Security outcomes, proven in practice.

Explore anonymised engagements across penetration testing, security assessment and compliance. Each case study shows the challenge, the evidence, the remediation path and the outcome.

Coverage: cloud and identity, applications and devices, internal and wireless infrastructure, detection engineering, physical security, payments and compliance, endpoints and executive risk.

See How Technical Findings Become Business Decisions

These case studies move beyond vulnerability lists. They show what was at risk, how the exposure was validated, which conclusions the evidence supported and how remediation was prioritised.

The most useful security evidence answers four questions: What can happen? Why can it happen? How do we know? What should change first?

Across cloud identities, payment flows, repositories, internal and wireless networks, security operations, physical environments, devices and endpoints, the collection demonstrates how ProCheckUp combines realistic attack simulation with careful technical calibration. Confirmed impact is separated from plausible-but-unproven risk, and the resulting actions are written for both technical owners and decision-makers.

Case Studies

GitHub Repository Security Review

Security assessment — source code and secrets. Large-scale source-code secret discovery across approximately 800 repositories, followed by controlled validation against authorised cloud and SaaS endpoints.

• Approximately 800 repositories
• More than 2,300 exposed items
• Nine prioritised findings

Core lesson: secrets in source history remain credentials until they are revoked.

Cloud Penetration Testing

Penetration testing — Azure identity. A realistic Azure attacker simulation showed how one compromised developer context could expose tokens, secrets, repositories and connected CI/CD services.

• Four scenarios
• Twenty findings
• Three attack chains

Core lesson: legitimate identity paths can produce deep compromise without malware.

Mobile Application Testing

Penetration testing — iOS payments. Static, dynamic and API testing of a native iOS payment integration identified two Critical transaction-integrity defects before production release.

• Thirteen findings
• Two Critical
• Two build channels

Core lesson: payment-interface integrity is not the same as transaction integrity.

IoT Penetration Testing

Penetration testing — embedded device. An embedded-device review assessed network exposure, local authentication, installed software and the architectural blast radius of an all-root process model.

• One device
• Eight findings
• Critical risk rated 9.2

Core lesson: device architecture determines the blast radius of every component flaw.

Wireless Network Security Testing

Penetration testing — wireless infrastructure. Using a NetAlly AirCheck G3E Pro, an onsite multi-floor wireless assessment combined RF discovery, controlled association testing, configuration review, segmentation checks and physical access-point correlation to identify exposed credentials, insecure management, an open guest service and potential rogue access points.

• Eight wireless findings
• Four High-severity issues
• Potential rogue and unmanaged access points identified for ownership investigation

Core lesson: RF visibility must be reconciled with physical ownership and the wired network.

Internal Infrastructure Penetration Testing

Penetration testing — internal infrastructure. A second-round onsite insider-threat simulation for an international bank assessed whether an unauthorised device could bypass admission controls, relay authentication, cross network boundaries and reach identity services or systems supporting critical banking operations.

• Approximately 550 internal addresses
• Twenty-two findings
• Four Critical-severity issues

Core lesson: internal access is not trusted access.

Purple Teaming

Penetration testing — detection engineering and security operations. A collaborative MITRE ATT&CK-aligned exercise tested how activity from managed laptops, valid user and VPN access, controlled rogue internal systems and cloud services became telemetry, alerts, investigation and containment.

• Twelve MITRE ATT&CK tactic families
• Thirty-four percent of tested scenarios flagged as IoCs
• Two live detection improvements

Core lesson: telemetry is not detection until it becomes actionable.

Build Review Test

Security assessment — Windows 11 and AVD. A physical Windows 11 laptop and Azure Virtual Desktop review tested whether endpoint controls survived standard-user compromise and simulated local-administrator access.

• Two endpoint builds
• Three security contexts
• Six control themes

Core lesson: endpoint controls must remain effective after the user context is compromised.

C-Suite Office Security Review

Security assessment — executive assurance. A mixed-trust executive office assessment extended assurance beyond company-issued devices to personal systems, wireless infrastructure, connected technology and physical controls.

• Six security domains
• No exposed external ports
• Medium to high residual risk

Core lesson: a managed laptop is only one trust boundary in an executive environment.

Physical Security Audit

Security assessment — physical security and social engineering. A five-day assessment of a local-government town hall combined covert access attempts with authorised inspection of doors, visitor controls, CCTV, pass-card records, information handling and staff response. Testers achieved full access within the agreed scope while preserving strict non-destructive boundaries.

• Five-day physical-security programme
• Six High-severity findings
• Three recorded challenges during covert testing

Core lesson: people, physical controls and response must hold at the same time.

PCI DSS QSA Consultancy

Compliance and advisory — scope and SAQ. A multi-channel payment environment was mapped to clarify PCI DSS scope, establish a preliminary assessment route and identify opportunities to reduce the compliance boundary.

• Three payment channels
• Preliminary SAQ D route
• Two critical prerequisites

Core lesson: PCI DSS scope depends on where payment data travels and which systems can affect it.

PCI DSS ASV Scan

Compliance and advisory — external perimeter. A quarterly external vulnerability assessment identified compliance-failing TLS and component issues, then verified their remediation through a successful rescan.

• Quarterly external scan
• Two failures corrected
• Verified passing rescan

Core lesson: the public edge and every security-affecting proxy form part of the assurance boundary.

A Consistent Route From Uncertainty to Action

Every case study is organised so that senior stakeholders can understand the business consequence while technical teams can trace the supporting evidence.

• 1. Context: define the environment, business objective, trust boundaries and operational constraints — what mattered.
• 2. Test: exercise the agreed attack paths under realistic conditions using controlled, authorised methods — what was challenged.
• 3. Proof: manually validate impact, calibrate severity and separate confirmed exposure from inference — what the evidence showed.
• 4. Action: translate findings into immediate containment, engineering improvements and sustained governance — what changed next.

Technical depth without unnecessary disclosure. The collection retains the security lesson while avoiding customer-identifying systems, users, domains and operational details. Read more about ProCheckUp.