Case Studies
Anonymised outcomes from real engagements. All client identities, specific systems, and personally identifiable information have been removed.
— Absolute discretion by design —
Government
PROTECTED — Anonymised
Full-scope Red Team Operation
Legacy Authentication Bypass in a Federal Agency
A Commonwealth agency had passed three consecutive compliance audits but had never undergone objective-based adversary testing. Senior leadership had limited visibility into whether their controls would withstand a determined, targeted attacker.
Critical Infrastructure
SENSITIVE — Anonymised
Open-Source Intelligence Audit
Exposed Operational Technology Interfaces at a Utilities Provider
A national utilities provider suspected their operational technology (OT) environment had unintended internet exposure following a network migration. They needed an attacker's-eye view of their external footprint before commissioning internal testing.
Financial Services
CONFIDENTIAL — Anonymised
Web Application & API Penetration Test
Privilege Escalation via Broken Object-Level Authorisation in a Fintech Platform
A fast-growing Australian fintech had scaled rapidly and needed assurance that their customer-facing platform and internal APIs were secure ahead of a Series B raise and regulatory review.
Defence
RESTRICTED — Anonymised
Assumed Breach & Incident Response Validation
Lateral Movement Undetected for 11 Days in a Defence Contractor
A Tier 1 defence contractor needed to validate whether their security operations team could detect and contain a skilled internal attacker starting from a compromised workstation — a scenario mandated by their prime contractor.
Begin the Conversation
Ready to commission your own engagement?
Every engagement is bespoke. No two organisations face the same threat profile — and no two assessments are identical.
Request a Confidential Briefing