Services Capabilities Industries Cloud Audit Free Scanner Case Studies Use Cases Book a Consultation
Home › Use Cases
Security Assessment Use Cases

Real Audits.
Real Findings. Full Walkthrough.

Three detailed security assessments across Financial Services, FinTech, and AI/ML platforms. Each one covers the full attack surface — infrastructure, application, and compliance — with every finding documented, mapped to frameworks, and remediated.

3 Published audits
71 Total findings
29 Critical findings
3 Industries covered
Use Case #1
Case #001 Financial Services

DataVault CRM

Financial Services CRM Security Audit: 21 Vulnerabilities Found — SQL Injection, Plaintext PII, Broken JWT Auth, and Exposed Production Credentials

Risk Score 87/100 CRITICAL
11 Critical
7 High
3 Medium
21 Total
Key Findings
Critical
SQL Injection in Reporting Module
Unsanitized input in the report export endpoint — any authenticated user could execute arbitrary SQL, extract all records, or drop tables.
Critical
Plaintext SSNs and Credit Card Numbers
847 customer records stored with no encryption. SSNs, PANs, and passwords in clear text — any database access was a full data breach.
Critical
Exposed .env File — JWT Secret, DB Creds, API Keys
Environment config file publicly accessible from the web root. JWT signing secret recoverable — we forged admin tokens within minutes.
Critical
Broken JWT Authentication — Admin Account Takeover
Hardcoded JWT secret allowed token forgery for any user account, including admin. Full application compromise from a single config leak.
High
IDOR on Customer Records
No authorization checks on record IDs — any authenticated user could access any other customer's data by changing the ID in the URL.
High
No Rate Limiting on Auth Endpoints
Login and password reset endpoints accepted unlimited requests — automated credential stuffing was trivially executable.
Compliance Frameworks Tested
PCI DSS Non-Compliant
SOC 2 Type II Multiple Gaps
NIST 800-53 Non-Aligned
Post-Remediation Risk 87→12%
Security Audit Walkthrough · DataVault CRM · March 2026
Live exploit demos — SQL injection, token forgery, IDOR chain — and full remediation walkthrough
Coming Soon
3-day black-box engagement · 847 records at risk · All 21 findings remediated in 14 days
Read Full Audit
Use Case #2
Case #002 FinTech / Payment Processing

NovaPay Solutions

Payment Processor Security Audit: 25 PCI-DSS Violations Exposed — Plaintext PANs, CVV Storage, Magnetic Stripe Data, and Unpatched Critical CVE

Risk Score 96/100 CRITICAL
9 Critical
12 High
4 Medium
25 Total
Key Findings
Critical
PANs Stored in Plaintext
Primary Account Numbers stored unencrypted in the transactions table — a direct PCI-DSS v4.0 Requirement 3 violation affecting all processed cards.
Critical
CVV Data Retained Post-Authorization
Card verification values stored permanently after payment authorization — explicitly prohibited by PCI-DSS Requirement 3.2. Affects 100% of card transactions.
Critical
Full Magnetic Stripe Data Retained
Track 1 and Track 2 magnetic stripe data stored after authorization — enables card cloning. Strictly prohibited under PCI-DSS and never permissible post-auth.
Critical
Hardcoded API Keys in Client-Side JavaScript
Payment processor API keys embedded in front-end JavaScript bundles — visible to any user viewing page source. Enables unauthorized payment initiation.
Critical
Unpatched Critical CVE — 14 Months Deferred
Known critical vulnerability in the payment gateway library unpatched for 14 months despite public disclosure. Active exploit code available in the wild.
High
No Network Segmentation — Flat Cardholder Data Environment
Payment processing systems on the same network segment as general business infrastructure. Compromise of any internal system provides a path to cardholder data.
High
Default Vendor Credentials on Payment Terminal Management
Terminal management console accessible with factory-default admin credentials — unchanged from vendor defaults. Full administrative access to all payment terminals.
Compliance Frameworks Tested
PCI-DSS v4.0 8% Compliant
SOC 2 TSC 10% Compliant
Security Audit Walkthrough · NovaPay Solutions · FinTech Payment Processor
PCI-DSS violation demo — plaintext PAN extraction, CVV database dump, terminal credential takeover
Coming Soon
FinTech payment processor · 25 PCI-DSS violations · Risk score 96/100 — highest across all engagements
Read Full Audit
Use Case #3
Case #003 AI/ML — Model Serving & Inference

NeuralPath AI

AI Platform Security Audit: Critical Model Theft & Data Exfiltration Risks — 4.2TB Training Data Exposed, Pickle RCE, Kubernetes Container Escape

Risk Score 89/100 CRITICAL
9 Critical
11 High
5 Medium
25 Total
Key Findings
Critical
4.2TB Training Data on Public S3 Bucket
Entire training dataset — including proprietary enterprise client data — stored in a publicly readable S3 bucket with no authentication required.
Critical
Model Theft via Unauthenticated Model Weights Endpoint
Model weights and architecture files accessible without authentication on the inference API. Any internet user could download the full model — years of training data and compute cost.
Critical
Pickle RCE — CVE-2023-43338 (Insecure Deserialization)
Model serialization used Python Pickle format with no validation — arbitrary code execution via crafted model file upload. Exploitable through the public model import endpoint.
Critical
Multi-Tenant Data Cross-Contamination
Tenant isolation failure — API keys from one enterprise client could query inference results and cached prompts belonging to other tenants. Affects all 200 enterprise clients.
Critical
Kubernetes Anonymous Authentication Enabled
Kubernetes API server configured with anonymous authentication enabled — unauthenticated users had cluster-admin equivalent access to all GPU workloads and pod secrets.
Critical
Exposed Jupyter Notebooks — Production Credentials in Cells
Jupyter notebook server accessible without authentication, with notebooks containing production database connection strings, cloud credentials, and API keys in executed cells.
High
API Key Leakage via Model Response Headers
Internal service API keys exposed in inference response headers — leaked to every API consumer, enabling lateral movement into internal data pipeline infrastructure.
Compliance Frameworks Tested
SOC 2 Type II ~17% Compliant
NIST 800-53 ~15% Aligned
EU AI Act High-Risk Gaps
Security Audit Walkthrough · NeuralPath AI · ML Model Serving Platform
Pickle RCE exploit, model weight extraction, tenant isolation bypass, and Kubernetes cluster compromise chain
Coming Soon
AI/ML model serving platform · 200 enterprise clients at risk · Pickle RCE + K8s escape = full infrastructure compromise
Read Full Audit
More Use Cases

Additional Audits — Live & In Progress

More detailed security assessment walkthroughs covering different industries, cloud platforms, and threat profiles.

CloudReach SaaS
AWS Cloud
Multi-account AWS infrastructure: public S3 leaking customer data, wildcard IAM roles, GuardDuty off in every region, Terraform state exposed. 25 findings, risk 92.
Live — Read full audit
AzureVault Analytics
Azure Cloud
Azure-native data analytics platform: public Blob Storage leaking customer datasets, Global Admin no MFA, Defender for Cloud disabled, Key Vault soft-delete off, Service Principal with Owner rights. 25 findings, risk 90.
Live — Read full audit
MedFlow Analytics
Healthcare
HIPAA-focused cloud audit: unencrypted PHI at rest in S3, overly permissive IAM, missing audit logging. 19 findings, full NIST 800-53 alignment.
Case study in progress
GridEdge Energy
IoT
Smart-grid IoT audit: unprotected MQTT endpoints, missing device authentication, insecure firmware update pipelines. 18 findings, full AWS IoT Core hardening.
Case study in progress

Get Your Own Security Assessment

Run a free surface scan on your domain, or schedule a full engagement. We break it down finding by finding — the same methodology used in every audit above.

Run Free Scanner Book a Consultation