submitted to the attacker's infrastructure.