Skip to main content
Resources · Case Studies

Penetration testing case studies: what happened when they tested

What an assessment turns up, by industry: the findings, what it took to close them, and the lesson that carried over. Companies are given by profile rather than by name.

Published
6
Length
800–1,200 words
Re-confirmed
Annually

All studies

Every study we have published

DH

Digital health and patient records platform

Healthcare

02

HIPAA-ready security testing for a patient platform that cannot go offline

A 24/7 clinical platform needed continuous testing without touching patient data or availability. Non-destructive assessments found 200+ issues with zero scan-induced downtime.

Read the case study
0
Minutes of scan-induced downtime
200+
Vulnerabilities found and closed
100%
Mapped HIPAA controls evidenced
RM

Retail and marketplace platform

Retail & E-Commerce

03

Cutting 2,800 weekly alerts to 80 on a platform doing millions of transactions a day

Scanner noise had trained the team to ignore alerts. Reporting only what had been exploited cut 2,800 findings a week to roughly 80, and caught a checkout race condition worth an estimated $2M in prevented loss.

Read the case study
99.2%
Reproduced by the team on review
97%
Fewer findings raised
$2M
Estimated loss prevented
FW

Freight and warehousing operator

Logistics & Supply Chain

05

Eleven attack paths to domain admin, closed by four changes

A 40-site Active Directory estate had accumulated a decade of delegation. Attack chain analysis reduced 11 domain-admin paths to zero without a migration project.

Read the case study
11 → 0
Paths to domain admin
4
Changes that closed all of them
0
Accounts locked during testing
IM

Industrial equipment manufacturer

Manufacturing

06

Finding the dependency risk that a vulnerability count kept hiding

A 4,100-package dependency tree produced 900 CVE alerts. Reachability analysis showed 23 were exploitable, and one was in a build tool nobody had inventoried.

Read the case study
900 → 23
Exploitable dependency findings
1
Critical in the build system
19 months
How long it had been there

FAQ

Penetration testing case study FAQs

What do these penetration testing case studies cover?

Each study follows one engagement: the customer profile, what was not working, what AIPTx did about it, the measured results and the lessons that carried over. They span financial services, healthcare, retail and e-commerce, B2B SaaS, logistics and manufacturing.

Are the customers named?

No. Companies are given by profile (industry, size and environment) rather than by name.

Which security problems do the case studies cover?

Moving from twice-yearly pentests to continuous security validation, testing a 24/7 healthcare platform without downtime, cutting scanner noise on a retail platform, proving tenant isolation for a SaaS company, closing Active Directory attack paths, and prioritising software supply chain risk in manufacturing.

How are the results in each study measured?

Each study states the period its numbers cover and what they are compared against, such as the first quarter after rollout or the previous six months of scanner output, and sets out a before-and-after comparison.

How can I see what an assessment would find in my environment?

The sample assessment report shows the output format, or you can talk to a security engineer about a similar engagement.

See Your Attack Surface in Real-Time

Run a comprehensive VAPT assessment powered by advanced security tools. Get actionable findings in hours, not weeks. No credit card required.