Strengthening Security Through Testing and Verified Remediation

Overview

A financial services and commercial leasing organisation engaged CypherLeap to assess its security posture across public-facing systems, business applications, internal infrastructure and wireless networks. The engagement was designed to show what a realistic attacker could achieve and to identify weaknesses that could affect business operations, sensitive information and customer trust.

The assessment identified 27 findings: six high risk, 14 medium risk, five low risk and two informational. No critical-risk issues were identified. Following remediation, CypherLeap carried out a focused retest to independently verify the organisation's progress.

Test coverage

The assessment covered internet-facing services, three key business applications, the internal corporate environment, Active Directory, multiple network locations and the organisation's wireless network.

External testing reviewed services accessible to an unauthorised internet user. Application testing assessed both public functionality and authenticated user journeys, including whether users could access information or actions beyond their intended responsibilities.

The internal assessment simulated a controlled scenario in which an unauthorised person gained access to the corporate network. It examined whether that access could expand into broader privileges, sensitive information, or other systems. The team also performed wireless testing, with no material issues identified.

Initial findings

The most significant findings involved application access controls, internal privilege management and protection of sensitive information.

Within the business applications, some users could access other users' information or reach functions intended only for administrators. These weaknesses created a risk that users could view, modify or interact with information beyond their approved responsibilities.

The assessment also identified weaknesses involving publicly accessible testing environments, session management, file uploads and automated submissions. Collectively, these issues increased the possibility of unauthorised data access, misuse of application functionality and compromise of systems supporting business processes.

The internal review showed that privileged access was not always sufficiently restricted. Too many accounts held elevated permissions, some shared storage locations exposed sensitive material too broadly and certain inherited permissions increased the potential impact of a compromised account.

The organisation also faced risks from old or unmanaged passwords, insufficient separation of internal privileges, and weaknesses that could allow authentication information to be captured by someone with internal network access.

Although the assessment demonstrated several realistic attack paths, CypherLeap did not fully compromise the external environment or corporate identity domain during the agreed testing period. The organisation's security monitoring also detected several simulated activities, providing evidence that defensive controls were functioning.

Remediation journey

The organisation established a coordinated remediation programme involving infrastructure, application, identity and security teams. Actions were prioritised by business impact, exploitability, and the likelihood that individual weaknesses could be combined into a broader attack.

The infrastructure and identity teams reduced excessive administrative access, restricted access to sensitive share information, and strengthened internal security protections. They also removed unnecessary directory access and improved controls around privileged accounts.

Application teams worked on access restrictions, session behaviour, file-upload controls and protection against repeated or automated requests. These changes required more than simple configuration adjustments because the underlying cause was embedded in application functionality and business processes.

The programme showed that an effective security fix must address the original risk, not just one visible example. Where a control was partially improved, the issue remained subject to further verification.

Retest and validation

CypherLeap completed a focused retest during April 2026. The team reviewed the organisation's remediation claims, confirmed the affected systems and repeated the original assessment activities relevant to each finding.

The reviewers checked whether the original weakness could still be reproduced, whether related functions had also been secured and whether the remediation addressed the underlying cause. They also assessed whether proposed compensating controls, such as access restrictions or monitoring, were operating effectively.

The team assigned each finding a status based on the evidence collected. Issues that were no longer reproducible and had been resolved at their root cause were marked closed. Findings that had been reduced but not fully eliminated remained open as partially remediated or mitigated. Issues that remained exploitable stayed open, while observations based on incorrect or outdated information were recorded as false positives.

This evidence-based approach ensured that completion was measured by actual security outcomes rather than by configuration changes or internal remediation statements alone.

Retest outcome

The retest reduced the number of findings from 27 to 16, representing an improvement of approximately 41 per cent. No critical-risk issues were identified during either assessment.

Several important weaknesses were successfully resolved. These included excessive internal privileges, sensitive shared-resource access, inappropriate directory exposure, certain internal authentication risks, detailed system errors, unnecessary server information disclosure and insecure cookie settings.

A previously reported issue concerning an unsupported operating system was confirmed to be a false positive because the relevant system was no longer active and the record was based on outdated information.

The remaining issues mainly concerned application authorisation, public exposure of testing environments, session control, file uploads, automated request protection, software maintenance and password lifecycle management. Two high-risk issues and 10 medium-risk issues remained because additional application engineering or broader process changes were required.

Business outcome

The engagement delivered a clear and measurable improvement in the organisation's security posture. It reduced the possibility of internal privilege escalation, improved protection of sensitive information and strengthened several foundational identity and infrastructure controls.

The retest also provided independent assurance that remediation was effective where reported as complete and identified where further work was still required. This prevented incomplete fixes from creating a false sense of security.

The principal long-term lesson was that security depends on coordinated ownership across technology and business teams. Strong identity governance, secure application design, controlled exposure of testing environments and regular verification are essential to protecting financial and customer-related services against evolving external and internal threats.

By continuing to address the remaining findings and incorporating the lessons into secure development, access management and change processes, the organisation can further reduce its attack surface and strengthen resilience against future compromise.