Case studies

Selected engagements, evidence attached.

Real-world assessments where our engineers identified critical vulnerabilities and helped teams close them. Client identities have been anonymized.

FinTech · 2023Critical · 9.1

Core Banking API Compromise

Scope: API Security Testing
Critical findings: A Broken Object Level Authorization (BOLA) flaw on the ledger endpoint let any authenticated customer read every account balance and move funds between arbitrary accounts.
Outcome: Patched within 4 hours. Prevented potential 8-figure financial loss.

Read the full case study

Healthcare · 2024Critical · 9.8

Pre-Emptive Ransomware Simulation

Scope: Red Team Operation
Critical findings: A single unpatched VPN appliance led to pre-auth RCE, credential theft, and a forged Kerberos golden ticket — full domain control in 36 hours.
Outcome: Complete restructuring of Active Directory and implementation of Zero Trust architecture.

Read the full case study

Cryptocurrency · 2023Critical · 9.0

Cold Wallet Escrow Breach

Scope: Cloud Security Assessment
Critical findings: A leaked read-only AWS key chained through an iam:PassRole misconfiguration to reach the KMS keys signing cold-wallet transactions.
Outcome: Hardened IAM policies and segregated critical signing infrastructure.

Read the full case study

Energy · 2022Critical · 9.4

Energy Grid SCADA Isolation

Scope: IoT / OT Security
Critical findings: A single phishing email led to a dual-homed engineering workstation that bridged the supposed air gap into the OT network controlling physical turbines.
Outcome: Implemented physical data diodes and rewrote corporate-to-OT access rules.

Read the full case study

Digital Payments · 2026Critical · 9.8

OAuth Token Confusion Account Takeover

Scope: API Security Testing
Critical findings: The third-party login endpoint verified that an identity-provider token was genuinely signed, but never checked the token was issued for this application. Any valid token minted for an unrelated app authenticated as the victim.
Outcome: Audience enforcement deployed within the disclosure window. Confirmed fixed and existing sessions rotated.

Read the full case study

Online Trading · 2026Critical · 9.0

Balance Ceiling Bypass via Race Condition

Scope: Business Logic Testing
Critical findings: A funding endpoint checked the account ceiling and credited the deposit as two separate, non-atomic steps. A burst of parallel requests all passed the check before any committed, inflating the balance far beyond the enforced maximum.
Outcome: Funding wrapped in an atomic, row-locked transaction with idempotency keys. Re-test confirmed the ceiling held under parallel load.

Read the full case study

Consumer Electronics · 2026Critical · 8.2

Token Theft via Authentication Open Redirect

Scope: Web Application Testing
Critical findings: Login redirect parameters validated only the root domain, ignoring subdomains and paths. Crafted URLs that survived parsing inconsistencies sent the post-login redirect — and the authentication token — to attacker-controlled infrastructure.
Outcome: Redirect targets moved to a strict allowlist with full-URL validation across all subdomains. Re-test confirmed all bypasses closed.

Read the full case study

Travel & Hospitality · 2026Critical · 9.4

Identity Provider Email Spoofing Takeover

Scope: Authentication Security Review
Critical findings: Social login merged accounts on the email claim, and one supported provider lets tenant administrators set an arbitrary, unverified email on a user. An attacker could mint an identity bearing the victim’s email and log straight into their account.
Outcome: Account linking moved to the immutable subject identifier with verified-email enforcement. Confirmed fixed and unsafe links audited.

Read the full case study

EdTech / Online Learning · 2026Critical · 9.3

1-Click Mobile Account Takeover via DeepLink

Scope: Mobile Application Testing (Android)
Critical findings: An exported deep-link activity guarded its destination with a permissive pattern match. A crafted link slipped past the check and loaded attacker-controlled content inside the trusted app context, leaking the session on a single tap.
Outcome: Deep-link host validation rebuilt on an exact-match allowlist; the activity was unexported where not required. Re-test confirmed the bypass closed.

Read the full case study

Start an engagement

Tell us what you're shipping.
We'll tell you what it's exposing.

Book a 30-minute scoping call with a senior engineer. You'll leave with a clear recommendation on scope, approach, and timeline.

Book a consultation contact@proteqon.com

Selected engagements, evidence attached.

Core Banking API Compromise

Pre-Emptive Ransomware Simulation

Cold Wallet Escrow Breach

Energy Grid SCADA Isolation

OAuth Token Confusion Account Takeover

Balance Ceiling Bypass via Race Condition

Token Theft via Authentication Open Redirect

Identity Provider Email Spoofing Takeover

1-Click Mobile Account Takeover via DeepLink

Tell us what you're shipping.We'll tell you what it's exposing.

Tell us what you're shipping.
We'll tell you what it's exposing.