# Velstadt

### Posts

#### Anatomy of a Critical Pentest Finding: From MS SQL Injection to Remote Code Execution in a Production CRM
During a scheduled penetration test of a corporate web application, a customer relationship management (CRM) system handling sensitive personal data, Velstadt's offensive security team identified a Critical-severity SQL injection vulnerability. Exploitable without authentication, this vulnerability allowed the exfiltration of full database contents and chained to remote code execution (RCE) on the underlying SQL Server through the xp_cmdshell extended stored procedure.



The finding scored CVSS v3.1 10.0 (Critical) — the maximum possible severity, and exposed customer Personally Identifiable Information (PII), including full names, dates of birth, tax identification numbers, and passport details, as well as production API keys and internal business-process data.



This case study walks through how the finding was discovered, exploited, and escalated, and what enterprise security teams should do to prevent identical findings in their own environments. The engagement is anonymized; technical details are preserved for educational value.



TL;DR — Key Takeaways from This Case Study




Vulnerability: Unauthenticated SQL injection (CWE-89) in a CRM feedback-form API endpoint. The text parameter passed to a POST request was concatenated into a SQL query without parameterization or sanitization.



Discovery: Triggered by deliberately malformed input. The application returned a verbose MS SQL error message that disclosed query structure: a classic production error-disclosure weakness (CWE-209 / CWE-200)



Exfiltration: Automated tooling (sqlmap) was used to enumerate database accounts, list every database (including master and MSCRM), and extract table contents such as customer PII, production API keys, internal business reports, and transaction logs.



Escalation: SQL Server's built-in xp_cmdshell extended stored procedure was disabled by default, but the compromised database context had sufficient privileges to reconfigure the SQL Server instance, enable xp_cmdshell, and execute operating-system commands (CWE-269 / CWE-78 ; MITRE ATT&CK T1505.001 / T1059.003).



Severity: CVSS v3.1 10.0 (Critical) — maximum score across all dimensions: network-accessible, no authentication required, no user interaction, scope-changed (database to OS), full confidentiality / integrity / availability impact.



Root Cause: Two stacked failures: application code that concatenated user input into SQL queries (CWE-89), and excessive SQL Server privileges that allowed a compromised database context to enable and execute xp_cmdshell (CWE-269 / CWE-78). Each control alone would have significantly limited the worst outcome.




The Engagement Context



The target was a CRM system used to manage customer relationships and operational workflows for a highly regulated business. CRMs are particularly attractive targets because they centralize structured customer data, including personal information, contract details, payment context, alongside operational metadata (API integrations, internal scripts, business rules) and credentialed connections to other systems. A successful CRM compromise produces an attacker payoff far exceeding the cost of entry.



The engagement scope included the external-facing application surface, with explicit permission to enumerate exposed APIs, probe input parameters, and validate exploitation primitives within agreed safety boundaries. Testing was aligned to:




OWASP Web Security Testing Guide



OWASP Top 10: A05:2025-Injection



NIST SP 800-115



MITRE ATT&CK Enterprise Framework




Manual testing was supplemented by targeted automated tooling.



Step-by-Step Technical Breakdown



Step 1 — Reconnaissance: Finding the Feedback-Form API Endpoint



The CRM exposed a customer feedback form on its public-facing surface. When a user submitted the form, the application issued an HTTP POST request to an internal API endpoint with a JSON payload containing, among other fields, a text parameter carrying the user's feedback message.



The following request, payload, and error examples are simplified and anonymized reconstructions based on the confirmed testing flow. They are included to illustrate the vulnerability pattern and are not verbatim excerpts from the client environment.



POST /api/feedback HTTP/1.1Host: crm.target-company.comContent-Type: application/jsonContent-Length: 142{  "name": "John Doe",  "email": "johndoe@example.com",  "text": "This is a standard feedback message."}



Feedback forms and contact endpoints are routinely under-tested. The assumption that they "just record text" often leads to weaker input validation and less rigorous database interaction. Velstadt's pentest methodology treats every user-influenced input as a candidate injection point until proven otherwise.



Step 2 — Confirming the Injection: A Verbose SQL Error Tells the Story



The first probe was a deliberate syntax-violation payload: characters designed to break SQL syntax if the input was concatenated directly into a database query. In this case, we appended a single quotation mark ' to the text parameter:



{  "name": "test",  "email": "test@test.com",  "text": "'"}



The application returned an HTTP 500 response containing a detailed MS SQL Server error message:



Microsoft OLE DB Provider for SQL Server error '80040e14'Unclosed quotation mark after the character string '...'



A verbose database error in a production application response body constitutes two high-impact findings at once:




CWE-89 (SQL Injection) — Confirmed: Error-based responses indicate user-controlled input is reaching the query execution layer without sanitization.



CWE-209 / CWE-200 (Information Exposure Through Error Messages): Production environments should never disclose raw database errors, query fragments, table names, or column references to clients. The error itself acts as a map of the underlying database schema, significantly accelerating the exploitation phase.




This step was determinative. The offensive team had a confirmed injection point with disclosed metadata.



Step 3 — Database Enumeration and Data Exfiltration



With a confirmed injection point, a second-stage payload was constructed to query SQL Server's metadata: version, configuration, current user context, and available databases.



To accelerate enumeration and demonstrate realistic risk, we deployed the industry-standard SQL injection exploitation framework, sqlmap:



python sqlmap.py -u "https://crm.target-company.com/api/feedback" \--data='{"name":"test","email":"test@test.com","text":"*"}' \-H "Content-Type: application/json" \--dbms="Microsoft SQL Server" \--level=5 \--risk=3



The asterisk * tells sqlmap exactly where to place the injection payloads. Within minutes, the tool confirmed the backend DBMS and produced evidence of excessive database privileges, accessible databases, and table enumeration. 



The relevant sqlmap output is summarized below. Sensitive database names were partially redacted.



[INFO] testing if current user is DBAdatabase management system users privileges:[*] logging [*] sa (administrator)



available databases [9]:[*] CrmIntegration[*] Debug[*] master[*] model[*] MSCRM_CONFIG[*] msdb[*] [REDACTED]MSCRM[*] querymon[*] tempdb



Database: master[6 tables]+---------------------+| spt_fallback_db     || spt_fallback_dev    || spt_fallback_usg    || spt_monitor         || trace_xe_action_map || trace_xe_event_map  |+---------------------+



The automation run allowed us to:




Identify Database Accounts & Roles: The output confirmed that the database context had DBA-level privileges and identified sa (administrator), representing a severe violation of the principle of least privilege (CWE-269).



Enumerate Databases: sqlmap listed accessible databases, including system databases (master, msdb, tempdb, model) and CRM-related databases such as MSCRM_CONFIG and [REDACTED]_MSCRM.



Extract Table Schemas & Dump Data: We targeted the CRM database schema and dumped tables holding highly sensitive corporate and customer information:




The sanitized sqlmap output below illustrates the types of data exposed during the engagement, including CRM integration tables, API key records, environment labels, and customer identity fields. Sensitive values were redacted.



Database: CrmIntegration[13 tables]+--------------------------------+| ApiKeys || CancelEmail || [REDACTED]ManagePlanIntegration|| [REDACTED] || [REDACTED]ClientsAdditionalInfo|| [REDACTED]Statistics || HttpLogging || Logging || [REDACTED]Integration || [REDACTED] || sysdiagrams || [REDACTED]_contact |+--------------------------------+



Table: ApiKeys+------------------------+------------+-------------+| Name | ExpireDate | Environment |+------------------------+------------+-------------+| [REDACTED]-token-dev |  | dev || [REDACTED]-key |       | prod || [REDACTED]-key-dev |    | dev || [REDACTED] |           | prod || [REDACTED] |            | dev |+------------------------+------------+-------------+



Sample customer identity fields:{"docNumber": "[REDACTED]","lastNameUA": "[REDACTED]","firstNameUA": "[REDACTED]","middleNameUA": "[REDACTED]","birthday": "[REDACTED].1992"}



The exfiltrated database dump included:




Customer Personally Identifiable Information (PII): Full names, dates of birth, tax identification numbers, and passport series/numbers. This dataset is sufficient for synthetic-identity fraud, financial account takeovers, and regulatory breach assessment under applicable privacy laws.



Production API Keys: Active authentication tokens for third-party integrations, payment processors, and shipping systems. These keys were validated during the engagement and allowed direct access to external APIs without further exploitation (MITRE ATT&CK T1552: Unsecured Credentials; T1078: Valid Accounts, where the API keys functioned as valid authentication material)



Internal Business-Process Data: Transaction logs, CRM backend settings, and operational scripts.




At this point, the compromise was already severe. However, the database server configuration and excessive SQL Server privileges allowed for further escalation.



Step 4 — Escalation: From SQL Injection to Remote Code Execution (RCE)



Microsoft SQL Server contains a built-in extended stored procedure called xp_cmdshell. This procedure executes operating system commands and returns their output as rows of text. By default, it is disabled in modern SQL Server installations due to its high potential for abuse.



In this case, xp_cmdshell was disabled. However, because the compromised database context had sysadmin-level privileges, the team was able to reconfigure the SQL Server instance and enable xp_cmdshell through the SQL injection vector.



The escalation was validated by executing a benign whoami-style operating-system command to confirm command execution under the SQL Server service account context. This confirmed that the exploit chain had moved beyond database compromise and resulted in operating-system command execution on the host.



By breaking out of the database context and executing commands directly in the host OS, a malicious actor could:




Execute arbitrary programs and shell scripts on the operating system.



Download and deploy malware, post-exploitation tooling, or ransomware binaries on the server.



Modify or stop services, change system configuration, and manipulate application or database state.



Use the compromised CRM server as an entry point for follow-on activity against the internal corporate network, including lateral movement attempts where network reachability and credentials permit.




This escalation chain is mapped to several MITRE ATT&CK techniques:




T1190: Exploit Public-Facing Application — exploitation of the internet-facing CRM API endpoint.



T1505.001: Server Software Component — SQL Stored Procedures — abuse of SQL Server stored procedures through xp_cmdshell.



T1059.003: Windows Command Shell — Windows command execution through xp_cmdshell.



T1552: Unsecured Credentials — exposed API keys and secrets discovered in the compromised database.




Techniques related to lateral movement, defense evasion, and ransomware deployment should be treated as potential follow-on activity unless validated within the agreed rules of engagement.



The CRM server acted as a classic entry point through a public-facing application. This aligns with the broader industry trend highlighted in the 2025 Verizon Data Breach Investigations Report (DBIR): exploitation of vulnerabilities continues to be a significant driver of breaches, especially where internet-facing systems expose exploitable weaknesses.





Severity Classification







Dimension
Value
Details


CVSS v3.1 Base Score
10.0 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H


Attack Vector (AV)
Network
Exploitable remotely over the internet.


Attack Complexity (AC)
Low
No specialized conditions or obfuscation required.


Privileges Required (PR)
None
Exploitable by unauthenticated, anonymous users.


User Interaction (UI)
None
Requires no actions from legitimate users.


Scope (S)
Changed
The attack crossed security boundaries from the database engine to the operating system.


Confidentiality (C)
High
Complete access to database contents and sensitive application secrets.


Integrity (I)
High
Ability to modify databases, application data, and system configuration due to confirmed administrative control.


Availability (A)
High
Ability to stop services, delete tables, or disrupt the server due to confirmed administrative control.


Primary CWE
CWE-89 (SQL Injection)
Main entry vector.


Stacked CWEs
CWE-209 / CWE-200 (Verbose Error Disclosure), CWE-269 (Improper Privilege Management), CWE-78 (OS command execution primitive through xp_cmdshell)
Vulnerabilities contributing to the escalation chain.


OWASP Top 10 (2025)
A05:2025-Injection
Also related to A02:2025-Security Misconfiguration due to verbose production errors and unsafe database configuration. 







The CVSS score is based on a confirmed unauthenticated SQL injection reachable over the network, full database compromise, excessive SQL Server privileges, and successful transition from the database context to operating-system command execution through xp_cmdshell.



Root Cause Analysis



We identified five distinct control failures that allowed this attack chain to succeed. Removing any single failure would have significantly mitigated the overall impact; addressing multiple would have prevented the exploit entirely:




Direct Concatenation of User Input into SQL Queries (CWE-89): The application constructed queries by directly concatenating raw HTTP input into SQL strings instead of using parameterized queries (prepared statements).



Verbose Error Disclosure in Production (CWE-209 / CWE-200): The web server returned raw database syntax errors to the client. Detailed diagnostic output should be logged securely on the backend, while presenting generic error messages to the client.



Excessive SQL Server Account Privileges (CWE-269):  The database credentials used by the web application were mapped to a user with sysadmin-level privileges. The application only required read/write permissions on specific tables within the MSCRM database.



Ability to Enable and Execute xp_cmdshell Due to Excessive Privileges (CWE-78 / CWE-269): xp_cmdshell was disabled, but the compromised database context had sufficient privileges to reconfigure the SQL Server instance, enable xp_cmdshell, and execute operating-system commands.



Missing or Insufficient Edge-Layer Detection: A WAF could have reduced exposure by detecting common SQL injection payloads and suspicious request patterns. However, WAF controls should be treated as compensating controls and must not replace secure query construction, least-privilege database access, and secure error handling. 




Technical Remediation Guide



The recommendations below are based on the confirmed findings from the penetration test and are intentionally focused on controls that directly reduce the risk of SQL injection exploitation, privilege escalation through SQL Server, and exposure of sensitive CRM data.



1. Use Parameterized Queries and Eliminate SQL String Concatenation



All database queries that process user-controlled input must be refactored to use parameterized queries or prepared statements. User input must never be concatenated directly into SQL command strings.



Parameterized queries ensure that user-supplied values are bound as data parameters rather than concatenated into executable SQL statements. This is the primary remediation for SQL injection and should be implemented in the vulnerable feedback-form endpoint as well as any other API or application component that builds SQL queries dynamically.



Recommended actions:




Refactor the vulnerable POST endpoint to use parameterized queries.



Review the codebase for other dynamic SQL patterns involving string concatenation.



Validate all user-controlled inputs according to expected type, length, format, and business logic.



Treat input validation as an additional control, not as a replacement for parameterized queries.




2. Restrict the Use of xp_cmdshell and SQL Server Reconfiguration Capabilities



xp_cmdshell should remain disabled on production SQL Server instances unless there is a documented and approved business requirement. In this case, the critical issue was not only the presence of xp_cmdshell as a feature, but the fact that the compromised database context had enough privileges to enable and execute it.



Recommended actions:




Ensure xp_cmdshell is disabled on production SQL Server instances.



Review which users can execute sp_configure with RECONFIGURE.



Revoke unnecessary administrative SQL Server privileges from application accounts.



Allow xp_cmdshell only for a clearly defined and restricted set of database administrators, if business-justified.



Monitor attempts to enable or execute xp_cmdshell in production environments. 




3. Enforce Least Privilege for Database and Web Application Accounts



The web application database account must not run with sysadmin, sa, db_owner, or other excessive administrative privileges unless there is a clearly documented and approved requirement. Application accounts should only have the permissions required for their specific business functions.



Recommended actions:




Create dedicated database accounts for the CRM application and its components.



Grant only the required permissions on specific databases, schemas, tables, views, or stored procedures.



Remove access to system databases and administrative stored procedures where not required.



Separate read, write, administrative, and integration roles where possible.



Periodically review database privileges and remove unused or excessive permissions. 




4. Suppress Verbose Database Errors in Production Responses



Production applications must not return raw SQL Server errors, query fragments, table names, column names, stack traces, or internal diagnostic details to users. Detailed errors should be logged securely on the backend and exposed only to authorized engineering or security personnel.



Recommended actions:




Replace raw backend error responses with generic client-facing error messages.



Log detailed diagnostic information in a secured logging platform.



Ensure logs are protected from unauthorized access and integrated into SIEM/monitoring where appropriate.



Review error handling across API endpoints, not only the vulnerable feedback form.




5. Use WAF as a Compensating Edge-Layer Control



A Web Application Firewall (WAF) can help detect and block common SQL injection payloads before they reach backend components. It can also provide visibility into suspicious request patterns and exploitation attempts. However, WAF must be treated as a compensating control, not as a replacement for secure query construction and least-privilege database access.



Recommended actions:




Deploy or tune WAF protections for public-facing CRM endpoints.



Enable SQL injection detection rules and monitor triggered events.



Apply rate limiting and anomaly detection where appropriate.



Review WAF logs together with application, IIS, SQL Server, EDR, and SIEM telemetry during incident investigation.




6. Rotate Exposed Secrets and Review Third-Party Integrations



Because production API keys and integration secrets were exposed and validated during the engagement, they should be treated as compromised. Rotation should include both internal and third-party integration credentials.



Recommended actions:




Rotate exposed API keys, tokens, database credentials, and administrative passwords.



Review access scopes, expiration policies, IP restrictions, and integration permissions.



Revoke unused or overly permissive keys.



Check third-party API logs for unauthorized access or abnormal activity.



Store secrets in a dedicated secrets management solution rather than application databases or configuration tables.




7. Perform Targeted Security Review and Ongoing Monitoring



After remediation, the organization should validate that the vulnerable endpoint is fixed and that similar patterns do not exist elsewhere in the application. This should be supported by targeted retesting, code review, SAST/DAST where applicable, and continuous monitoring.



Recommended actions:




Retest the vulnerable endpoint after remediation.



Scan and review the codebase for similar SQL injection patterns.



Review IIS, application, SQL Server, EDR, and SIEM logs for signs of prior exploitation.



Keep SQL Server, application frameworks, and related technologies updated.



Establish a regular penetration testing and security review cadence for high-value applications such as CRM systems.




Risk-Based Remediation Priorities



The exact remediation timeline depends on the organization’s infrastructure, change-management process, business criticality, regulatory obligations, and operational constraints. However, for a confirmed Critical SQL injection with database compromise, exposed secrets, and operating-system command execution, remediation should be prioritized based on immediate risk reduction.



Priority 1 — Contain the Active Risk




Patch or temporarily disable the vulnerable endpoint: Refactor the feedback submission API to use parameterized queries or temporarily disable the affected functionality until a secure fix is deployed.



Disable xp_cmdshell and lock down reconfiguration paths: Ensure xp_cmdshell is turned off globally and verify that application database accounts cannot re-enable it through sp_configure and RECONFIGURE.



Rotate exposed secrets: Rotate all exposed API keys, tokens, database connection strings, and administrative passwords discovered in the compromised database tables.



Review logs for signs of prior exploitation: Analyze IIS, application, SQL Server, EDR, and SIEM telemetry to determine whether unauthorized entities exploited this vulnerability before the penetration test.




Priority 2 — Reduce the Blast Radius




Enforce least privilege: Review all application database connections and replace overly permissive logins with restricted service accounts.



Remove excessive SQL Server privileges: Remove sysadmin, db_owner, sa, or other excessive privileges from application accounts unless explicitly required and approved.



Restrict administrative stored procedures and system database access: Ensure application accounts cannot access administrative functions or system databases beyond what is strictly required.



Tune WAF and monitoring controls: Configure edge-layer protection to detect, rate-limit, and block common SQL injection payloads and suspicious request patterns. Treat WAF as a compensating control, not as a replacement for secure coding and database hardening.




Priority 3 — Eliminate Similar Vulnerability Patterns




Review the codebase for SQL injection patterns: Search for dynamic SQL queries, string concatenation, unsafe interpolation, and other patterns that may allow user-controlled input to affect SQL command structure.



Refactor vulnerable database interactions: Replace unsafe dynamic SQL with parameterized queries or prepared statements.



Validate user-controlled inputs: Enforce expected type, length, format, and business-logic validation for all API parameters and user-submitted fields.



Retest affected and high-risk endpoints: Validate that the original issue is remediated and that similar input points are not vulnerable. 




Priority 4 — Improve Long-Term Security Maturity




Integrate SAST/DAST into CI/CD where applicable: Add automated scanning to detect security regressions before code reaches production.



Improve secrets management: Store sensitive credentials in a dedicated secrets management solution and enforce rotation, scope limitation, and access control.



Establish a regular security review cadence: Schedule recurring penetration testing and targeted security reviews for high-value applications such as CRM systems.



Conduct threat modeling for critical applications: Run structured threat modeling sessions for CRM systems, customer-facing portals, and other business-critical environments.




Compliance & Regulatory Impact



Exploitation of this vulnerability may trigger significant notification and compliance obligations depending on the affected entity, jurisdiction, data categories, contractual obligations, and whether unauthorized access is confirmed. 







Framework
Relevant Requirements / Areas
Why It Matters


GDPR (EU)
Articles 32, 33, 34
Relevant where personal data is accessed or exfiltrated. May trigger breach assessment, supervisory authority notification, and notification to affected individuals where required.


PCI DSS v4.0 / v4.0.1
Requirement 6.2.4; Requirement 6.5.1; Requirement 11.4
Relevant where the CRM stores, processes, transmits, or can impact systems handling account/cardholder data. Covers secure software development, protection against common software attacks such as SQL injection, change-control discipline, and regular internal/external penetration testing.


SOC 2
CC6; CC7
Relevant where the affected application is part of the audited system boundary. Logical access, monitoring, incident response, and confidentiality controls may be implicated.


NIS2 / DORA (EU)
Incident reporting; ICT risk management
May apply to in-scope essential, important, or financial entities. Obligations depend on sector, jurisdiction, severity, and regulatory thresholds.


ISO/IEC 27001:2022
Clauses 6, 8, 9, 10; Annex A controls where applicable
Relevant where the organization operates or aligns with an ISMS. The finding may indicate gaps in risk treatment, access control, secure development, monitoring, or incident response.


HIPAA (US)
Security Rule; Breach Notification Rule
Relevant only where the CRM stores or processes Protected Health Information (PHI) for a covered entity or business associate.







The key point is simple: a confirmed SQL injection leading to database compromise, exposed secrets, and operating-system command execution is not only a technical issue. In regulated environments, it can become a compliance, notification, contractual, and business-continuity issue.



Broader Lessons for Security Teams




All Input Points Matter: Do not assume that "low-visibility" areas like feedback forms, survey fields, or contact endpoints are secure. Attackers often target inputs that developers assume are safe and do not monitor.



Defense in Depth is Necessary: Security should never rely on a single control. If the application-level validation fails, database-level restrictions, such as disabling xp_cmdshell, preventing application accounts from enabling it, and using non-admin database accounts, should still contain the blast radius. 



Scanners Miss Context: Automated scanners are useful for identifying low-hanging fruit, but they often fail to chain vulnerabilities together. Expert, manual testing is required to identify how a database flaw can lead to operating system compromise.




About Velstadt Offensive Security Practice



Velstadt's penetration testing practice is structured around manual, expert-led testing and chained-exploit thinking. Rather than relying on automated reports, our certified team members (holding OSCP, OSWE, OSCE, and CREST credentials) analyze your applications to find the systemic flaws that automated scanners miss.



Velstadt is recognized as the #1 Cybersecurity Company in Ukraine (2025 TechBehemoths) and listed among the top software testing and security companies in New York City (2025, 2026 Clutch).





Frequently Asked Questions (FAQ)



What is a SQL injection vulnerability?



SQL injection (CWE-89) occurs when an application takes user-controlled input and combines it directly with a SQL command string without proper parameterization. This allows an attacker to manipulate the structure of the SQL query, enabling them to read, write, modify, or delete database records, bypass authentication, and potentially execute system-level commands on the underlying server when additional misconfigurations or excessive privileges are present. 



Why is xp_cmdshell considered a high-risk feature?



xp_cmdshell is an extended stored procedure built into Microsoft SQL Server that allows users with sufficient privileges, typically sysadmin, to execute arbitrary operating system shell commands. If an attacker gains administrative database access through SQL injection or credential leakage, they may be able to enable and execute xp_cmdshell, break out of the database engine, access the host operating system, download malicious tools, and pivot across the corporate network.



Can a Web Application Firewall (WAF) completely block SQL injections?



A Web Application Firewall (WAF) is an effective layer of defense that can detect and block common SQL injection patterns. However, WAFs can sometimes be bypassed using payload encoding, SQL dialect variations, or application-specific logic. A WAF should be used as a supplementary defense tool, not as a replacement for parameterized database queries.



What are the main benefits of parameterized queries?



Parameterized queries (or prepared statements) ensure that the database engine treats user input strictly as data, never as executable SQL code. Even if an input contains SQL commands, quotes, or semicolons, the database driver safely processes the input as a literal string parameter, neutralizing SQL injection vectors.



References and Sources




OWASP: SQL Injection Prevention Cheat Sheet



OWASP: Web Security Testing Guide



OWASP Top 10 (2025): A05:2025-Injection



PortSwigger Academy: SQL Injection Explained



Microsoft Learn: xp_cmdshell Server Configuration Option



NIST SP 800-115: Technical Guide to Information Security Testing and Assessment



ISO/IEC 27001:2022



GDPR (EU)



PCI Security Standards Council: PCI DSS v4.0.1



FIRST: CVSS v3.1 Specification Document



CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command



CWE: CWE-209:  Generation of Error Message Containing Sensitive Information



CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor



CWE: CWE-269: Improper Privilege Management



CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command



MITRE ATT&CK: T1190 - Exploit Public-Facing Application



MITRE ATT&CK: T1505.001 — Server Software Component: SQL Stored Procedures



MITRE ATT&CK: T1059.003 — Windows Command Shell



MITRE ATT&CK: T1552 — Unsecured Credentials



MITRE ATT&CK: T1078 — Valid Accounts



Verizon:2025 Data Breach Investigations Report (DBIR)




 

#### Exposed WSO2 SOAP Services and Path Traversal: How a File Management Endpoint Led to Unauthenticated Local File Read
Enterprise integration platforms often expose more functionality than security teams expect: legacy SOAP services, service discovery pages, file-handling operations, internal methods, and integration endpoints that may not have been designed for direct internet exposure.

When these components are deployed without strict access control and input validation, a single exposed method can become a direct path to sensitive system files.

In one recent penetration test, Velstadt’s offensive security team identified a high-impact vulnerability in a deployment based on WSO2 services that allowed unauthenticated access to sensitive internal files.

The issue was caused by an exposed SOAP endpoint that did not properly validate user input and did not require authentication, creating a direct entry point into the system. During the initial reconnaissance phase, the team also discovered that the /services endpoint was publicly accessible. This endpoint provided a full listing of available services and methods, effectively exposing the internal attack surface of the application.

Such visibility makes it significantly easier for an attacker to understand how the system works and identify potentially dangerous functionality without prior knowledge or valid access.

This case study explains how an exposed WSO2 SOAP service, weak access control, and insufficient path validation resulted in unauthenticated local file read through path traversal. The engagement is anonymized, and technical details are preserved for educational purposes.

TL;DR — Key Takeaways

Vulnerability: Unauthenticated path traversal in a WSO2 SOAP-based file management service.

Impact: An external attacker could read sensitive local files from the underlying operating system.

Discovery path: A publicly accessible /services endpoint exposed available services and operations, helping identify file-handling functionality.

Root cause: The service accepted a user-controlled file_name parameter and returned file contents without proper authentication or path validation.

Sensitive exposure: The team was able to retrieve the system’s .bash_history file, which may contain commands, credentials, tokens, internal paths, and operational details.

Risk level: High-impact and potentially critical, depending on accessible files, exposed secrets, service privileges, and the surrounding infrastructure.

Main lesson: File-handling functionality should not be exposed without authentication, authorization, strict input validation, and controls that ensure requested files remain within an approved directory.

Why This Finding Matters

Path traversal vulnerabilities are sometimes underestimated because they may appear less severe than vulnerabilities that immediately result in remote code execution. However, when a vulnerable service can read sensitive local files, the practical impact can be significant.

A local file read issue may expose configuration files, credentials, application secrets, logs, shell history, private keys, source code, deployment paths, or internal system details. This information may help an attacker better understand the environment and identify follow-on attack paths.

In this case, the risk was increased by three conditions:

the service was reachable over the network;

the vulnerable file management operation did not require authentication;

the /services endpoint exposed available services and methods, reducing the effort required to identify sensitive functionality.

Individually, each condition increases exposure. Combined, they created a direct path from external reconnaissance to unauthorized local file access.

Engagement Context

The target environment used WSO2-based services to support enterprise integration and service exposure.

During the assessment, Velstadt focused on externally reachable functionality, exposed service methods, authentication boundaries, and whether available operations could be abused to access local files or sensitive system resources.

The finding demonstrates why integration platforms and SOAP-based services should be reviewed as part of the organization’s external attack surface, not only as backend middleware.

Technical Breakdown

Step 1 — Discovering the Public /services Endpoint

During reconnaissance, the /services endpoint was found to be publicly accessible.

This endpoint provided a listing of deployed services and available methods. From an attacker’s perspective, this type of exposure reduces uncertainty: instead of guessing available operations, the attacker can directly review what the platform exposes.

A public service listing is not always a vulnerability by itself. However, it can become a meaningful risk multiplier when it exposes sensitive operations or when access control is inconsistent.

Step 2 — Identifying File Management Functionality

The vulnerable functionality was part of a file management service that accepted a file name parameter and returned its contents.

This type of feature requires careful security design. Any service that reads files based on user-controlled input should enforce authentication, authorization, strict input validation, and safe file path handling.

In this case, the service accepted a file_name parameter. Because the parameter was not properly sanitized, it was possible to manipulate the requested path using directory traversal sequences.

Step 3 — Exploiting Path Traversal Through SOAP

By sending crafted SOAP requests, the team was able to move outside the intended directory and access files from the underlying operating system.

The vulnerable SOAP endpoint allowed the file path parameter to be modified using traversal patterns such as:

../../../../

By injecting traversal sequences into the file_name parameter, the request could escape the intended application directory and retrieve files from other parts of the server.

This is best described as path traversal leading to local file read.

Although some teams may broadly describe this type of issue as LFI, the confirmed behavior in this case is more accurately classified as path traversal / directory traversal leading to local file read. The engagement confirmed unauthorized access to local files, not local file inclusion, remote file inclusion, or code execution in the application runtime.

Step 4 — Reading Sensitive Local Files

One of the most impactful findings was the ability to retrieve the contents of the system’s .bash_history file.

This file can contain previously executed shell commands. In real environments, shell history may accidentally expose credentials, access tokens, API keys, internal paths, hostnames, database connection strings, deployment commands, administrative scripts, or other operational details.

Access to this information can significantly increase an attacker’s understanding of the environment. Even if the file does not contain active credentials, it may still reveal how systems are administered and which internal components may be worth targeting next.

Severity Classification

The exact severity depends on the environment, the privileges of the service account, the sensitivity of accessible files, and whether exposed data includes valid credentials or secrets.

Severity FactorAssessmentAttack VectorNetwork / Web-accessible SOAP endpointAuthentication RequiredNoneUser InteractionNoneAttack ComplexityLow once the exposed service and vulnerable parameter are identifiedConfirmed ImpactUnauthorized local file readPotential ImpactExposure of credentials, tokens, internal paths, configuration files, operational details, and information useful for follow-on attacksPrimary WeaknessPath traversal / directory traversal in an unauthenticated SOAP file management serviceContributing MisconfigurationPublicly accessible /services listing and exposed SOAP functionality without authenticationPractical OutcomeLocal file readRisk LevelHigh-impact; potentially critical depending on accessible files, exposed secrets, service privileges, and surrounding infrastructure

This finding should be prioritized for remediation because the affected SOAP functionality was externally reachable, did not require authentication, and allowed unauthorized access to sensitive local files.

Root Cause Analysis

The finding resulted from several control failures occurring together:

Public exposure of service discoveryThe /services endpoint was accessible without restriction and exposed available services and methods.

Missing authentication on sensitive functionalityThe exposed SOAP file management functionality did not require authentication.

Insufficient validation of the file_name parameterThe service accepted a user-controlled file name parameter and returned file contents without properly sanitizing the input.

Lack of safe path enforcementDirectory traversal sequences allowed the request to move outside the intended directory instead of being constrained to an approved file location.

Technical Remediation Guide

The recommendations below focus on the confirmed weakness: unauthenticated path traversal in exposed WSO2/SOAP file-handling functionality, which allowed unauthorized local file read.

1. Restrict Exposure of Service Discovery and SOAP Endpoints

Public service listings and SOAP methods should be restricted unless there is a clear operational requirement to expose them.

Recommended actions:

restrict access to /services to trusted networks, authenticated users, or approved service consumers;

disable public service listing if it is not required;

review exposed WSO2 services and remove unused or legacy methods;

ensure internal-only services are not publicly reachable;

monitor access attempts to service discovery endpoints, especially from unknown sources or unusual user agents.

2. Require Authentication and Authorization for File-Handling Operations

File retrieval functionality should not be available to anonymous users.

Recommended actions:

enforce authentication on the affected SOAP file management functionality;

apply authorization checks before returning file contents;

ensure users or service consumers can access only files they are explicitly allowed to retrieve;

log successful and failed file access attempts.

3. Implement Safe Path Handling

Simple string filtering is not sufficient for path traversal prevention. A safer implementation should ensure that user-controlled input cannot escape the approved file location.

Recommended actions:

resolve requested files to canonical absolute paths;

verify that the resolved path remains inside an approved base directory;

reject absolute paths;

reject unexpected paths, traversal sequences, and encoded traversal variants after normalization/canonicalization;

use allowlists of expected file names or server-side file identifiers where possible;

avoid passing raw user input directly into file system APIs.

4. Review Exposed Files and Rotate Affected Secrets

Because the testing team was able to retrieve .bash_history, the organization should verify whether sensitive operational data was exposed. Shell history files may contain executed commands, credentials, tokens, internal paths, and other operational details that can support follow-on attacks.

Recommended actions:

review retrieved and potentially accessible files for credentials, tokens, keys, and internal details;

rotate any secrets that may have been exposed;

remove secrets from shell history and operational scripts;

review configuration files for hardcoded credentials and migrate them to a dedicated secrets management solution;

review whether the service account has unnecessary read access to sensitive files.

5. Add Detection and Monitoring

Preventive fixes should be supported by monitoring for similar exploitation attempts. WAF or reverse proxy rules can help detect and block common path traversal payloads as an additional defense layer. However, they should not replace the primary fix: authentication, authorization, and safe path handling in the affected application logic.

Recommended actions:

monitor for traversal patterns such as ../, encoded path separators, and unusual file names;

configure WAF or reverse proxy rules to detect and, where appropriate, block common path traversal payloads;

alert on attempts to access sensitive files such as .bash_history, /etc/passwd, SSH keys, environment files, and application configuration files;

correlate WSO2 logs with relevant telemetry sources, such as reverse proxy, WAF, EDR, and SIEM logs where available;

review historical logs to determine whether similar requests occurred before the penetration test.

Remediation Priorities

Priority 1 — Reduce Immediate Exposure

Restrict or temporarily disable access to the vulnerable SOAP endpoint, restrict public access to /services, require authentication for file management operations, review recent logs for suspicious file access attempts, and configure WAF or reverse proxy rules to detect and, where appropriate, block common path traversal payloads as an additional defense layer while the application-level fix is being implemented.

Priority 2 — Fix the Vulnerable Logic

Implement safe path validation, ensure resolved paths remain inside an approved directory, reject traversal payloads and encoded variants after normalization/canonicalization, and replace direct file name input with controlled server-side file identifiers where possible.

Priority 3 — Limit the Impact of Similar Issues

Review file permissions, reduce privileges of the service account, rotate exposed credentials or tokens, remove secrets from shell history and operational scripts, and review configuration files for hardcoded credentials.

Priority 4 — Improve Long-Term Resilience

Review WSO2 hardening configuration, include SOAP services and legacy endpoints in future penetration testing scope, document ownership of exposed services, and improve centralized logging and alerting for suspicious service access.

Frequently Asked Questions (FAQ)

Can authentication alone fix this issue?

No. Authentication reduces exposure, but it does not fix unsafe file handling. If the application still accepts user-controlled file paths without safe validation, an authenticated user may still be able to abuse the same path traversal flaw. The fix should combine authentication, authorization, and safe path validation.

How can developers prevent path traversal in file-handling functionality?

Developers should avoid passing raw user input directly into file system operations. A safer approach is to use server-side file identifiers, allowlists of expected files, canonical path validation, and checks that ensure the resolved file path remains inside an approved directory.

Should service discovery endpoints be disabled completely?

Not always. Some environments may need service discovery for operational reasons. However, service listings should not be publicly accessible by default. Access should be restricted to trusted users, trusted networks, or approved service consumers.

Can a WAF be enough to prevent this type of vulnerability?

No. A WAF or reverse proxy can help detect and block common traversal payloads, but it should be treated as an additional defense layer. The primary fix is secure application logic: authentication, authorization, safe path handling, and least-privilege access.

References and Sources

OWASP: Path Traversal

PortSwigger: File path traversal 

OWASP WSTG: Testing Directory Traversal File Include

OWASP: Input Validation Cheat Sheet

NIST SP 800-115: Technical Guide to Information Security Testing and Assessment

CWE-22: Improper Limitation of a Pathname to a Restricted Directory

CWE-306: Missing Authentication for Critical Function

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

MITRE ATT&CK: T1083 — File and Directory Discovery

MITRE ATT&CK: T1552 — Unsecured Credentials

#### From Exposed elFinder to Remote Code Execution: How an Unauthenticated File Manager Led to Server Compromise
A critical server compromise does not always require a zero-day or a critical software vulnerability. Sometimes, an exposed administrative tool is enough.

During an authorized penetration test of client assets, Velstadt’s offensive security team identified a critical exposure that could allow an external attacker to fully compromise a server and reach sensitive data.

While mapping the external attack surface, our team discovered an additional public resource that exposed the web file manager elFinder without any authentication. Because elFinder provides direct file system management features, an unauthenticated user could browse server directories, view and edit files, and upload arbitrary content.

In practice, this meant the application itself became the exploitation mechanism, without the need for complex vulnerability research.

This anonymized case study explains how the exposure was discovered, how remote code execution was validated, and what security teams should do to prevent similar findings in their own environments.

TL;DR — Key Takeaways

Finding: An unauthenticated elFinder web file manager was publicly accessible.

Impact: An attacker could browse directories, edit files, upload arbitrary content, and execute code on the server.

RCE Validation: A PHP web shell was uploaded to a web-accessible directory, confirming command execution under the permissions of the web service account.

Post-Exploitation Risk: The team demonstrated an interactive reverse shell and SSH key-based persistence.

Credential Exposure Paths: Database credentials were recovered from wp-config.php, while public phpinfo() files exposed environment and configuration information useful to attackers.

Sensitive Data Exposure: The team accessed two databases containing password hashes for administrative accounts, confidential user information, and other internal records.

Severity: Critical. The combination of no authentication, low exploitation effort, remote code execution, persistence, and database access could lead to full host compromise.

Root Cause: A powerful administrative file-management component was published without proper access control, while executable uploads, debug artifacts, and server-side secrets were not sufficiently restricted.

The Engagement Context

The target environment included public-facing web assets that were in scope for an authorized penetration test. The objective was to identify externally reachable weaknesses that could create material business risk, including unauthorized access, data exposure, server compromise, and potential paths to deeper infrastructure impact.

In this case, the key risk came from an administrative file manager exposed to the internet without authentication.

Technical Breakdown

Step 1 — Reconnaissance: Discovering the Exposed File Manager

The exposed elFinder instance was identified during reconnaissance as an additional public resource within the assessed attack surface.

What made this finding immediately high-risk was the level of functionality available without authentication. The interface exposed file-system operations normally reserved for trusted administrators: directory browsing, file viewing, file editing, and file upload.

From an attacker’s perspective, this type of exposure removes much of the uncertainty from exploitation. Instead of searching for a complex application vulnerability, the attacker can use the exposed administrative functionality directly.

In other words, the issue was not only that an administrative interface was visible. The issue was that it provided enough control over the file system to become a direct path to exploitation.

Step 2 — Validating Remote Code Execution

To validate the real business impact, the team used the exposed file manager to upload a PHP web shell into a web-accessible directory.

Once the file was reachable through the web server, it was possible to execute commands on the host under the permissions of the web service account. This confirmed that the issue was not limited to unauthorized file access or file modification. It resulted in remote code execution.

From a real-world attacker perspective, this is the turning point where the incident shifts from a “website issue” to a “server breach.” Code execution can enable data theft, persistence, privilege escalation, and potential lateral movement where credentials and network paths permit.

The confirmed issue should be described precisely: remote code execution through an exposed file manager and executable file upload. Unless a specific vulnerable elFinder version or CVE is confirmed, the article should not claim that elFinder itself contained an RCE vulnerability.

Step 3 — Demonstrating Persistence Risk

After establishing initial execution capability through the uploaded web shell, we demonstrated how an attacker could maintain longer-term access to the compromised host.

Within the agreed scope of the engagement, the web shell was used to initiate an outbound connection from the affected server to a controlled testing host, resulting in an interactive reverse shell. The team then added an SSH public key to enable SSH-based access where the SSH service was reachable.

This persistence path is particularly dangerous because removing the exposed web component alone may not remove attacker access. If host-level changes are not reviewed, unauthorized SSH keys, web shells, modified files, or other persistence artifacts may remain after the initial web application issue is fixed.

Detection should therefore include both outbound reverse-shell behavior and host-level indicators such as changes to authorized_keys, unusual SSH logins, suspicious file modifications, and unexpected processes spawned by the web service account.

Step 4 — Accessing Sensitive Databases

During further post-exploitation activity, we were able to access two databases containing sensitive information.

The data observed included password hashes for administrative accounts, confidential user information, and other internal records. The database credentials required to authenticate to these systems were recovered through multiple exposure paths on the server.

In particular, the WordPress configuration file wp-config.php contained database access details, while publicly accessible phpinfo() files revealed environment and configuration information that can significantly assist attackers in locating secrets, understanding the server layout, and identifying connected services.

Even when password hashes are stored instead of plaintext passwords, they still represent a serious risk. Attackers may attempt to crack them offline, use recovered passwords in credential-stuffing attacks, or support privilege escalation across the environment. Administrative password hashes are especially valuable because cracked or reused administrator passwords may provide access to higher-impact systems.

Why This Finding Matters

This finding was classified as Critical because it combined three high-risk conditions: public unauthenticated access, executable file upload, and confirmed command execution on the server.

The impact extended beyond file management. The team demonstrated persistence risk and accessed sensitive databases, which means this issue could support full host compromise in a real-world attack scenario.

From a risk perspective, this exposure could lead to:

Complete compromise of the affected host.

Theft or manipulation of user data.

Exposure of administrative password hashes and database credentials.

Service disruption.

Deployment of additional malicious tools.

Further compromise of connected systems if shared credentials or trusted network paths exist.

This is the kind of finding that security teams should treat as a breach-enabling condition, not simply as a web application misconfiguration.

Severity Classification

A formal CVSS score should be calculated based on the exact production context, exposed attack surface, privileges, confirmed impact, and environmental factors. However, based on the confirmed exploitation path, this issue fits a Critical severity rating.

Severity FactorAssessmentAttack VectorNetworkAttack ComplexityLowPrivileges RequiredNoneUser InteractionNoneConfirmed ImpactRemote code execution, persistence, database accessConfidentiality ImpactHighIntegrity ImpactHighAvailability ImpactPotentially HighBusiness RiskFull host compromise and sensitive data exposure

Root Cause Analysis

The exploit path was enabled by several control failures.

1. Public Exposure of an Administrative File Manager

The elFinder instance was accessible from the internet without authentication. Because file managers provide high-risk administrative functionality, they should not be exposed publicly without strong access control.

2. Executable Uploads to a Web-Accessible Directory

The exposed file manager allowed a PHP file to be uploaded into a location where it could be executed by the web server. This transformed file upload capability into remote code execution.

3. Insufficient Separation Between Managed Files and Executable Paths

Uploaded or managed content should not automatically become executable server-side code. Environments should separate user-manageable files from executable application paths wherever possible.

4. Exposed Configuration and Debug Artifacts

The presence of accessible configuration data and public phpinfo() pages increased the attacker’s ability to discover secrets, understand the environment, and access connected databases.

5. Insufficient Detection of Post-Exploitation Activity

The ability to upload a web shell, establish a reverse shell, and add SSH-based access highlights the need for effective file integrity monitoring, outbound connection monitoring, and administrative activity detection.

Technical Remediation Guide

1. Remove or Restrict Public Access to elFinder

The exposed elFinder instance should be disabled or removed from public access immediately.

If the tool is still required for business or administrative purposes, access should be restricted to authenticated administrators only. Ideally, it should be placed behind a VPN, Zero Trust access layer, or strict IP allow-listing, with MFA enforced wherever possible.

Recommended actions:

Remove public access to the elFinder instance.

Require strong authentication and MFA for administrative access.

Restrict access by network location where possible.

Review whether the tool is still needed in production.

Disable the component entirely if there is no approved operational requirement.

2. Prevent Executable File Uploads

Upload and edit capabilities must be hardened so that executable content cannot be placed in web-accessible directories.

Recommended actions:

Enforce a strict allow-list of permitted file types based on business need.

Block server-side executable file types such as .php, .phtml, .phar, .cgi, .pl, .jsp, and similar formats depending on the technology stack.

Store uploaded files outside the web root where possible.

Configure the web server to prevent script execution in upload and user-managed directories.

Validate file extension, MIME type, and file content server-side.

Do not rely on client-side validation as a security control.

3. Remove phpinfo() and Debug Artifacts from Production

Public phpinfo() pages and debug files should not exist in production environments. They may disclose environment variables, paths, modules, server configuration, and other information that helps attackers refine exploitation.

Recommended actions:

Remove public phpinfo() files.

Search the web root for debug scripts, test files, backups, and temporary files.

Disable verbose production diagnostics.

Ensure sensitive configuration details are logged only in protected backend systems.

Review deployment processes to prevent debug artifacts from reaching production.

4. Protect Configuration Files and Secrets

Because the compromise path enabled credential exposure, all potentially affected secrets should be treated as compromised.

Recommended actions:

Rotate database passwords.

Rotate administrative credentials.

Rotate application secrets and API tokens.

Review WordPress and plugin configuration files for exposed credentials.

Move secrets to a dedicated secrets management solution where possible.

Restrict file permissions so the web service account cannot access unnecessary secrets.

5. Hunt for Persistence and Web Shells

Removing the exposed file manager is not enough if an attacker already used it.

Security teams should review the affected host for persistence mechanisms, unauthorized SSH keys, modified files, suspicious PHP scripts, scheduled tasks, unknown services, and abnormal outbound connections.

Recommended actions:

Search web directories for recently created or modified executable files.

Review SSH authorized_keys files for unauthorized entries.

Check system users, cron jobs, services, and startup scripts.

Review web server logs for web shell access patterns.

Review outbound network connections from the server.

Use EDR where available, SIEM, and file integrity monitoring to support investigation.

6. Improve Detection and Monitoring

Detection should focus on both the initial abuse and the post-exploitation activity that follows.

Recommended detections:

File creation or modification in web-accessible directories.

Upload of executable file extensions.

Web server execution of unusual PHP files.

Unexpected outbound connections from the web server.

Reverse shell-like network behavior.

SSH logins from unusual sources.

Unauthorized changes to SSH authorized_keys files.

Access to wp-config.php or other configuration files.

Public access attempts to phpinfo() or debug endpoints.

A WAF can help detect suspicious requests and exploitation attempts, but it should not be treated as the primary fix. The primary remediation is to remove public administrative exposure, enforce authentication, and prevent executable uploads.

Risk-Based Remediation Priorities

Priority 1 — Contain the Active Risk

Disable or restrict the exposed elFinder instance.

Remove web shells and suspicious executable files.

Disable script execution in upload and user-managed directories.

Rotate database passwords, administrative credentials, and other potentially exposed secrets.

Review SSH access and remove unauthorized keys.

Review recent outbound connections and unusual processes from the affected host.

Priority 2 — Clean Up the Exposure

Remove public phpinfo() pages, debug files, backups, and test artifacts.

Review web root permissions and configuration file access.

Validate that similar administrative tools are not exposed elsewhere.

Restrict administrative interfaces behind strong authentication, MFA, IP allow-listing, VPN, or Zero Trust Access where appropriate.

Review and tune WAF or edge-layer rules to detect and block suspicious file upload, web shell, and exploitation attempts as part of a long-term defense-in-depth strategy. These controls should complement, not replace, application and server-side fixes.

Priority 3 — Investigate and Harden

Review logs for signs of prior exploitation.

Investigate suspicious file changes, outbound connections, unusual SSH activity, and unexpected processes spawned by the web service account.

Retest the affected path after remediation.

Use EDR where available to support host-level investigation and detect web shell or reverse shell behavior.

Integrate relevant host, web server, SSH, database, EDR, WAF, and access-control logs into SIEM.

Add file integrity monitoring for critical web directories and configuration files.

Business Impact

A finding like this can create more than a technical incident. If sensitive personal data, administrative credentials, or customer records are exposed, the organization may need to perform a formal breach assessment depending on its jurisdiction, contractual obligations, industry, and data categories.

From a business perspective, unauthenticated access to a file manager that leads to remote code execution, persistence, and database access should be treated as a serious risk. It may affect incident response, customer trust, contractual obligations, regulatory assessment, and business continuity.

The exact compliance impact depends on the affected data, systems, geography, and regulatory scope. Security teams should involve legal, compliance, and incident response stakeholders when sensitive data or privileged access is confirmed.

FAQ

Is this an elFinder vulnerability?

Not necessarily. Based on the confirmed evidence, the safer wording is that an exposed elFinder instance led to remote code execution. Unless a specific vulnerable elFinder version or CVE is confirmed, the article should not claim that elFinder itself contained a software vulnerability.

In this case, the confirmed risk came from deployment and access-control conditions: the file manager was reachable without authentication, allowed file-system operations, and enabled upload of executable content into a web-accessible location.

Why is phpinfo() dangerous in production?

phpinfo() can expose configuration details, environment information, enabled modules, file paths, PHP settings, server variables, and other technical data that helps attackers understand the system.

On its own, a public phpinfo() page may not provide direct compromise. However, during exploitation it can help attackers identify application paths, loaded extensions, environment-specific configuration, and connected services. This information can make it easier to locate secrets, understand the server layout, and refine follow-on attacks.

Are password hashes really sensitive?

Yes. Password hashes are sensitive even when plaintext passwords are not exposed. Attackers can use open-source cracking tools and wordlists to attempt offline password recovery, especially when weak passwords, reused passwords, or outdated hashing algorithms are involved. If a password is recovered, it can be used for credential stuffing, privilege escalation, or access to other systems where the same password was reused.

In some environments, stolen hashes may also support hash-based authentication attacks, such as Pass-the-Hash in Windows infrastructure. That is why administrative password hashes should be treated as high-risk secrets and investigated as part of credential exposure.

References and Sources

OWASP Web Security Testing Guide

OWASP File Upload Cheat Sheet

OWASP Top 10 2025: A01 — Broken Access Control

OWASP Top 10 2025: A02 — Security Misconfiguration

CWE-434: Unrestricted Upload of File with Dangerous Type

CWE-306: Missing Authentication for Critical Function

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

MITRE ATT&CK: T1190 — Exploit Public-Facing Application

MITRE ATT&CK: T1059 — Command and Scripting Interpreter

MITRE ATT&CK: T1505.003 — Server Software Component: Web Shell

MITRE ATT&CK: T1098.004 — Account Manipulation: SSH Authorized Keys

FIRST: CVSS v3.1 Specification Document

NIST SP 800-115: Technical Guide to Information Security Testing and Assessment

#### How Email Attacks Disrupt Business: A Practical Guide to Email Security
Introduction

Email-based attacks continue to grow steadily year over year. For organizations, this is no longer just another cybersecurity challenge — it is a direct question of business continuity and operational resilience.

According to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), more than 90% of successful cyberattacks begin with a phishing email, making email the primary initial access vector. Credential theft, compromise of information assets, malware deployment, and even full-scale infrastructure encryption frequently originate from a single email message that bypasses technical or human controls.

Threat actors continuously refine social engineering techniques, carefully adapt their tactics to specific business processes, and actively leverage artificial intelligence. AI-powered tooling enables attackers to generate highly convincing messages at scale, personalize attacks based on publicly available or compromised data, and dynamically adjust content to evade both user suspicion and automated detection mechanisms.

In the context of hybrid warfare and increasing geopolitical tension, organizations face not only mass cybercrime campaigns but also targeted, state-sponsored operations. These campaigns are often long-running, well-resourced, and focused on disrupting critical business processes rather than achieving quick financial gain. Under such conditions, maintaining basic cyber hygiene is no longer sufficient — organizations must adopt a systematic, risk-based approach to email security.

This article explains how the most common attacks targeting corporate email impact business operations, why email remains a preferred entry point for attackers, and why investment in email security should be viewed as a direct investment in business resilience and continuity.

1. Business Email Compromise (BEC)

What It Means for Business

Business Email Compromise (BEC) is a targeted attack in which threat actors impersonate executives, business partners, vendors, or customers to manipulate employees into executing financial transactions or disclosing sensitive business information.

Unlike mass phishing campaigns, BEC attacks are highly personalized. Attackers spend time studying the organization’s structure, communication patterns, approval chains, and internal workflows. They know who authorizes payments, how financial requests are typically phrased, when executives are traveling or unavailable, and which departments are most likely to comply with urgent requests.

The Real Cost of BEC

The business impact of BEC attacks is well documented and consistently severe.

In 2019, Nikkei, Japan’s leading financial news organization, lost $29 million as a result of a single BEC incident. An attacker successfully impersonated an executive of an international company and convinced employees to transfer funds to a fraudulent bank account.

According to the IBM Cost of a Data Breach Report 2022, Business Email Compromise is the second most expensive type of security incident, with an average total cost of $4.89 million per incident. This figure includes costs associated with detection, investigation, response, recovery, operational disruption, and reputational damage.

Data from the FBI Internet Crime Complaint Center (IC3) further illustrates the scale of the problem. In the United States alone, BEC attacks resulted in direct financial losses of $2.7 billion in 2022. Subsequent IC3 reports show that the threat remains persistently high, with reported losses of $2.95 billion in 2023 and $2.77 billion in 2024. These figures confirm that BEC is not a short-term trend but a systemic, long-term risk to businesses.

Why BEC Works

Traditional technical controls are often ineffective against BEC attacks. Messages typically originate from legitimate or lookalike email addresses, contain no malicious attachments or links, and therefore bypass many email security filters.

Instead, BEC relies on social engineering techniques such as urgency, authority, and trust, combined with a deep understanding of internal business processes. Requests often appear plausible and contextually correct, making them difficult for employees to question.

For organizations, this leads to a critical conclusion: even best-in-class security technology cannot compensate for weak or nonexistent financial verification processes. If a payment or sensitive action can be executed based solely on a single email request, the organization remains fundamentally vulnerable.

How to Defend Against BEC

BEC cannot be mitigated by technology alone. Effective protection requires a coordinated combination of clearly defined processes, independent verification mechanisms, and a strong security culture.

Financial Verification Processes

Implement mandatory dual approval for all payments above a defined threshold. Any request to transfer funds, change banking details, or onboard a new vendor must be reviewed and approved by more than one authorized individual.

All financial requests must be verified via an independent, out-of-band communication channel. This may include a phone call, secure messaging platform, or internal ticketing system.

Critically, verification must rely on contact details already stored in corporate records. Phone numbers or contact information provided in an email request should never be used for confirmation, as attackers frequently include fraudulent contact details.

Establish clear procedures for urgent or exceptional payment requests. Claims of urgency from executives such as a CEO or CFO should trigger additional verification steps rather than accelerate approval workflows.

Technical Controls

Enable external email tagging to clearly indicate when a message originates outside the organization, even if the sender name or address appears familiar.

Deploy protection against domain spoofing by monitoring the registration of lookalike domains similar to your own (for example, ve1stadt.com, velstadt.co) and blocking or quarantining emails originating from such domains.

Properly configure SPF, DKIM, and DMARC to protect corporate domains from spoofing. Email gateways should enforce DMARC policies and automatically quarantine or block messages that fail authentication checks.

Monitor for indicators of account compromise, including unusual login times, suspicious changes to mailbox rules, unexpected forwarding configurations, or anomalous email-sending behavior.

Security Awareness and Training

Conduct targeted BEC simulations rather than generic phishing tests. Training scenarios should reflect real business workflows, such as urgent executive payment requests, vendor banking detail changes, or customer document requests.

Educate employees on common BEC red flags, including:

Unusual or artificial urgency.

Requests to bypass established procedures.

Changes in writing style, tone, or language quality.

Requests for sensitive information without sufficient context.

Foster a culture in which verification is considered a standard business practice rather than a sign of mistrust. Employees should feel empowered to directly confirm requests with executives or partners.

Monitoring and Incident Response

Monitor financial transactions for anomalies such as sudden changes in beneficiary details, the appearance of new payees, or payment amounts that deviate from normal patterns.

Establish a clear escalation and response process for suspected fraud, including immediate payment suspension, internal investigation, and executive notification.

Regularly review and audit access rights to financial systems. A compromised account with payment initiation or approval privileges represents a direct and immediate business risk.

Critical Point

BEC targets people and processes rather than technology. Even the most advanced email security gateway will not prevent fraud if financial operations rely on trust without verification. Protection against BEC must be embedded into daily operational workflows and enforced consistently across all levels of the organization, including senior management.

2. Email Spoofing

What It Means for Business

Email spoofing is an attack in which threat actors forge the sender address to make emails appear as if they originate from a trusted source: a partner, bank, executive, or vendor. The email may contain phishing links, malware, or payment requests.

The core risk is trust. When a message looks legitimate, employees act without suspicion: opening attachments, clicking links, or providing access to systems.

Email spoofing is a common technique used in phishing attacks, combining technical sender impersonation with social engineering. Consequences may include account compromise, data breaches, financial loss, or use of spoofing as an initial access vector for more severe attacks such as ransomware.

For businesses, this represents not just a technical incident but a risk of operational disruption, reputational damage, and regulatory exposure, especially when customer data or financial transactions are involved.

How to Defend Against Spoofing

Technical controls form the foundation, but without organizational processes they are insufficient.

Technical Controls

Implement SPF, DKIM, and DMARC to authenticate email at the infrastructure level and block most automated spoofing attacks before delivery.

Use advanced email security solutions that analyze technical and behavioral signals, sender and domain reputation, and spoofing patterns.

Enforce multi-factor authentication (MFA) across all critical systems to limit impact even if credentials are compromised.

Organizational Controls

Train employees to identify spoofing indicators such as lookalike domains, header inconsistencies, unexpected attachments or links, and lack of contextual relevance.

Run regular phishing simulations focused on building reflexes, not punishment.

Monitoring and Response

Monitor for lookalike domain registrations.

Establish a clear incident response workflow for suspicious emails.

Critical Point 

Spoofing is a persistent threat. Effective defense requires alignment between technology, processes, and people, not reliance on a single control.

3. Spam

What It Means for Business

Spam is unsolicited bulk email sent to corporate mailboxes without recipient consent. While often perceived as low risk, spam creates operational overhead, increases cognitive load on employees, and raises the likelihood of missing real threats.

How to Defend Against Spam

Effective spam protection requires a combination of layered filtering technologies and disciplined organizational practices.

Technical Controls

Deploy multi-layered spam filtering. Modern anti-spam solutions leverage machine learning to analyze message content, sender reputation, and behavioral patterns. When properly configured, these controls can block more than 95% of spam before it reaches user inboxes.

Use greylisting techniques to temporarily reject emails from unknown senders. Legitimate mail servers automatically retry delivery, while many spam bots do not, making this an effective control against automated bulk mail.

Enable protection against bulk mailing activity, including rate limiting, sender throttling, blocking of known spam domains, and content-based filtering using keywords and message templates.

Organizational Practices

Define and enforce a corporate email usage policy. Employees should not use work email addresses to register for third-party services, marketing subscriptions, or online surveys, as this significantly increases exposure to spam and data leaks.

Use dedicated shared addresses for public-facing communication. Instead of exposing personal corporate inboxes, organizations should rely on generic addresses such as info@, sales@, or support@. This approach localizes spam exposure and protects the mailboxes of key employees.

Educate employees not to respond to spam messages. Any reply confirms that an address is active and often leads to increased spam volume. Suspicious messages should instead be reported or deleted.

Security Hygiene

Regularly monitor whether corporate email addresses appear in public data breaches. If exposure is detected, organizations should expect an increase in spam and phishing attempts and strengthen monitoring accordingly.

Use unique email aliases for different services. If an alias begins receiving spam, it becomes immediately clear which service was compromised or improperly shared the address.

Configure quarantine instead of permanent deletion. Spam filters are not perfect, and legitimate emails from new partners or customers may occasionally be misclassified. Quarantine allows for review and recovery of false positives.

Monitoring and Optimization

Continuously track filtering effectiveness, including blocked spam volumes, delivered messages, and false positives. This enables ongoing tuning of filtering rules to match the organization’s specific risk profile.

Maintain updated allowlists and blocklists, ensuring trusted partner domains are not filtered while known spam sources are consistently blocked.

Implement regular reporting, such as monthly reviews showing how much spam was blocked, how much employee time was saved, and how the load on email infrastructure was reduced.

Critical Point

Spam filtering is not a one-time configuration. Spam campaigns constantly evolve, with attackers rotating domains, changing message patterns, and adapting delivery techniques. Effective spam defense must remain dynamic, supported by continuous monitoring and rule optimization.

Reducing spam volume also lowers background noise within corporate inboxes, making it significantly easier to detect genuinely dangerous threats such as targeted phishing attacks.

4. Email Flooding

What It Means for Business

Email flooding is a denial-of-service attack that involves sending massive volumes of automated, low-value emails, often containing random characters or meaningless content, to overwhelm corporate email infrastructure.

Unlike spam, the goal of email flooding is not advertising, but disruption of availability. When a mailbox or mail server receives hundreds or thousands of messages per second, legitimate emails are delayed or dropped, mail queues grow uncontrollably, and employees lose access to critical communications.

For businesses, this quickly becomes an operational incident. Sales teams miss customer requests, support teams cannot receive tickets, finance teams lose access to payment confirmations, and internal coordination breaks down. In organizations where email is a primary communication channel, even short periods of disruption can halt key business processes.

How to Defend Against Email Flooding

Defending against email flooding requires infrastructure capable of absorbing abnormal traffic volumes, combined with clear operational procedures to maintain business continuity during an attack.

Technical Controls

Implement rate limiting at the mail server or email gateway level. Limit the number of emails accepted from a single IP address or domain within a defined time window. For example, if a source sends more than 50 emails per minute, traffic can be automatically throttled or blocked.

Use anti-flood and behavioral filtering mechanisms. Modern email security platforms detect anomalies such as sudden traffic spikes, repetitive message patterns, meaningless content, or identical headers with minor variations.

Prioritize critical email traffic. Even during a flooding attack, messages from verified partners, internal users, and trusted systems should be processed first to preserve essential business communications.

Deploy distributed or resilient email infrastructure. Load-balanced or geographically distributed mail servers ensure that if one node becomes overwhelmed, traffic can be redirected to healthy systems, maintaining service availability.

Monitoring and Early Detection

Enable real-time monitoring of inbound email volumes. Security teams should be alerted when traffic exceeds baseline levels by 5–10x, allowing rapid response before infrastructure becomes saturated.

Track traffic sources. Flooding attacks often originate from specific IP ranges, subnets, or autonomous systems (ASNs). These can be blocked at the firewall or email gateway level once identified.

Integrate reputation-based filtering. Email gateways should leverage threat intelligence and reputation data to deprioritize or block known abusive sources automatically.

Configure automated alerts for IT and SOC teams. Flooding attacks require immediate attention. Every minute of delay can result in thousands of unnecessary messages entering the system.

Organizational Procedures

Develop an email flooding incident response plan. Clearly define who receives alerts, who has authority to block traffic, how employees are informed, and which alternative communication channels are activated.

Establish backup communication channels. If corporate email becomes unavailable, critical teams (sales, finance, customer support) must know how to continue operating using alternatives such as Microsoft Teams, Slack, phone calls, or secondary email addresses.

Regularly test response and recovery procedures. Simulate flooding scenarios in controlled environments to validate detection, escalation, and recovery timelines.

Post-Incident Actions

Analyze attack patterns and sources. Identify how the flood was generated, which controls were effective, and whether the attack was isolated or part of a broader campaign.

Update filtering and rate-limiting rules based on lessons learned to improve resilience against future attacks.

Communicate transparently with employees. Explain what happened, why email was disrupted, and how to act if similar incidents occur again.

Critical Point

Email flooding is an availability attack, not a confidentiality breach. Its purpose is to disrupt operations, not steal data. Effective defense focuses on infrastructure resilience, rapid detection, and well-rehearsed recovery procedures.

For organizations where email is mission-critical to functions such as sales, customer support, or financial operations, even short periods of downtime are unacceptable. Investments in anti-flood protections and alternative communication channels should be viewed not as optional expenses, but as safeguards against operational paralysis.

5. Credential Harvesting

What It Means for Business

Credential harvesting is an attack technique aimed at stealing user credentials such as usernames, passwords, MFA tokens, or session cookies. In most cases, it is not the final objective, but the first stage of a larger security incident.

For businesses, this is one of the most dangerous email-based threats. Once credentials are compromised, attackers can operate as legitimate users, logging into systems without triggering immediate suspicion, bypassing certain controls, and gradually expanding access.

Stolen credentials are commonly used for:

Accessing corporate email accounts.

Executing Business Email Compromise (BEC) scenarios.

Accessing VPNs, CRM systems, financial platforms, cloud services, and other critical business systems.

Launching follow-on attacks, such as Ransomware.

Credential harvesting is typically delivered via phishing emails, fake login pages, QR-code phishing (quishing), malicious attachments or links that imitate legitimate authentication portals.

How to Defend Against Credential Harvesting

Effective protection requires a layered, identity-centric security model that assumes credentials will eventually be targeted.

Technical Controls

Enforce MFA for all accounts, especially privileged users, using phishing-resistant methods where possible (hardware security keys, certificate-based authentication).

Apply Conditional Access policies that evaluate login context, including geolocation, device posture, and behavioral risk signals (new devices, unusual login times).

Deploy identity protection with behavioral analytics to detect anomalous sessions, rapid IP changes, token reuse, or impossible travel scenarios.

Adopt Zero Trust principles by granting users only the minimum access required for their roles and continuously validating trust throughout sessions.

Monitoring and Early Detection

Monitor authentication anomalies, including logins from new devices, unexpected locations, or abnormal time patterns.

Continuously scan for indicators of account compromise, such as unusual internal activity or leaked credentials appearing in public breaches or dark web sources.

Correlate identity events with email activity to identify phishing-to-login attack chains early.

Organizational Processes

Define credential lifecycle management policies, including regular rotation, access reviews, and privilege audits.

Ensure rapid account containment procedures. When compromise is suspected, accounts must be disabled or reset immediately.

Audit third-party integrations and OAuth applications. Review which external services have delegated access, API tokens, or extended permissions and revoke unnecessary privileges.

Security Awareness and Training

Train employees to recognize phishing login pages and fake authentication prompts.

Educate users about the risks of password reuse and browser-stored credentials.

Run scenario-based training focused on what to do if credentials were entered on a suspicious page, including immediate reporting and response steps.

Critical Point

Credential harvesting attacks target identity, not infrastructure. Once credentials are stolen, attackers operate within legitimate sessions, making detection significantly harder.

Because credential theft often serves as the entry point for broader compromise, defending against it requires a comprehensive approach that combines identity security, monitoring, user awareness, and rapid response capabilities.

6. QR Code Phishing (Quishing)

What It Means for Business

QR code phishing, commonly referred to as quishing, is a form of phishing attack in which threat actors use QR codes as a delivery mechanism for malicious links. Unlike traditional email phishing, where users can hover over or visually inspect a URL, a QR code obscures the destination until it is scanned.

This creates a particularly dangerous scenario for businesses. An employee may receive an email, PDF document, invoice, or internal notice containing a QR code, scan it using a corporate or personal mobile device, and be redirected to a phishing page without any prior visibility into the destination.

These phishing pages frequently impersonate:

Authentication portals such as Microsoft 365, Google Workspace, VPNs, or HR systems.

MFA verification or “security check” pages.

Password reset forms or document access portals.

Quishing is especially effective in organizations that actively use mobile devices, BYOD policies, or QR codes in internal workflows such as offices, warehouses, logistics, or finance operations.

Compromised credentials obtained through quishing often become the initial access vector for further attack progression, including identity abuse (BEC), lateral movement within the environment, and ultimately disruptive outcomes such as data encryption or infrastructure compromise.

How to Defend Against Quishing

Effective protection against quishing requires a combination of email security controls, identity-centric protections, and clearly defined organizational rules around QR code usage.

Technical Controls

Deploy email security solutions capable of detecting QR codes within email bodies and attachments and applying additional inspection to embedded content.

Use sandboxing and dynamic URL analysis for destinations reached via QR codes, validating page behavior after user interaction rather than relying solely on static inspection.

Restrict access to corporate resources from mobile devices through Conditional Access policies, Mobile Device Management (MDM), or Zero Trust controls.

Enforce MFA across all critical systems to ensure that credential compromise alone does not grant immediate access.

Monitoring and Early Detection

Monitor for anomalous authentication attempts originating from mobile browsers, newly observed devices, or unusual geolocations.

Correlate email telemetry with identity-related events in SIEM platforms to identify phishing-to-login attack chains at an early stage.

Track the emergence of new phishing domains impersonating corporate services, brands, or commonly used SaaS platforms.

Organizational Controls

Define clear policies governing the use of QR codes in business processes, explicitly specifying where QR codes are permitted and where they are prohibited.

Prohibit the use of QR codes for high-risk actions such as authentication, password changes, or financial approvals.

Establish a rapid escalation process for employees who have scanned a suspicious QR code, including immediate session review and credential reset procedures.

Security Awareness and Training

Train employees on a simple but critical rule: a QR code is a concealed link.

Educate staff on common quishing indicators, including unexpected QR codes, urgency-driven messaging, and requests to “verify access” or “confirm identity.”

Conduct dedicated quishing simulation exercises rather than limiting training to traditional email phishing scenarios.

Critical Point

Quishing demonstrates how attackers bypass traditional email filtering by exploiting trust in visual elements and mobile-first workflows. Effective defense is only possible when technical controls, process restrictions, and informed user behavior are combined into a cohesive security posture.

Email Security: Key Takeaways

Email is no longer just a communication channel. It represents a primary attack surface and, in many cases, the main entry point for attackers seeking to compromise identities, access sensitive information, and disrupt critical business processes.

Business Email Compromise (BEC) and credential harvesting remain the most high-impact email-based threat scenarios from a business perspective. Even when technical security controls are in place, successful exploitation is often driven by abuse of trust and weaknesses in operational processes, resulting in direct financial loss, access compromise, and operational disruption.

Technology alone is not sufficient. Even the most advanced email security solutions cannot compensate for the absence of clear verification procedures if financial transactions or other critical actions can be executed without mandatory out-of-band validation.

Effective email security starts with identity protection. Identity and Access Management (IAM), multi-factor authentication (MFA), Conditional Access policies, authentication anomaly detection, and session monitoring form the foundation for preventing credential abuse and unauthorized access.

Security effectiveness is directly influenced by employee actions in real-world scenarios. Traditional phishing awareness training is insufficient on its own. Practical value is achieved through scenario-based simulations, including BEC, QR-code phishing (quishing), and other targeted attacks aligned with real business roles and workflows.

Monitoring and correlation determine response speed. Detection of email-borne threats must be based on correlating email telemetry with identity-related events within SIEM platforms to enable early identification of compromise and controlled incident response.

Email security is an ongoing process, not a one-time project. Attack techniques evolve continuously, requiring regular review, testing, and adaptation of controls to remain aligned with the current threat landscape.

Next Steps

If email is a critical channel for business communication and operational execution, organizations should move beyond generic recommendations and assess how effectively their infrastructure, processes, and teams can detect and respond to the threat scenarios described above. This assessment must reflect real business roles, workflows, and attack paths rather than theoretical controls.

That is why Velstadt engages with organizations to evaluate their readiness for email-based threats, focusing on how well technologies, processes, and responsible roles are aligned, and whether the organization can detect and contain attack scenarios without disrupting business continuity and key operational processes.

#### How to Choose the Right Penetration Testing Provider in 2026: A Decision Framework for Security Leaders
Choosing the right penetration testing provider in 2026 means matching the engagement model (boutique services or continuous PTaaS), testing methodology, technical depth, and regulatory context to your organization's risk profile and security maturity. A credible provider should be able to explain how they test, which references they use, such as OWASP WSTG, NIST SP 800-115, PTES, or OSSTMM, and how findings are mapped to real-world attacker techniques using frameworks like MITRE ATT&CK. For advanced engagements, OSCP, CREST CRT/CCT, OSWE, OSEP and OSED are stronger signals than broad certification lists or entry-level credentials. The wrong provider produces long lists of low-value findings; the right one produces validated exploitation evidence, clear business impact, and remediation support through verification.



TL;DR — What every CISO should know in 2026




The data supports the investment. Verizon's 2025 DBIR analyzed 22,052 incidents and 12,195 confirmed breaches across 139 countries. The report found that vulnerability exploitation grew 34% year over year and now accounts for 20% of breaches. Ransomware was present in 44% of breaches, reaching 88% among SMBs, while third-party involvement doubled to 30%. Edge devices and VPNs represented 22% of vulnerability-exploitation targets, yet only about 54% of those vulnerabilities were fully remediated during the year. Against IBM’s 2025 global average breach cost of USD 4.4 million, a well-scoped penetration test is a practical way to validate exploitable risk before attackers do.



Two engagement models serve different needs. Boutique penetration testing is best when you need depth, sector-specific threat modeling, and remediation ownership. Continuous PTaaS is better suited for frequent release cycles, broader asset coverage, and integration with development workflows. Mature security programs often use both.



Certifications are useful, but not decisive. Treat them as supporting evidence, not the selection criterion. Methodology, scope fit, sector experience, reporting quality, and remediation support matter more than a long list of acronyms.



Compliance shapes scope. DORA, NIS2, PCI DSS v4.0.1, CMMC 2.0, ISO/IEC 27001, SOC 2, HIPAA, and SEC cyber-disclosure expectations influence how testing should be planned, evidenced, and reported. They do not all require the same type of penetration test, so the obligation should be mapped before scoping.



Reports without proof of exploitation are noise. Demand chained attack paths, business-impact narratives, and post-fix retest as part of the engagement, not a separate purchase.



Pricing transparency is a buyer's right. Most pentests cost $5K–$25K per engagement; complex enterprise tests reach $100K+; DORA threat-led engagements run $150K–$400K+. Anything below $4K for a web app pentest is an automated scan in disguise. Big 4 firms charge 2–3× boutique providers for the same scope.




Why provider selection is harder in 2026 than it was in 2024



Two structural shifts changed the pentest buyer's landscape in 2025–2026.



Regulatory expansion. DORA has applied since January 2025 and requires financial entities to maintain digital operational resilience testing programs, with selected entities subject to threat-led penetration testing under Articles 26–27. NIS2 does not directly mandate pentesting, but Article 21 raises expectations for risk management, vulnerability handling, secure development, supply-chain security, and control effectiveness assessment. PCI DSS v4.0.1 includes explicit penetration-testing requirements under Requirement 11.4, while the SEC cybersecurity disclosure rule requires public companies to disclose material incidents within four business days after determining materiality. CMMC 2.0 is also being phased into DoD contracting requirements. Provider selection now depends on regulatory fit, not only technical fit.



Threat and exposure acceleration. Verizon's 2025 DBIR shows that vulnerability exploitation is now close to credential abuse as an initial access vector. The key signal is not that every breach starts with a zero-day, but that exposed systems, edge devices, VPNs, credentials, third parties, and ransomware paths increasingly overlap. Generic "scan plus PDF" engagements cannot validate chained attack paths, identity abuse, business logic flaws, lateral movement, or exposure through vendors and integrations. Buyers need providers who can test realistic attack paths, not just run generic OWASP Top 10 checks.



These two forces mean the cost of choosing the wrong provider has increased. Buyers need disciplined evaluation, not a checklist of logos, tools, and generic certification claims.



What the 2025 Verizon DBIR data says about pentest priorities for 2026



Verizon's 2025 Data Breach Investigations Report analyzed 22,052 real-world security incidents, including 12,195 confirmed data breaches, with victims spanning 139 countries. The dataset covers incidents from 1 November 2023 through 31 October 2024. For security leaders, the DBIR does not tell you what your exact scope should be, but it does show which attack patterns deserve more attention.




Vulnerability exploitation is now a board-level scoping issue Vulnerability exploitation as an initial access vector grew 34% year over year and reached 20% of breaches in the 2025 DBIR. Edge devices and VPNs represented 22% of assets targeted in vulnerability-exploitation breaches. Verizon also reported that only about 54% of those edge-device vulnerabilities were fully remediated during the year, with a median remediation time of 32 days.This does not mean every penetration test should become an infrastructure test. It means that scoping should not ignore internet-facing assets, exposed administrative interfaces, VPNs, firewalls, remote access paths, and externally reachable services. If those assets are business-critical, they should be explicitly considered during scoping.



Credentials remain central to initial accessThe 2025 DBIR identifies credential abuse as the most common initial access vector at 22%, followed closely by exploitation of vulnerabilities at 20%. Stolen credentials also play a major role in Basic Web Application Attacks, where the DBIR reports that 88% involved stolen credentials.For penetration testing, this points to more than password-policy checks. Credible scope should consider authentication flows, authorization boundaries, session management, MFA implementation, password reset logic, privilege escalation, identity-provider integrations, and scenarios where attackers use valid credentials rather than malware.



Third-party involvement is no longer peripheralThird-party involvement doubled to 30% of breaches in the 2025 DBIR. This does not mean every provider should test every supplier. It does mean that organizations should understand where third parties affect authentication, data access, APIs, CI/CD pipelines, managed services, SaaS integrations, and operational dependencies.A penetration test that stops at the organization's own perimeter may miss important paths created by integrations, delegated access, supplier portals, shared cloud environments, and exposed vendor-managed services.



Ransomware risk is about attack paths, not just malwareRansomware was present in 44% of breaches in the 2025 DBIR, and Verizon reported a disproportionate impact on SMBs, with ransomware present in 88% of SMB breaches. The median ransom payment reported by Verizon was USD 115,000, while 64% of victim organizations did not pay.A penetration test should not pretend to "test ransomware" by deploying ransomware-like payloads. The safer and more useful approach is to validate the paths ransomware operators rely on: initial access, exposed services, identity compromise, lateral movement, privilege escalation, backup exposure, segmentation weaknesses, and data-exfiltration paths.



Human-driven paths still matterThe DBIR continues to show the importance of the human element, with human involvement hovering around 60% of breaches. This includes social engineering, credential abuse, misuse, and error. Phishing and pretexting may not belong in every penetration test, but they should be considered when the business risk involves payment fraud, helpdesk abuse, privileged access, sensitive data workflows, or executive impersonation.For mature programs, phishing simulation should be separated from technical penetration testing unless the engagement is explicitly designed as a social engineering or red team exercise. The important point is not to mix everything into one engagement, but to test the attack paths that actually matter.




A defensible priority map for pentest scope



DBIR data should not be copied into scope mechanically. It should be translated into practical testing priorities based on the organization’s assets, business model, regulatory obligations, and threat exposure.







DBIR signal
What it means for scoping
Practical testing focus


Credential abuse: 22%; vulnerability exploitation: 20%
Identity and exposed systems are both primary attack surfaces
Authentication, authorization, session handling, MFA, password reset, exposed applications


Edge devices and VPNs: 22% of vulnerability-exploitation targets
Perimeter and remote-access technologies need explicit attention
VPNs, firewalls, exposed admin interfaces, remote access paths, patch posture


Third-party involvement: 30% of breaches
Supplier, SaaS, API, and managed-service dependencies can create real attack paths
SaaS/API integrations, delegated access, support portals, CI/CD workflows


Ransomware: present in 44% of breaches
Ransomware risk should be validated through attack paths, not malware deployment
Initial access, identity compromise, lateral movement, privilege escalation, segmentation, backup exposure


Basic Web Application Attacks: about 88% involved stolen credentials
Web and API testing should include identity and account-abuse scenarios
Account takeover, credential-based abuse, authorization flaws, session management, MFA edge cases


Human element: around 60% of breaches
User-driven and process-driven attack paths should be considered where business risk justifies it
Helpdesk abuse, payment-process manipulation, privileged access workflows, phishing or pretexting where in scope







These are not mandatory scope items for every engagement. They are evidence-based signals that should be considered during scoping. A credible provider should be able to explain why each item is included, excluded, or handled through a separate engagement.



Pentest ROI in context — the business case



IBM's 2025 Cost of a Data Breach Report puts the global average cost of a data breach at USD 4.4 million, a 9% decrease from the previous year. That number should not be used as a precise forecast for your organization. Breach cost depends on industry, geography, data type, response maturity, legal exposure, downtime, and regulatory context.



For regulated organizations, breach exposure can extend beyond direct response cost. GDPR administrative fines can reach up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher. Under NIS2, essential entities may face administrative fines of at least EUR 10 million or 2% of worldwide annual turnover, while important entities may face fines of at least EUR 7 million or 1.4%.



The better business argument is not "a pentest is cheaper than a breach." That is too simplistic. The stronger argument is that penetration testing helps validate whether security controls actually reduce exploitable risk. A good engagement can reveal whether a vulnerability is merely theoretical, whether it can be chained into business impact, and whether remediation actually closes the path.



For CFO and board discussions, frame penetration testing as evidence generation:




It validates exploitable risk before attackers do.



It gives development and infrastructure teams prioritized remediation work.



It supports audit and compliance evidence where testing is required or expected.



It helps leadership understand business impact rather than only technical severity.



It provides a baseline for retesting and continuous improvement.




Penetration testing is not where organizations should chase the cheapest possible option. The real value is not the number of findings. The value is defensible evidence, prioritization, and verified closure.



Step 1 — The seven questions every CISO should answer before issuing an RFP



Before talking to any provider, answer these internally. Most weak engagements start with unclear scope, not weak tooling.



1. What are we actually protecting? Customer data, financial transactions, intellectual property, operational uptime, regulated workloads, and critical business processes each imply a different test design.



2. Which regulations require this test? DORA, NIS2, PCI DSS v4.0.1, SOC 2, HIPAA, CMMC 2.0, ISO/IEC 27001 — each prescribes specific testing requirements. Document the obligation before scoping.



3. What is the maturity of our security program? An organization at an early stage of security maturity needs a different engagement than a regulated enterprise validating control effectiveness across critical systems.



4. Which attack paths are most relevant to our sector and business model? Financial services, healthcare, energy, manufacturing, public sector, and technology companies face different exposure patterns, data risks, and regulatory expectations. Threat-informed scoping can use well-documented actor examples, such as FIN7, Sandworm, APT29, or APT41, but the scope should be based on realistic attack paths, not actor-name dropping.



5. Will internal teams remediate findings, or do we need fix support? Many providers stop at the report. Some own remediation through fix verification. The right answer depends on internal capacity.



6. Is this a one-time exercise or part of a continuous program? Continuous testing changes the provider model, cadence, reporting structure, and integration with engineering workflows.



7. What's our reporting consumer? A board needs business-impact narratives. An auditor needs evidence and methodology disclosure. A development team needs reproducible exploitation steps. Different audiences, different deliverable formats.



Until these are answered, no provider — Velstadt included — can scope your engagement responsibly.



Step 2 — Boutique services vs continuous PTaaS: pick the right model first



This is the single most under-discussed decision in the buyer's journey. Generic "how to choose a pentest provider" articles treat all providers as equivalent. They are not.



Boutique penetration testing services (Velstadt, NetSPI, Bishop Fox, Sentrium)




What it is: Engagement-based, expert-led testing against a defined scope over a defined period.



Best fit when: You need deep exploitation evidence, sector-specific threat modeling, regulated-industry reporting, complex business logic testing, or remediation support through verification.



Strengths: Manual depth, business-context-aware testing, clear accountability, tailored reporting, and stronger ability to investigate non-obvious attack chains.



Limitations: Lower throughput; testing is point-in-time unless contracted for repeat engagements.



Pricing: Typically $15,000–$120,000 per engagement, depending on scope.




Continuous PTaaS platforms (Cobalt, Synack, BreachLock, Astra, Horizon3.ai)




What it is: Subscription-based testing model that usually combines platform workflows, recurring testing, triage, ticketing, retesting, and sometimes crowdsourced or distributed tester capacity.



Best fit when: You need frequent testing across many releases, faster retesting, broad asset coverage, integration with development workflows, or continuous vulnerability intake.



Strengths: Throughput, repeatability, developer workflow integration, faster retest cycles, and better fit for high-change environments.



Limitations:  Depth can vary by tester, scope, and platform model. Sector-specific threat modeling and complex business logic testing may require additional expert-led work.



Pricing: Typically $20,000–$120,000+ per year, scaling with assets and test frequency.




Decision rule



If your security program prioritizes depth, sector specialization, and regulated-industry rigor — choose a boutique services provider. If your security program prioritizes throughput, developer integration, and continuous coverage — choose a continuous PTaaS platform. Many mature organizations use both. Most under-resourced ones pick one and overuse it.



Step 3 — Velstadt's 12-Point Provider Evaluation Framework



Use this framework whether you are evaluating Velstadt or any other provider.







#
Criterion
What to demand
Why it matters


1
Named delivery team
The proposal identifies the engagement lead and the testers who will perform the work, including their relevant experience
Reduces ambiguity, rotation risk, and generic "senior team" claims


2
Scope discovery
A discovery process covering business context, assets, constraints, objectives, and reporting needs
Good testing starts before tooling


3
Relevant credentials
OSCP, CREST CRT/CCT, OSWE, OSEP, OSED or other scope-relevant credentials
Credentials should support the scope, not decorate the proposal


4
Methodology
OWASP WSTG, NIST SP 800-115, PTES, OSSTMM, and ATT&CK mapping where relevant
Prevents ad hoc testing hidden behind “industry standard” language


5
Manual and automated balance
Explanation of what is automated, what is manual, and where expert judgment is applied
Automation supports testing; it does not replace it


6
Sector experience
Comparable work in your industry or regulatory environment
Sector context changes test design and reporting


7
Regulatory and audit context
The provider understands which regulatory or audit expectations affect scope, evidence, reporting, and retesting
Prevents technically useful reports that do not support audit, board, or compliance needs


8
Proof of exploitation
Safe, authorized evidence showing exploitability and business impact
Reduces theoretical findings and improves prioritization


9
Remediation guidance
Specific code-level, configuration-level, or process-level recommendations
Generic advice does not close gaps


10
Retest workflow
Included or clearly priced post-fix validation
Findings should not remain unverified


11
Evidence handling
NDA, rules of engagement, secure evidence storage, data minimization, and cleanup process
Pentest evidence can be sensitive or regulated


12
References or proof of work
Relevant case studies, references, or anonymized examples where possible
Helps validate delivery quality beyond sales claims







A provider does not need to be perfect on every item for every engagement. But if several of these areas are vague, the risk of a low-value engagement increases.





Step 4 — Certifications and accreditations decoded



Certification lists are often misleading. The question is not whether a company can display many acronyms. The question is whether the qualifications are relevant to the scope and supported by actual delivery experience.



Strong baseline signals




OSCP (Offensive Security Certified Professional) — a widely recognized practical baseline for hands-on penetration testing. It is not the highest-level offensive certification, but it remains a credible signal of exploitation capability.



CREST CRT (Council of Registered Ethical Security Testers, Registered Penetration Tester) — an intermediate-level, practical penetration testing certification that validates competence in core infrastructure and web application penetration testing. It is especially relevant in UK/EU and regulated procurement contexts where buyers value formal assurance around tester capability and delivery standards.



GIAC GPEN / GWAPT (Global Information Assurance Certification) — useful professional certifications for network and web application penetration testing, especially in enterprise, US federal, and DoD-adjacent environments.




Advanced and specialist signals




OSWE (OffSec Web Expert) — an advanced web application exploitation certification focused on source-code-assisted vulnerability discovery, exploitation, and advanced web attack techniques.



OSEP (OffSec Experienced Penetration Tester) — an advanced penetration testing certification focused on evasion, lateral movement, bypassing defenses, and operating in hardened enterprise environments.



OSED (OffSec Exploit Developer) — an advanced exploit development certification focused on Windows user-mode exploit development, shellcode, and bypassing memory protections.



OSCE3 (OffSec Certified Expert 3) — an advanced OffSec designation awarded to candidates who hold OSEP, OSWE, and OSED. It signals breadth across advanced penetration testing, web exploitation, and exploit development.



GXPN (GIAC Exploit Researcher and Advanced Penetration Tester) — an advanced GIAC certification that validates exploit research, advanced penetration testing, and deeper technical exploitation skills.



CRTL (Certified Red Team Lead) — an advanced red team certification focused on planning, executing, and leading adversary-simulation engagements.



CRTO (Certified Red Team Operator) — a red team operations certification focused on adversary simulation, offensive tradecraft, and practical operator skills.



CRTP (Certified Red Team Professional) — an Active Directory-focused certification that validates knowledge of enterprise identity attack paths, privilege escalation, lateral movement, and domain compromise techniques.




Useful but not sufficient on their own:




CEH (Certified Ethical Hacker) — an entry-level signal. It may show basic familiarity with ethical hacking concepts, but it should not be treated as sufficient evidence for serious regulated or advanced penetration testing.



CISSP (Certified Information Systems Security Professional) — a security management and governance credential, not a hands-on penetration testing certification. It can be useful for engagement leadership, governance context, and executive communication, but it does not prove technical testing ability.




Scope-specific signals




AWS Certified Security – Specialty — a cloud security certification relevant when Amazon Web Services environments are in scope. It should be paired with practical AWS security testing experience.



Azure security certifications — cloud security certifications relevant when Microsoft Azure environments are in scope, especially for identity, cloud configuration, and workload security testing.



Google Cloud security certifications — cloud security certifications relevant when Google Cloud environments are in scope, especially for IAM, cloud architecture, and workload security testing.



Scope-specific certifications — examples include CKS (Certified Kubernetes Security Specialist) for Kubernetes security, OSWP (OffSec Wireless Professional) for wireless testing, GMOB (GIAC Mobile Device Security Analyst) for mobile device and application security, and GRID (GIAC Response and Industrial Defense) for ICS/OT environments (it is more of an OT/ICS defense and response signal than a general penetration testing credential). These are useful when those technologies are part of the engagement scope, but they should not be treated as general proof of penetration testing depth.




The practical rule: certifications should support the scope. They do not replace methodology, delivery experience, reporting quality, and proof of exploitation.



Step 5 — Methodology: what to demand



A credible provider can explain its testing process, map it to recognized references, and show how evidence will be collected and reported.



The key references are:




OWASP Web Security Testing Guide (WSTG) — appropriate for web applications and web services. It provides a structured reference for areas such as authentication, authorization, session management, input validation, and business logic. For dedicated scopes, it should be complemented with specialized OWASP references: OWASP API Security Top 10 for API risks, OWASP MASVS/MASTG for mobile applications, and OWASP AISVS/AI Testing Guide for AI-enabled systems.



NIST SP 800-115 —  a technical guide for planning and conducting information security testing and assessment, analyzing findings, and developing mitigation strategies.



OSSTMM (Open Source Security Testing Methodology Manual) — useful for structured, audit-friendly, and controls-oriented security testing.



PTES (Penetration Testing Execution Standard) —  useful for engagement lifecycle structure, from pre-engagement interaction through intelligence gathering, threat modeling, exploitation, post-exploitation, and reporting.



MITRE ATT&CK — not a penetration-testing methodology by itself, but a knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations. It is useful for mapping tested behaviors and findings to attacker techniques.




For mature engagements, the report should include specific references where useful: OWASP WSTG categories, NIST testing phases, and MITRE ATT&CK technique IDs. This helps technical teams reproduce findings and helps auditors understand what was actually tested.



Step 6 — Pricing models and total cost of ownership



Penetration testing pricing varies widely. Any exact market range should be treated as a planning estimate, not a universal benchmark. The price depends on scope, number of assets, authentication complexity, business logic, cloud footprint, testing depth, reporting expectations, retesting, and regulatory requirements.



As a practical market-observed planning view:







Engagement type
Typical planning range
Notes


Small web application pentest
USD 5,000–25,000
Depends heavily on roles, flows, API scope, and business logic


Complex web/API pentest
USD 25,000–75,000+
Common where multiple roles, integrations, APIs, and payment/data flows are in scope


Network penetration testing (external and/or internal)
USD 5,000–80,000+
Covers internet-facing infrastructure and/or internal network paths, including public IPs, exposed services, VPNs, firewalls, remote access, segmentation, credentialed access, Active Directory, lateral movement, and reporting depth


Cloud security assessment / cloud pentest
USD 15,000–80,000+
Depends on provider, accounts/subscriptions/projects, IAM complexity, and architecture


Red team / adversary simulation
USD 50,000–250,000+
Depends on duration, objectives, stealth requirements, and rules of engagement


Continuous PTaaS
USD 20,000–120,000+ per year
Depends on asset count, test frequency, retest workflow, and platform model


DORA TLPT-style engagement
Often significantly higher
Scope, regulatory coordination, threat intelligence, critical functions, and live-system testing can materially increase cost







Very low quotes should be treated with caution, not automatically rejected. A low price may reflect narrow scope, a small application, local market rates, or a limited validation exercise. But if the provider cannot explain manual testing effort, methodology, evidence, reporting, and retest process, the buyer should assume the engagement may be closer to a vulnerability scan than a penetration test.



Hidden cost factors (often quoted separately)




Retesting: included, limited, or separately priced.



Out-of-scope findings: how the provider handles issues discovered outside the agreed scope. A credible provider should document the issue as informational or separately reportable, avoid unauthorized testing, and agree on next steps before expanding activity.



Reporting customization: whether technical, executive, auditor-facing, and board-ready reporting are included by default. Custom formats, board briefings, regulator-facing evidence packs, or additional review cycles may increase cost and should be clarified before signing.



Business logic: complex workflows require more manual analysis than standard vulnerability checks.



On-site testing: OT/ICS, restricted networks, or highly regulated environments may add travel and coordination cost.



Third-party coordination: vendors, managed services, and shared infrastructure require more scoping discipline.



Threat intelligence add-on: sector-specific TTP modeling (Sandworm, FIN7-adjacent, RaaS profiles). Velstadt's Phantom platform is included in regulated-industry engagements; standalone TI subscriptions from external providers run $50,000+ per year.




First-year total cost of ownership



The first-year cost may be higher than the initial engagement price if retesting, custom reporting, stakeholder briefings, regulator-facing evidence packs, travel, third-party coordination, or expanded scope are not included. Buyers should compare providers based on included deliverables, retest terms, reporting depth, evidence quality, and remediation support — not only the headline quote.



The lowest headline price is rarely the lowest total cost if the report cannot support remediation, audit, or board-level risk decisions.



Step 7 — Compliance framework mapping



Map the obligation before scoping the test. The point is not to force every framework into a pentest. The point is to understand what evidence the organization needs. The examples below are not exhaustive. Other legal, regulatory, contractual, and internal audit requirements may also influence testing scope and evidence needs.







Framework / regulation
Practical testing implication


DORA
Financial entities must maintain digital operational resilience testing. Selected entities must conduct TLPT under Articles 26 and 27 against critical or important functions.


NIS2
Article 21 requires appropriate and proportionate cybersecurity risk-management measures. Penetration testing may support evidence of vulnerability handling, secure development, supply-chain security, and control effectiveness, but NIS2 should not be oversimplified as a direct pentest mandate.


PCI DSS v4.0.1
Requirement 11.4 includes internal and external penetration-testing expectations, generally at least annually and after significant changes, with segmentation testing where segmentation is used.


SOC 2
SOC 2 does not explicitly require penetration testing or prescribe one universal pentest format. However, penetration testing is commonly used as evidence that relevant security controls, vulnerability management processes, and risk mitigation activities are designed and operating effectively under the Trust Services Criteria.


ISO/IEC 27001
ISO/IEC 27001 does not mandate a universal penetration testing cadence. However, risk-based security testing can support the ISMS by validating vulnerability management, secure development, risk treatment, and continual improvement activities.


HIPAA
The HIPAA Security Rule requires covered entities and business associates to conduct risk analysis and implement administrative, physical, and technical safeguards for ePHI. Penetration testing is not named as a universal requirement, but it can support risk analysis, risk management, and validation of technical safeguards.







Velstadt scopes penetration testing engagements with regulatory, audit, and contractual expectations in mind. The goal is to produce evidence that supports compliance and risk-management needs, not just a generic list of findings.



Step 8 — What good reporting looks like



Reports are where pentest engagements either earn their fee or quietly waste it. Here is the bar.



Executive summary: business-language risk narrative, scope overview, key findings, likely impact, top remediation priorities, and board-ready conclusions.



Technical report: each finding should include affected assets, reproducible steps, supporting evidence such as request/response data or screenshots, severity rationale, CVSS v4.0 where appropriate, business impact, relevant OWASP/NIST references, MITRE ATT&CK mapping where useful, and actionable remediation guidance.



Remediation plan: prioritized fixes, suggested owners where known, recommended timelines, dependencies, and compensating controls where immediate remediation is not possible.



Raw evidence package: captured artifacts, scripts used, log files — auditor-ready.



Optional board briefing: a concise presentation for executives or the board covering security posture, material risks, remediation priorities, and peer or industry context where available.



Retest deliverables: post-fix verification report confirming each finding is closed, partially mitigated, or accepted as residual risk with documentation.



If a provider's sample report is a generic vulnerability list with no exploitation evidence and no business-impact narrative — they are running a vulnerability scan dressed as a pentest. Walk away.



Step 9 — Red flags that justify additional due diligence



These conditions do not always mean the provider is bad, but they should slow the buyer down.




They quote without discovery. A credible provider should understand business context, scope, assets, test objectives, constraints, and reporting needs before issuing a serious proposal.



They describe tools but not methodology. "We use Burp Suite, Nessus, and Metasploit" is not a methodology. Tools support testing; they do not define it.



They avoid explaining manual testing. Automation is useful, but it cannot reliably replace business logic testing, authorization testing, chained exploitation, or contextual risk analysis.



They cannot provide a redacted sample report or report structure. Confidentiality matters, but credible providers should still be able to show report quality without exposing client data.



They overpromise compliance. A provider can help produce evidence, but it should not claim that one pentest automatically makes the organization "DORA compliant," "NIS2 compliant," or "ISO compliant."



They treat MITRE ATT&CK as a pentest methodology. ATT&CK is valuable for mapping adversary behavior, but it is not a substitute for a testing methodology.



They cannot explain retesting. Findings are not truly closed until remediation is verified or risk is formally accepted.



The proposal price is dramatically below market. A $1,500–$4,000 "comprehensive web app pentest" is a vulnerability scan or an inexperienced provider. The real cost of a low-quality engagement is the post-incident remediation that follows when an attacker finds the missed exploit.



They refuse to define evidence handling. Pentest evidence can include sensitive data, tokens, screenshots, credentials, payloads, and logs. Handling rules must be clear.



They cannot identify the delivery team. A credible provider should be able to name the engagement lead and describe the testers’ relevant experience before work begins. Anonymous “senior team” claims increase rotation risk and make credentials harder to verify.



They cannot show comparable work. Claims like "we work with Fortune 500 clients" mean little without relevant case studies, anonymized examples, or references from organizations with similar size, scope, or regulatory exposure. If references are not available, the provider should still be able to show credible evidence of comparable delivery experience.




Why Velstadt approaches penetration testing differently



Velstadt's penetration testing practice combines offensive security expertise, threat intelligence context, and remediation-focused delivery for mid-market and enterprise organizations.



Threat-informed context. Velstadt operates from Ukraine's high-intensity threat environment, where organizations have faced sustained cyber pressure since 2022, including destructive malware, ransomware activity, espionage-driven operations, and attacks affecting critical infrastructure, financial services, logistics, technology, and public-sector ecosystems. This context helps Velstadt design testing scenarios around realistic attack paths rather than generic checklist execution.



Phantom Threat Intelligence Platform integration. Where relevant, penetration testing engagements draw on Velstadt's proprietary Phantom Threat Intelligence Platform (backed by Google) for sector-specific threat context, external exposure correlation, dark web signals, credential exposure, and adversary-TTP-aligned testing scenarios. This does not turn every pentest into a red team engagement, but it helps align testing with the threats most relevant to the client's environment.





Remediation through verification. Engagements focus on validated findings, practical remediation guidance, and post-fix verification. The goal is not to maximize the number of findings, but to help clients close exploitable paths and produce evidence that can be used by technical teams, auditors, executives, and boards.



Market recognition and client feedback. Velstadt’s penetration testing practice was recognized in 2025 by Clutch as a Top Software Testing Company in New York City (#17 of 175). In addition to Clutch recognition, Velstadt was named TechBehemoths Best Cybersecurity Provider 2025 and recognized in five Techreviewer.co 2025 leadership lists, including Top 100+ Cybersecurity Companies and Top Cloud Consulting Companies. All 12 published Clutch client reviews rate Velstadt 5 of 5. These recognitions should not replace technical due diligence, but they provide additional market validation.



Frequently asked questions



What should I look for in a pentest provider? Named pentesters with verifiable certifications (OSCP, CREST, GIAC etc.), clearly disclosed methodology (OWASP / NIST SP 800-115 etc.), sector experience matching your industry, compliance accountability matching your regulatory obligations, proof of exploitation in sample reports, and retest as a contracted deliverable.



How much does penetration testing cost in 2026? Pricing varies by scope, complexity, testing depth, reporting requirements, retesting, and regulatory expectations. As market-observed planning ranges, small web application pentests often fall around USD 5,000–25,000, while complex web/API engagements can reach USD 25,000–75,000+. Network penetration testing, external and/or internal, commonly ranges from USD 5,000–80,000+, depending on exposed assets, segmentation, credentialed access, Active Directory complexity, and lateral movement scope. Cloud security assessments or cloud pentests often fall around USD 15,000–80,000+, red team or adversary simulation engagements can reach USD 50,000–250,000+, and continuous PTaaS subscriptions often range from USD 20,000–120,000+ per year. DORA TLPT-style engagements are usually significantly higher because they may include threat intelligence, red team execution, white-team coordination, critical-function scoping, regulatory expectations, and detailed reporting.



What's the minimum I should pay for a credible web application pentest? There is no defensible universal minimum. A very small and narrowly scoped test can cost less than a complex enterprise engagement. The better question is whether the provider can explain the manual testing effort, coverage, methodology, evidence, reporting format, and retest process. If those are unclear, the low price is a risk signal.



Why do Big 4 consulting firms charge 2–3× more than boutique providers? Big 4 (Deloitte, PwC, EY, KPMG) prices reflect brand premium, broader scope of practice, and standard global rates rather than specialized depth. Buyers who need brand-mandated reporting (board, regulator, M&A diligence) sometimes choose Big 4 for the badge. Buyers who need exploitation depth, sector specialization, and named pentester accountability typically get better outcomes from boutique providers at one-half to one-third the cost.



What certifications should pentesters have? Certifications should match the engagement scope. OSCP, CREST CRT, and relevant GIAC certifications are useful baseline signals, while advanced or specialist work may require more specialized credentials. CEH alone is not enough for serious testing, and CISSP does not prove hands-on penetration testing capability.



What is the difference between boutique and continuous penetration testing? Boutique penetration testing is engagement-based, expert-led, and depth-oriented. It is best for critical systems, regulated contexts, business logic, and remediation ownership. Continuous PTaaS is subscription-based and throughput-oriented. It is best for frequent testing, release-cycle coverage, and developer workflow integration. Mature programs often combine both.



How long does a penetration test take? A focused web application test may take one to four weeks depending on scope. Larger network, cloud, or multi-application engagements can take several weeks. Red team and adversary simulation engagements often take longer because they require planning, rules of engagement, stealth constraints, execution phases, and detailed debriefing. The timeline should be based on scope, not a generic promise.



How often should we run a penetration test? Frequency depends on risk, regulatory obligations, change rate, and business criticality. As a concrete example, PCI DSS v4.0.1 requires internal and external penetration testing at least annually and after significant changes. High-change or critical environments may need more frequent testing, continuous PTaaS, or targeted retesting after material changes.



What is proof of exploitation? Proof of exploitation is concrete evidence that a finding can be exploited in the tested environment, within the agreed rules of engagement. It may include request/response evidence, screenshots, demonstrated privilege escalation, controlled data access, chained attack paths, or safe simulation of impact. It should be collected carefully, minimized, protected, and documented.



 

#### Velstadt Earns Four Clutch 2025 Awards, Led by #2 Dark Web Monitoring Rank in New York
Velstadt has been named to four Clutch 2025 leadership lists, including a #2 ranking out of 154 firms for Dark Web Monitoring in New York and a #7 ranking out of 563 firms for Managed SIEM Services in New York — both top-tier positions, within roughly the top 1–2% of evaluated providers in two of the most competitive cybersecurity markets in the United States. Every one of the firm's 12 published Clutch client reviews rates Velstadt 5 of 5, a perfect-rating record across every engagement reviewed on the platform.

"A #2 ranking in Dark Web Monitoring among 154 New York firms reflects what we hear from CISOs every week: enterprise threat exposure no longer ends at the perimeter. Continuous visibility into criminal marketplaces — credential leaks, initial-access broker activity, sector-specific threat-actor chatter — has become a board-level expectation, not a niche capability. We are honored to be ranked among the top providers in one of the most demanding markets in the world." — Founder & CEO, Velstadt

The four 2025 Clutch recognitions

#RecognitionRankCohort sizePercentile1Top Dark Web Monitoring Company — New York#2154 firmsTop 1.3%2Top Managed SIEM Services Company — New York#7563 firmsTop 1.2%3Top Dark Web Monitoring Company — United States#17154 firmsTop 11%4Top Software Testing Company — New York City#17175 firmsTop 10%

Two of the four recognitions place Velstadt within roughly the top 1-2% of evaluated providers in their respective categories.

Why Clutch's recognition is meaningful for buyers

Clutch is one of the most widely used B2B research and review platforms in technology services, with rankings driven by a combination of verified client reviews, service-quality scoring, market presence, and engagement-specific case studies. Unlike vendor-curated awards, Clutch rankings respond directly to client feedback — every review is independently verified through a structured interview process before publication.

For procurement teams evaluating cybersecurity providers, Clutch leadership status combined with a perfect average rating signals two things rarely found together: independently verified outcomes and consistency across engagements.

What earned the recognition

The four 2025 recognitions map to three of Velstadt's core practice areas, and reflect engagements with clients across financial services, energy, logistics, and information technology.

Threat Intelligence & Dark Web Monitoring (recognized #2 NY, #17 US)

Velstadt's threat intelligence practice combines automated dark-web and underground-marketplace monitoring with analyst-driven attribution work. Engagements typically include continuous credential-leak monitoring, brand and executive-impersonation tracking, initial-access broker activity surveillance, and sector-specific threat-actor reporting calibrated to a client's industry and geography. The practice draws on threat data observed during active engagements in EU and Ukrainian environments, where attribution-rich intelligence is operationally essential.

Managed SIEM & SOC-as-a-Service (recognized #7 NY)

Velstadt operates 24/7 Managed SIEM and SOC services for mid-market and regulated clients across the EU and the US, integrating directly with platforms including Splunk, Microsoft Sentinel, and Elastic. Engagements are scoped around measurable detection, response, and reporting outcomes — including MTTD and MTTR commitments, monthly executive reporting, and quarterly threat-landscape reviews tailored to the client's industry.

Penetration Testing (recognized #17 NYC, "Software Testing" category)

Velstadt's penetration testing practice covers web applications, APIs, mobile, cloud-native architectures, and infrastructure, with engagements aligned to OWASP, NIST SP 800-115, and sector-specific compliance frameworks (PCI DSS, SOC 2, ISO 27001, HIPAA). Each engagement combines vulnerability discovery with architectural review and remediation guidance owned through to fix verification — a model that produces fewer findings but more closed gaps.

A growing presence in the New York region

Three of the four 2025 Clutch recognitions are New York–specific, including the firm's two highest-ranked categories. The geographic concentration reflects Velstadt's increasing engagement with US Northeast clients — a market characterized by dense regulatory exposure (SEC Cybersecurity Disclosure Rule, NYDFS Part 500, financial-services third-party requirements) and high concentrations of mid-market financial, legal, and professional-services firms whose security obligations have intensified through 2025.

2025 in context: ten industry recognitions in Velstadt's second year

The four Clutch awards bring Velstadt's verified 2025 industry recognitions to ten, making the firm's second year its strongest to date. Earlier 2025 recognitions include:

TechBehemoths Best Cybersecurity Provider 2025

Techreviewer.co — Top Cloud Consulting Companies 2025

Techreviewer.co — Top 100+ Cybersecurity Companies 2025

Techreviewer.co — Top IT Services Companies in the USA 2025

Techreviewer.co — Top Managed IT Service Providers 2025

Techreviewer.co — Top QA and Software Testing Companies 2025

Across both Clutch and Techreviewer rankings, the recognitions span cybersecurity, threat intelligence, managed detection, cloud consulting, application security, and IT services — a multi-category profile uncommon for a firm in its second year of operations

About Velstadt

Velstadt is a cybersecurity firm founded in 2018 and operating across Ukraine, the European Union, and the United States. The firm provides Threat Intelligence (including Dark Web Monitoring), SOC-as-a-Service (including Managed SIEM), Penetration Testing, Compliance Services, Security Consulting, and Infrastructure Hardening to mid-market and regulated enterprises in financial services, energy, logistics, IT, and adjacent sectors.

Velstadt has been recognized in 2025 by Clutch (four leadership categories), Techreviewer.co (five leadership categories), and TechBehemoths (Best Cybersecurity Provider).

Team: 30 cybersecurity professionals across Ukraine and the EU.

Learn more: velstadt.com · Clutch profile

About Clutch

Clutch is a leading B2B research and reviews platform that helps organizations identify and connect with service providers across software development, IT services, cybersecurity, and digital marketing. Clutch's rankings combine verified client reviews collected through independent interviews with service-quality scoring, market presence, and engagement-specific case studies.

Next step

#### Velstadt Recognized Among Techreviewer's 2025 Top Cloud Consulting Companies
Velstadt has been named to Techreviewer.co's 2025 Top Cloud Consulting Companies list, recognizing the firm's security-first approach to cloud architecture, migration, and ongoing operations for mid-market and regulated enterprises across Europe and the United States. The recognition arrives in Velstadt's second year of operation and follows additional 2025 inclusions across Techreviewer's cybersecurity, IT services, managed services, and quality assurance categories - a multi-category endorsement for a firm that launched in 2024.

How Techreviewer evaluated cloud consulting firms

Techreviewer's 2025 cloud consulting ranking evaluates providers against the criteria buyers most often use during procurement: cloud-platform certifications and partnerships; industry-specific experience and compliance fluency (HIPAA, SOC 2, FedRAMP, GDPR); architectural maturity, including adherence to frameworks such as the AWS Well-Architected Framework and the use of infrastructure-as-code; security and compliance posture, including identity and access management, audit-trail discipline, and encryption practices; FinOps maturity; delivery model and SLA structure; observability and policy-as-code tooling; and verifiable client outcomes.

Inclusion in the list signals that the named firms meet professional-buyer standards across this multi-dimensional evaluation, not only on a single capability axis.

What earned Velstadt the recognition

Velstadt's cloud consulting practice is built around three commitments that map directly to Techreviewer's evaluation criteria:

1. Cloud-native security architecture, not cloud security as an add-on. Velstadt designs cloud environments so that security controls are embedded in the architecture itself — identity boundaries, network segmentation, secrets management, encryption at rest and in transit, and continuous configuration monitoring are part of the build, not a post-deployment audit.

2. Regulated-industry depth. Velstadt's client base spans financial services, energy and fuel distribution, logistics, and IT operators — sectors where a misconfigured cloud control creates regulatory and operational consequences within days. Engagements integrate compliance frameworks (DORA, NIS2, SOC 2, ISO/IEC 27001, GDPR) into the cloud architecture from project inception.

3. Tier-1 platform partnerships. Velstadt is a Google Cloud Partner and operates security programs across AWS, Microsoft Azure, and Google Cloud Platform. The firm's broader technology stack includes formalized integrations with CrowdStrike, Cisco, Splunk, Tenable, AWS, Cloudflare, and Censys.

What this means for cloud security buyers

Independent recognition from Techreviewer.co is one of the few cloud-consulting trust signals that combines technical, commercial, and outcome dimensions in a single evaluation. For organizations evaluating cloud security partners — particularly those navigating DORA enforcement (in force across the EU since January 2025), NIS2 transposition, or SOC 2 attestation for the first time — the recognition narrows the shortlist to providers who have been independently assessed against the same criteria a thoughtful procurement team would apply.

For Velstadt's existing clients, the recognition reinforces what their internal security and engineering teams already work with on a weekly basis: a partner whose cloud architecture decisions assume an active, capable adversary.

Velstadt's roadmap for 2026

Building on the recognition, Velstadt's near-term focus areas include:

EU-only SOC tier for DORA-regulated clients, with EU-based detection-and-response coverage that satisfies data-residency and operational-resilience obligations under DORA Articles 5 and 11.

Cloud security maturity assessment as a productized engagement — a fixed-scope, three-week assessment producing a board-ready posture report and a 12-month remediation roadmap.

Expanded vCISO services for mid-market organizations integrating cloud transformation with security-program build-out, including formal accountability for SOC 2, ISO 27001, DORA, and NIS2 attestations.

Deeper sector-specific threat modeling for energy, financial services, and critical-infrastructure clients, drawing on threat intelligence from active engagements in EU and Ukrainian environments.

About Velstadt

Velstadt is a cybersecurity firm founded in 2018 and operating across Ukraine, the European Union, and the United States. The firm provides Threat Intelligence, SOC-as-a-Service, Penetration Testing, Compliance Services, Security Consulting, and Infrastructure Hardening to mid-market and regulated enterprises in financial services, energy, logistics, IT, and adjacent sectors.

In addition to inclusion in Techreviewer's 2025 Top Cloud Consulting Companies, Velstadt has been recognized in the Top 100+ Cybersecurity Companies 2025, Top IT Services Companies in the USA, Top Managed IT Service Providers, and Top QA and Software Testing Companies 2025 lists by Techreviewer.co, and named TechBehemoths Best Cybersecurity Provider 2025.

Team: 30 cybersecurity professionals across Ukraine and the EU.

Learn more: velstadt.com

About Techreviewer.co

Techreviewer.co is an independent research and analytics platform that ranks technology service providers across cloud consulting, cybersecurity, software development, and managed services. Rankings are based on service quality, market presence, technical expertise, client feedback, and verifiable performance.

Next step

Evaluating cloud security partners for a regulated environment, an upcoming migration, or a SOC 2 / ISO 27001 / DORA program?

#### Як email-атаки зупиняють бізнес: практичний гайд із захисту електронної пошти
Вступ

Кількість атак через електронну пошту стабільно зростає з року в рік. Для компаній це не просто черговий виклик - це питання безперервності бізнесу.

За оцінкою CISA (Cybersecurity & Infrastructure Security Agency, США), понад 90% успішних кібератак починаються з фішингового листа, що робить фішинг основним початковим вектором компрометації. Саме з email часто починається викрадення облікових даних, компрометація інформаційних активів, розгортання шкідливого програмного забезпечення або шифрування інфраструктури з подальшим розвитком інциденту.

Зловмисники постійно вдосконалюють методи соціальної інженерії, адаптують тактики під конкретні бізнес-процеси та активно використовують можливості штучного інтелекту. Завдяки AI-інструментам атаки стають більш персоналізованими, масштабованими та складнішими для виявлення, як для користувачів, так і для автоматизованих засобів захисту.

У контексті гібридної війни та зростання геополітичної напруги компанії стикаються не лише з масовими кіберзагрозами, а й із цілеспрямованими кампаніями з боку зловмисників, які спонсоруються на державному рівні. У таких умовах критично важливо дотримуватися базової кібергігієни та впроваджувати системний підхід до захисту електронної пошти,  незалежно від розміру бізнесу чи галузі.

Ця стаття допоможе зрозуміти, як захистити себе та бізнес від найпоширеніших атак на корпоративну пошту та чому інвестиції в email-безпеку є прямою інвестицією у стійкість і безперервність бізнесу.

1. Business Email Compromise (BEC)

Що це означає для бізнесу

Business Email Compromise (BEC) — це таргетована атака, за якої зловмисники видають себе за керівництво, партнерів або клієнтів компанії, щоб змусити співробітників виконати фінансові операції або передати конфіденційні дані.

На відміну від масового фішингу, BEC — це персоналізована афера. Атакуючі вивчають структуру компанії, стиль листування, бізнес-процеси. Вони знають, хто підписує платежі, коли CEO у відрядженні, як виглядають типові запити від постачальників.

Реальна вартість BEC-атак для бізнесу

У 2019 році Nikkei, один із найбільших фінансово-медійних холдингів Японії, втратив $29 млн через одну BEC-атаку — зловмисник видав себе за керівника міжнародної компанії та переконав перерахувати кошти на шахрайський рахунок.

Згідно зі звітом IBM Cost of a Data Breach Report 2022, атаки типу Business Email Compromise (BEC) є другим найдорожчим типом порушення безпеки, із середньою загальною вартістю одного інциденту на рівні $4.89 млн, що включає витрати на виявлення, реагування, відновлення та інші бізнес-наслідки.

Водночас, за даними FBI Internet Crime Complaint Center (IC3), BEC-атаки призвели до прямих фінансових втрат для жертв у США на суму $2.7 млрд у 2022 році. Подальші звіти IC3 демонструють, що масштаб цієї загрози залишається стабільно високим: у 2023 році загальні зафіксовані втрати від BEC сягнули $2.95 млрд, а у 2024 році — $2.77 млрд, що підтверджує системний і довготривалий характер цієї загрози для бізнесу.

Чому BEC-атаки досі працюють

Технічний захист тут майже безсилий, листи приходять з легітимних або дуже схожих адрес, без шкідливих вкладень. Атака побудована на довірі, терміновості та знанні внутрішніх процесів. Саме тому BEC так складно виявити й зупинити.

Для бізнесу це означає просту, але критичну річ: навіть найкращі технології не компенсують відсутність чітких процесів верифікації фінансових операцій. Якщо платіж можна виконати лише на підставі одного email-запиту, компанія залишається вразливою.

Як бізнесу захиститися від BEC-атак

BEC неможливо зупинити лише технологіями - потрібна комбінація процесів, верифікації та культури безпеки.

Процеси верифікації фінансових операцій

Впровадьте правило подвійного підтвердження для всіх платежів понад встановлений ліміт. Будь-який запит на переказ коштів, зміну банківських реквізитів або додавання нового постачальника має підтверджуватися через альтернативний, незалежний від email канал зв’язку.

Критично: телефонуйте на номер, який вже є у вашій базі, а не на той, що вказаний у листі. Зловмисники часто додають у підпис підставний номер телефону для подальшої комунікації.

Встановіть чіткі процедури для термінових платежів, якщо CEO/CFO просить "терміново перевести гроші", це має активувати додаткову перевірку, а не прискорення процесу.

Технічні заходи

Налаштуйте попередження про зовнішні листи, якщо email приходить ззовні організації, співробітник має бачити помітне сповіщення, навіть якщо адреса виглядає знайомо.

Впровадити захист від domain spoofing: моніторинг реєстрації доменів, схожих на ваш (ve1stadt.com, velstadt.co тощо), та блокування листів з таких адрес.

Налаштуйте SPF, DKIM і DMARC для захисту корпоративного домену від підробки та перевірки справжності електронних листів. На рівні email gateway обов’язково перевіряйте результати SPF та DKIM і застосовуйте DMARC-політику, автоматично блокуючи або відправляючи в карантин листи, що її порушують.

Активуйте моніторинг компрометації облікових записів, якщо акаунт співробітника зламано, система має виявити аномальну активність: листи в незвичний час, зміни правил пересилання, підозрілі вкладення.

Навчання команди

Проводьте таргетовані симуляції BEC-атак, не загальний фішинг, а персоналізовані сценарії: лист від CEO про термінову оплату, запит від постачальника про зміну реквізитів, "клієнт" з проханням завантажити документ.

Навчіть розпізнавати “red flags”:

Незвична терміновість ("потрібно зараз, CEO чекає")

Прохання обійти стандартні процедури ("це конфіденційно, не обговорюй з колегами")

Зміни в стилі комунікації (CEO раптом пише ввічливіше або з помилками)

Запити на конфіденційні дані без контексту

Створіть культуру, де перевірка - це норма, а не недовіра. Співробітники не повинні боятися зателефонувати CEO й уточнити: "Ви дійсно просили це зробити?"

Моніторинг та реагування

Відстежуйте фінансові аномалії, раптові зміни реквізитів постачальників, нові бенефіціари, незвичні суми платежів.

Впровадити процес швидкого реагування на підозри, якщо хтось повідомив про підозрілий запит, у вас має бути протокол: хто перевіряє, як блокувати платіж, як інформувати керівництво.

Регулярно переглядайте права доступу: хто може ініціювати платежі, хто підтверджує, хто має доступ до фінансових систем. Скомпрометований акаунт з правами на платежі - це пряма загроза.

Критично важливо

BEC атакує не технології, а людей та процеси. Навіть якщо ваш email-gateway найкращий на ринку, але фінансовий директор може перевести $100K на основі одного листа без верифікації — ви вразливі.

Захист від BEC — це не проєкт, а постійна частина операційної діяльності. Процеси мають бути простими, зрозумілими й обов'язковими для всіх, включно з топ-менеджментом.

2. Email Spoofing

Що це означає для бізнесу

Spoofing — це атака, за якої зловмисники підробляють адресу відправника й розсилають листи від імені надійного джерела. Співробітник отримує повідомлення, яке виглядає цілком легітимним: від партнера, банку, керівника чи постачальника. Але всередині фішингові посилання, шкідливе ПЗ або запит на переказ коштів.

Ключовий ризик: довіра. Коли лист виглядає як офіційна комунікація, співробітники діють без підозри, відкривають файли, переходять за посиланнями, надають доступ до систем.

Spoofing належить до класу фішингових атак, де технічна підробка відправника поєднується із соціальною інженерією. Наслідки можуть бути серйозними: компрометація облікових записів, витік даних, фінансові втрати або використання “спуфінгу” як точки входу для подальших атак, зокрема ransomware.

Для бізнесу це означає не просто технічний інцидент, а ризик операційної зупинки, репутаційних втрат і регуляторних наслідків, особливо якщо під загрозою опиняються дані клієнтів або фінансові транзакції.

Як бізнесу захиститися від підміни email-адреси

Технічний захист — це фундамент, але без організаційних процесів він не спрацює.

Технічні заходи

Використовуйте SPF, DKIM та DMARC для автентифікації електронної пошти. Ці механізми перевіряють справжність відправника на рівні інфраструктури. Це блокує більшість автоматизованих spoofing-атак ще до того, як лист потрапить у поштову скриньку.

Використовуйте advanced email security рішення, які аналізують технічні та поведінкові ознаки поштового трафіку, репутацію відправників і доменів, виявляють spoofing та типові патерни і блокують підозрілу кореспонденцію ще до її доставки користувачу.

Активуйте multi-factor authentication (MFA) для всіх критичних систем, навіть якщо облікові дані скомпрометовані, доступ залишається захищеним.

Організаційні процеси

Навчіть команду розпізнавати ознаки spoofing: підроблені або схожі домени відправника, розбіжності в email-заголовках, несподівані вкладення чи посилання та відсутність чіткого контексту повідомлення.

Проводьте регулярні симуляції фішингових атак, не для покарання, а для вироблення рефлексів. Команда має знати, як виглядає справжня загроза.

Моніторинг та реагування

Відстежуйте спроби реєстрації схожих доменів, зловмисники часто купують домени, майже ідентичні вашому (наприклад, ve1stadt.com).

Побудуйте процес швидкого реагування на інциденти, якщо хтось повідомив про підозрілий лист, у вас має бути чіткий протокол: хто перевіряє, хто блокує, хто інформує команду.

Критично важливо

Spoofing — це не одноразова атака, це постійна загроза. Захист працює лише тоді, коли технології, процеси та люди синхронізовані. Одного технічного рішення недостатньо, потрібна системна кіберстійкість.

3. Spam

Що це означає для бізнесу

Spam — це масові небажані розсилки, які надходять на корпоративні поштові скриньки без запиту отримувача. На перший погляд, це найменш небезпечна загроза: зазвичай спам містить нав'язливу рекламу, а не шкідливе ПЗ чи фішингові посилання.

Але для бізнесу spam - це не просто роздратування. Це операційні втрати.

Як бізнесу захиститися від спаму

Ефективний захист від спаму - це комбінація технологій фільтрації та організаційної дисципліни.

Технічні заходи

Впровадьте багаторівневу систему фільтрації. Сучасні anti-spam рішення використовують машинне навчання для аналізу вмісту листів, репутації відправників, поведінкових патернів. Це блокує понад 95% спаму ще до потрапляння у поштові скриньки.

Використовуйте greylisting — технологія тимчасового відхилення листів від невідомих відправників. Легітимні поштові сервери автоматично повторюють спробу доставки, спам-боти — ні.

Активуйте захист від масових розсилок. Обмеження кількості листів з одного джерела за певний період, блокування відомих спам-доменів, фільтрація за ключовими словами та шаблонами.

Організаційні практики

Створіть політику використання корпоративної пошти, співробітники не повинні використовувати робочий email для реєстрації на сторонніх сервісах, підписок на розсилки, участі в онлайн-опитуваннях.

Рекомендується використовувати окремі адреси для публічних контактів, замість особистих корпоративних скриньок використовуйте загальні адреси типу info@, sales@, support@. Це локалізує спам та захищає персональні скриньки ключових співробітників.

Навчіть команду не відповідати на спам, будь-яка відповідь підтверджує, що адреса активна, що призводить до збільшення кількості спаму. Натомість, одразу позначати як спам або видаляти.

Гігієна безпеки

Регулярно перевіряйте, чи не потрапила ваша корпоративна база email-адрес у публічні витоки, якщо так, очікуйте збільшення спаму та посильте моніторинг фішингових атак.

Використовуйте унікальні email-aliases для різних сервісів, якщо адреса починає отримувати спам, ви одразу знаєте, який сервіс скомпрометовано або продав вашу базу.

Налаштуйте карантин замість повного видалення, спам-фільтри іноді помиляються. Важливі листи від нових партнерів або клієнтів можуть потрапити у спам. Карантин дозволяє швидко перевірити та відновити такі листи.

Моніторинг та оптимізація

Відстежуйте ефективність фільтрації, скільки спаму блокується, скільки проходить, чи є false positive (легітимні листи у спамі). Це дозволяє налаштовувати правила фільтрації під вашу специфіку.

Регулярно оновлюйте чорні та білі списки, додавайте відомі джерела спаму у блокування, перевірені домени партнерів у виключення.

Впровадьте звітність, щомісячний аналіз: скільки спаму заблоковано, скільки часу співробітників заощаджено, наскільки зменшилося навантаження на поштову інфраструктуру.

Критично важливо

Спам-фільтрація - це не одноразове налаштування. Спамери постійно адаптуються, змінюють тактики, використовують нові домени. Система захисту має бути динамічною, з регулярним оновленням правил та моніторингом ефективності.

Ефективний захист від спаму звільняє час команди, знижує навантаження на інфраструктуру та, що критично, зменшує "шумовий фон", у якому легше пропустити справжню загрозу - таргетований фішинг або BEC-атаку.

4. Email Flooding

Що це означає для бізнесу

Email flooding — це масова автоматизована розсилка беззмістовних повідомлень, часто з випадковим набором символів, яка перевантажує поштову інфраструктуру та блокує доступ до легітимної кореспонденції.

На відміну від спаму, мета флуду не реклама, а парaліч комунікації. Коли на корпоративну скриньку надходить 100+ листів за секунду або більше, поштовий сервер не встигає обробляти трафік, співробітники втрачають доступ до критичних повідомлень, а бізнес-процеси зупиняються.

Як бізнесу захиститися від масового перевантаження пошти

Захист від флуду вимагає інфраструктури, яка може поглинати аномальні обсяги трафіку, та організаційних процедур для швидкого відновлення комунікації.

Технічні заходи

Впровадьте rate limiting на рівні поштового сервера, обмеження кількості листів, які можуть бути прийняті з одного джерела за певний період. Якщо з однієї IP-адреси або домену надходить 50+ листів за хвилину, система автоматично блокує такий трафік.

Використовуйте anti-flood фільтри з аналізом поведінки, сучасні рішення виявляють аномалії: раптове збільшення обсягу пошти, повторювані патерни, беззмістовні повідомлення, ідентичні заголовки з мінімальними змінами.

Налаштуйте пріоритизацію трафіку, навіть під час флуд-атаки критично важливі листи (від верифікованих партнерів, внутрішня кореспонденція, системні повідомлення) мають обробляються в першу чергу.

Розгорніть distributed email infrastructure, якщо один поштовий сервер перевантажений, трафік автоматично перенаправляється на резервні вузли. Це забезпечує безперервність комунікації навіть під час атаки.

Моніторинг та раннє виявлення

Впровадьте real-time моніторинг обсягів пошти, система має сигналізувати, якщо кількість вхідних листів перевищує нормальні показники в 5-10 разів. Чим швидше виявлено флуд, тим менше часу потрібно на нейтралізацію.

Відстежуйте джерела трафіку: якщо атака надходить з конкретних IP-адрес, підмереж або автономних систем (ASN), їх можна оперативно заблокувати на рівні firewall або поштового gateway. Додаткові перевірки на рівні email gateway можуть враховувати репутаційні та політичні правила обробки пошти.

Налаштуйте автоматичні alerts для IT-команди, флуд-атака вимагає негайної реакції. Кожна хвилина затримки – це сотні або тисячі непотрібних листів у системі.

Організаційні процедури

Створіть план реагування на флуд-атаку, хто отримує сповіщення, хто приймає рішення про блокування трафіку, як комунікувати з командою під час простою пошти, які альтернативні канали зв'язку активувати (Slack, Teams, телефон).

Впровадьте backup-канали комунікації, якщо корпоративна пошта недоступна, критичні відділи (продажі, підтримка, фінанси) мають знати, як продовжувати роботу: резервні email-адреси, месенджери, телефонні лінії.

Регулярно тестуйте процедури відновлення, симулюйте флуд-атаку у контрольованих умовах, перевірте, чи спрацьовують фільтри, чи команда знає, що робити, скільки часу потрібно на повернення до нормальної роботи.

Дії після інциденту

Аналізуйте джерела та патерни атаки звідки надходив флуд, які вразливості використовувалися, чи був це одноразовий інцидент або частина тривалішої кампанії.

Оновлюйте правила фільтрації на основі нових даних, кожна атака дає інформацію про тактики зловмисників. Використовуйте це для посилення захисту.

Інформуйте команду про інцидент, співробітники мають розуміти, що сталося, чому пошта була недоступна, як діяти у майбутньому, якщо ситуація повториться.

Критично важливо

Флуд — це атака на доступність, а не на конфіденційність. Мета - не вкрасти дані, а зупинити операції. Тому захист має фокусуватися на стійкості інфраструктури, швидкості виявлення та процедурах відновлення.

Компанії, де email - критичний канал комунікації (продажі, підтримка клієнтів, фінансові операції), не можуть дозволити собі години простою. Інвестиції в anti-flood захист та резервні канали комунікації - це не витрати, а страховка від операційного паралічу.

5. Credential Harvesting

Що це означає для бізнесу

Credential Harvesting – це атака, спрямована на викрадення облікових даних користувачів (логінів, паролів, MFA-токенів або session cookies). Найчастіше вона є не кінцевою метою, а першим етапом більш складного інциденту.

Для бізнесу це одна з найнебезпечніших загроз, оскільки скомпрометовані облікові дані дозволяють зловмиснику діяти легітимно: входити в системи без підвищеної підозри, обходити частину контролів і поступово розширювати доступ. Викрадені облікові дані використовуються для:

Доступу до корпоративної пошти.

Реалізації BEC-сценаріїв.

Доступу до VPN, CRM, фінансових і хмарних сервісів.

Подальших атак, включно з Ransomware.

Credential harvesting часто реалізується через фішингові сторінки, QR-фішинг (quishing), а також через шкідливі вкладення або посилання, що імітують легітимні форми автентифікації.

Як бізнесу захиститися від викрадення облікових даних

Технічні заходи

Забезпечте MFA для всіх облікових записів, особливо привілейованих, надаючи перевагу методам, стійким до фішингу (наприклад, апаратні ключі або сертифікатна автентифікація).

Застосовуйте політики Conditional Access для контролю доступу з урахуванням геолокації, стану пристрою та ознаків підозрілого входу (наприклад, новий пристрій або нетиповий час активності)

Впровадьте identity protection з поведінковим аналізом (нетипові сесії, швидкі зміни IP, повторне використання токенів).

Обмежуйте доступ до критичних систем за принципами Zero Trust, надаючи користувачам лише той рівень доступу, який потрібен для виконання їхніх робочих задач.

Моніторинг та раннє виявлення

Контролюйте аномальні події автентифікації: нові пристрої, незвичні локації, нетиповий час активності.

Регулярно відстежуйте ознаки компрометації облікових записів, зокрема підозрілу активність усередині систем та появу облікових даних у публічних витоках або dark web-джерелах.

Організаційні процеси

Визначте політики управління обліковими даними: ротація, відкликання доступів, аудит привілеїв.

Забезпечте швидкий процес блокування акаунтів при підозрі на компрометацію.

Регулярно перевіряйте сторонні інтеграції та додатки, які мають доступ до облікових записів, зокрема сервіси, підключені через OAuth, API-токени або інші механізми делегованого доступу, а також обсяг наданих їм прав.

Навчання команди

Навчайте співробітників розпізнавати фішингові сторінки та підроблені форми входу.

Пояснюйте ризики повторного використання паролів та збереження облікових даних у браузері.

Проводьте навчання з акцентом на сценарії «що робити, якщо ви ввели пароль на підозрілій сторінці».

Критично важливо

Credential harvesting є атаками на ідентичність, які часто використовуються як початковий етап для подальшої компрометації інфраструктури. Після отримання облікових даних зловмисники діють у межах легітимних сесій, що ускладнює виявлення та потребує комплексного підходу до захисту.

6. QR-фішинг (Quishing): атаки через QR-коди

Що це означає для бізнесу

QR-код фішинг (Quishing) – це різновид фішингової атаки, за якої зловмисники використовують QR-коди як механізм доставки шкідливих посилань. На відміну від класичного email-фішингу, де користувач бачить URL або може перевірити посилання, QR-код приховує справжній напрямок переходу до моменту сканування.

Для бізнесу це створює особливо небезпечний сценарій: співробітник може отримати лист, PDF-документ, рахунок або внутрішнє повідомлення з QR-кодом, відсканувати його з корпоративного або особистого смартфона та перейти на фішингову сторінку. Часто такі сторінки імітують:

Портали входу (Microsoft 365, Google Workspace, VPN, HR-системи).

Сторінки підтвердження MFA або «перевірки безпеки».

Форми оновлення паролю або перегляду документа.

Quishing особливо ефективний проти організацій, які активно використовують мобільні пристрої, BYOD або QR-коди у внутрішніх процесах (офіси, склади, логістика, фінанси).

Компрометація облікових даних часто стає початковою точкою для подальшого розвитку інциденту: зловживання ідентичністю (BEC), розширення доступу всередині інфраструктури (lateral movement) та, у підсумку, руйнівних атак, як шифрування даних чи інфраструктури та інших.

Як бізнесу захиститися від QR-фішингу

Технічні заходи

Використовуйте email security рішення, здатні виявляти QR-коди у вкладеннях і тілі листів та застосовувати додаткову перевірку вмісту.

Застосовуйте sandboxing та динамічний аналіз URL, на які ведуть QR-коди, з перевіркою поведінки сторінки після фактичного переходу користувача.

Обмежуйте доступ до корпоративних ресурсів з мобільних пристроїв через Conditional Access, MDM або Zero Trust підходи.

Забезпечте MFA для всіх критичних систем, щоб компрометація паролю не означала автоматичний доступ.

Моніторинг та раннє виявлення

Відстежуйте аномальні спроби входу з мобільних браузерів, нових пристроїв або нетипових геолокацій.

Корелюйте події використовуючи системи моніторингу (SIEM): отримання листа з QR-кодом → перехід за посиланням → спроба аутентифікації.

Аналізуйте появу нових фішингових доменів, що імітують ваші сервіси або бренди.

Організаційні процеси

Визначте чіткі правила використання QR-кодів у бізнес-процесах: де вони дозволені, а де — заборонені.

Забороніть використання QR-кодів для критичних дій (аутентифікація, зміна паролю, фінансові операції).

Забезпечте швидкий процес ескалації, якщо співробітник відсканував підозрілий QR-код.

Навчання команди

Навчіть співробітників простому правилу: QR-код — це приховане посилання.

Пояснюйте типові ознаки quishing-атак: несподівані QR-коди, термінові дії, прохання «підтвердити доступ».

Регулярно проводьте симуляції саме QR-фішингових сценаріїв, а не лише класичного email-фішингу.

Критично важливо

Quishing – це приклад того, як зловмисники обходять традиційні фільтри, експлуатуючи довіру до візуальних елементів і мобільних сценаріїв. Захист можливий лише за умови поєднання технічних контролів, процесних обмежень і усвідомленої поведінки користувачів.

Email-безпека: ключові висновки для бізнесу

Електронна пошта — це не просто канал комунікації, а фактичні «двері» для зловмисників, які відкривають можливість отримати чутливу інформацію, скомпрометувати облікові дані і, зрештою, зупинити критичні бізнес-процеси.

BEC та credential harvesting залишаються найбільш ризиковими сценаріями для бізнесу з точки зору наслідків. Навіть за наявності технічних засобів захисту їх успішна реалізація, як правило, пов’язана з експлуатацією довіри та слабких процесів і може мати прямий фінансовий та операційний вплив.

Технології без процесів не працюють. Навіть найкращі рішення для захисту електронної пошти не компенсують відсутність чітких процедур, якщо фінансові операції або критичні дії виконуються без обов’язкової верифікації через незалежні канали.

Захист електронної пошти починається з управління ідентичністю (IAM). MFA, conditional access, моніторинг аномалій автентифікації та контроль сесій є базовими елементами захисту на рівні ідентичності, що дозволяють запобігати зловживанню обліковими даними та компрометації доступів.

Ефективність захисту напряму залежить від дій співробітників у реальних ситуаціях. Класичні тренінги з фішингу не формують практичних навичок — реальну цінність мають лише симуляції BEC, QR-фішингу та інших таргетованих сценаріїв, адаптованих до конкретних ролей і бізнес-процесів.

Моніторинг і кореляція подій визначають швидкість реагування. Виявлення email-загроз має ґрунтуватися на кореляції подій із поштових систем та систем управління ідентичністю в межах SIEM, що забезпечує своєчасне виявлення компрометації та контрольоване реагування на інциденти.

Email-безпека — це постійний процес, а не одноразовий проєкт. Тактики атак постійно змінюються, тому захист має регулярно переглядатися, тестуватися та адаптуватися до актуального ландшафту загроз.

Наступні кроки для захисту корпоративної пошти

Якщо електронна пошта є критичним каналом бізнес-комунікації, варто не обмежуватися загальними рекомендаціями, а оцінити, наскільки ваша інфраструктура, процеси та команда здатні виявляти та ефективно реагувати на описані загрози, з урахуванням реальних ролей, бізнес-процесів і сценаріїв атак.

Саме тому Velstadt залучається до оцінки готовності бізнесу до email-загроз, фокусуючись на тому, наскільки узгоджено працюють технології, процеси та відповідальні ролі, а також чи здатна організація своєчасно виявляти та стримувати сценарії атак без порушення безперервності операцій і ключових бізнес-процесів.

### Pages

#### Awards & Recognition
URL: https://velstadt.com/awards-recognition/

#### Blog
URL: https://velstadt.com/blog/

#### Cases
URL: https://velstadt.com/cases/

#### Certifications & Credentials
URL: https://velstadt.com/certifications-credentials/

#### International Privacy Notice
Last updated: 16 January 2026

Velstadt Ukraine LLC (“we”, “our”, “us”) attaches great importance to the security and confidentiality of your personal data. This Privacy Notice (the "Notice", the “Policy”, the “Privacy Notice”, the “Privacy Policy”) explains our practices in relation to the processing of personal data of individuals.

1. WHO IS “WE”?

Whenever you see a reference to “we” in this privacy notice, it actually refers to VelstadtUkraine LLC:

Full legal name: “VELSTADT UKRAINE” LIMITED LIABILITY COMPANY

Legal address: 04214, Ukraine, Kyiv city, Pivnichna street, building 54 , apartment 205 We are the data controller responsible for the collection and use of your personal data in the manner explained in this privacy notice. If you have any questions about this, please get in touch with us via e-mail: privacy@velstadt.com

When we process personal information we follow the rules and provisions of the Ukrainian law on personal data protection (Law of Ukraine № 2297 – VI). Moreover, since we are committed to protecting your privacy, Velstadt Ukraine LLC voluntarily adheres to the data protection principles outlined in the General Data Protection Regulation (GDPR).

Please note that in certain circumstances, third parties may (also) be responsible for the processing of your personal data. In that case, we recommend that you consult the privacy policies of these third parties.

2. WHEN ARE YOUR PERSONAL DATA COLLECTED AND USED?

We collect and use your personal data in the following cases:

when you contact us through the available channels of communication

to share with you marketing material or our newsletter

3. WHAT IF THIS PRIVACY NOTICE DOES NOT ANSWER ALL OF YOUR QUESTIONS?

The data protection laws oblige us to provide you with quite a lot of information. Should you have further questions regarding the processing of your personal data, do not hesitate to contact us via e-mail: privacy@velstadt.com

4. WHAT PERSONAL DATA DO WE PROCESS AND WHY?

4.1. When you contact us or communicate with us

Data processedPurpose of processingLegal basisFull nameEmail addressCompany nameCountryMessage content or otherinformation you choose toprovideWe need this information toprocess your request andeventually address itLegal interest

4.2. To share with you marketing material

Data processedPurpose of processingLegal basisFull nameEmail addressCompany nameCountryLegal obligationsConsent

4.3. Technical and usage data

When you visit our Website or interact with our services, we may automatically collectcertain technical and operational data necessary for the secure and reliable operation of theWebsite.

This may include:

IP address

User-agent and browser information

Device and operating system details

Date and time of requests

Referring URLs and interaction metadata

This data is collected through web servers, security systems, logging mechanisms, andsimilar technologies, and may be processed as part of our security monitoring, incidentdetection, and audit processes.

5. WITH WHOM DO WE SHARE YOUR PERSONAL DATA?

n principle, we do not share your personal data with anyone but the providers who help usprocess your personal data. For example, we rely on the Cloudflare services and might shareyour data with this company. You can also check the company privacy policy here. Anyonewho has access to your personal data will always be bound by strict legal or contractualobligations to keep your personal data safe and confidential.

Personal data may be processed or stored in jurisdictions outside the European EconomicArea where our service providers operate. In such cases, appropriate safeguards are appliedin accordance with applicable data protection laws.

We may also disclose personal data where required to comply with legal obligations,enforce our rights, or respond to lawful requests from public authorities.Please note: We do not sell personal data to third parties.

6. HOW LONG DO WE KEEP YOUR PERSONAL DATA?

Your personal data will be processed only for as long as necessary to achieve the purposesoutlined in this policy or, if processing is based on your consent, until you withdraw thatconsent.

Retention periods may vary depending on the type of data, the purpose of processing, andapplicable legal or regulatory requirements. Personal data is periodically reviewed anddeleted or anonymised when no longer required.

7. WHAT DO WE DO TO KEEP YOUR PERSONAL DATA SAFE?

The security and confidentiality of all data we process is very important to us. Hence, wehave taken steps to ensure that all personal data processed are kept safe. These stepsinclude processing only the personal data required for achieving the purposes we havecommunicated to you. We have also taken technical and organisational measures to secureour infrastructure, systems, applications, premises and processes.

8. WHICH RIGHTS DO YOU HAVE WITH REGARD TO YOUR PERSONAL DATA?

You have the following rights in relation to the processing of your personal data, which weare committed to respecting:

Right of Access: You have the right to request access to the personal data we hold about you. This includes obtaining confirmation as to whether or not your personal data is being processed, and if so, receiving a copy of the data in an understandable format along with information about how and why we are processing it.

Right to Rectification: If any of the personal data we hold about you is inaccurate or incomplete, you have the right to request its correction or completion. We will promptly make the necessary changes to ensure your information is up-to-date.

Right to Erasure (Right to be Forgotten): You have the right to request the deletion of your personal data when it is no longer necessary for the purposes for which it was collected if you withdraw your consent, or if you object to the processing and we have no legitimate overriding interest to continue processing. You can also request erasure if your data is being processed unlawfully or if it must be erased to comply with a legal obligation.

Right to Data Portability: You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format. You can also request that we transfer this data to another controller where it is technically feasible.

Right to Object: You have the right to object to the processing of your personal data at any time, especially in cases where the processing is based on our legitimate interests, including profiling. If you object, we will stop processing your data unless we can demonstrate compelling legitimate grounds for the processing that override your rights and interests or if the processing is necessary for legal claims.

Right to Restrict Processing: You can request that we limit the processing of your personal data in specific situations, such as when you contest the accuracy of the data, if the processing is unlawful but you prefer restriction over deletion, or if you need the data to be preserved for legal claims despite us no longer needing it for processing purposes.

Right to Withdraw Consent: If we are processing your personal data based on your consent, you have the right to withdraw that consent at any time. Once consent is withdrawn, we will stop processing your personal data for the purposes you initially agreed to, unless we have another legal basis for continuing the processing.

To exercise any of these rights, please contact us at privacy@velstadt.com

Please note that whenever you wish to exercise a right, we might ask you for proof ofidentity. We would like to avoid an unauthorised person obtaining your personalinformation while pretending to be you. This would result in a data breach.

You also have the right to lodge a complaint with your local data protection authority (DPA)if you believe we are not handling your data in accordance with the law.For Ukraine, the competent authority is the Ombudsman of Ukraine.Website: https://ombudsman.gov.ua/

Also, you can find information on the DPA of the EU Member State here: Link

#### Resources
URL: https://velstadt.com/resources/

#### Security that sees threats coming
URL: https://velstadt.com/

#### Terms & Conditions
Last updated: [10.04.2026]

Welcome to Velstadt. By accessing or using our website, you agree to be bound by these Terms & Conditions. If you do not agree with any part of the terms, please do not use the website.

1. Use of the website

You agree to use this website only for lawful purposes. You must not use it in any way that may cause damage to the website or impair access to it.

2. Intellectual property

All content on this website, including text, images, graphics, logos, and design, is the property of [назва компанії/сайту] unless otherwise stated. You may not copy, reproduce, or distribute any material without prior written permission.

3. User responsibilities

When using this website, you agree not to:

Submit false or misleading information

Attempt to gain unauthorized access to systems

Use the website for any illegal activities

4. Limitation of liability

We do our best to ensure that the information on this website is accurate and up to date, but we do not guarantee its completeness or accuracy. We are not liable for any damages resulting from the use of this website.

5. External links

Our website may contain links to third-party websites. We are not responsible for the content or practices of these external sites.

6. Changes to terms

We reserve the right to update or modify these Terms & Conditions at any time without prior notice. Continued use of the website means you accept the updated terms.

7. Contact

If you have any questions about these Terms & Conditions, please contact us at:[email@example.com]

#### Блог
URL: https://velstadt.com/ua/blog/

#### Головна
URL: https://velstadt.com/ua/

#### Кейси
URL: https://velstadt.com/ua/cases/

#### Нагороди та відзнаки
URL: https://velstadt.com/ua/awards-recognition/

#### Політика конфіденційності
Хто ми

Рекомендований текст: Адреса нашого вебсайту: http://vel.

Коментарі

Рекомендований текст: Коли відвідувачі залишають коментарі на сайті, ми збираємо дані, вказані у формі коментаря, а також IP-адресу відвідувача та рядок user agent браузера для допомоги у виявленні спаму.

Анонімізований рядок, створений з вашої електронної адреси (також званий хешем), може бути переданий сервісу Gravatar, щоб перевірити, чи використовуєте ви його. Політика конфіденційності сервісу Gravatar доступна тут: https://automattic.com/privacy/. Після затвердження вашого коментаря ваше фото профілю буде публічно видимим у контексті коментаря.

Медіа

Рекомендований текст: Якщо ви завантажуєте зображення на сайт, слід уникати завантаження зображень із вбудованими даними про місцезнаходження (EXIF GPS). Відвідувачі сайту можуть завантажувати та витягувати будь-які дані про місцезнаходження із зображень на сайті.

Cookies

Рекомендований текст: Якщо ви залишаєте коментар на нашому сайті, ви можете погодитися на збереження вашого імені, електронної адреси та вебсайту в cookies. Це для вашої зручності, щоб вам не доводилося повторно вводити ці дані при наступних коментарях. Ці cookies зберігаються протягом одного року.

Якщо ви відвідуєте сторінку входу, ми створимо тимчасовий cookie, щоб перевірити, чи підтримує ваш браузер cookies. Цей cookie не містить персональних даних і видаляється після закриття браузера.

Після входу ми також встановлюємо кілька cookies для збереження інформації про вхід та налаштування відображення. Cookies входу зберігаються два дні, а cookies налаштувань екрана — один рік. Якщо ви обираєте «Запам’ятати мене», вхід зберігається два тижні. Після виходу cookies входу видаляються.

Якщо ви редагуєте або публікуєте статтю, у вашому браузері буде збережено додатковий cookie. Він не містить персональних даних і лише вказує ID редагованої статті. Він спливає через 1 день.

Вбудований контент з інших вебсайтів

Рекомендований текст: Статті на цьому сайті можуть містити вбудований контент (наприклад, відео, зображення, статті тощо). Вбудований контент з інших вебсайтів поводиться так само, як якщо б відвідувач відвідав той самий інший вебсайт.

Ці вебсайти можуть збирати дані про вас, використовувати cookies, вбудовувати додаткове стороннє відстеження та відслідковувати вашу взаємодію з цим контентом, включно з відстеженням, якщо у вас є акаунт і ви увійшли на той вебсайт.

З ким ми ділимося вашими даними

Рекомендований текст: Якщо ви запитуєте скидання пароля, ваша IP-адреса буде включена в лист для скидання.

Як довго ми зберігаємо ваші дані

Рекомендований текст: Якщо ви залишаєте коментар, коментар і його метадані зберігаються безстроково. Це потрібно, щоб ми могли автоматично розпізнавати та схвалювати подальші коментарі замість їх утримання в черзі модерації.

Для користувачів, які реєструються на нашому сайті (якщо такі є), ми також зберігаємо персональну інформацію, яку вони надають у своєму профілі. Усі користувачі можуть переглядати, редагувати або видаляти свою персональну інформацію в будь-який час (крім зміни імені користувача). Адміністратори сайту також можуть переглядати та редагувати цю інформацію.

Які права ви маєте щодо ваших даних

Рекомендований текст: Якщо у вас є обліковий запис на цьому сайті або ви залишали коментарі, ви можете запросити експортований файл персональних даних, які ми зберігаємо про вас, включно з усіма наданими даними. Ви також можете вимагати видалення будь-яких персональних даних, які ми зберігаємо про вас. Це не включає дані, які ми зобов’язані зберігати з адміністративних, юридичних або безпекових причин.

Куди надсилаються ваші дані

Рекомендований текст: Коментарі відвідувачів можуть перевірятися через автоматизований сервіс виявлення спаму.

#### Правила та умови
Останнє оновлення: [10.04.2026]

Ласкаво просимо на сайт Velstadt. Використовуючи цей сайт, ви погоджуєтесь із цими Умовами користування. Якщо ви не погоджуєтесь із будь-якою частиною цих умов, будь ласка, не використовуйте сайт.

1. Використання сайту

Ви зобов’язуєтесь використовувати цей сайт лише у законних цілях. Забороняється використовувати його у спосіб, який може завдати шкоди сайту або обмежити доступ до нього.

2. Інтелектуальна власність

Увесь контент на цьому сайті, включаючи текст, зображення, графіку, логотипи та дизайн, є власністю [назва компанії/сайту], якщо не зазначено інше. Забороняється копіювати, відтворювати або поширювати матеріали без попереднього письмового дозволу.

3. Обов’язки користувача

Користуючись цим сайтом, ви погоджуєтесь не:

надавати неправдиву або оманливу інформацію

намагатися отримати несанкціонований доступ до систем

використовувати сайт для незаконної діяльності

4. Обмеження відповідальності

Ми прагнемо забезпечити актуальність і точність інформації на сайті, однак не гарантуємо її повноту або безпомилковість. Ми не несемо відповідальності за будь-які збитки, що можуть виникнути внаслідок використання сайту.

5. Зовнішні посилання

Наш сайт може містити посилання на сторонні ресурси. Ми не несемо відповідальності за їхній вміст або політику конфіденційності.

6. Зміни до умов

Ми залишаємо за собою право змінювати або оновлювати ці Умови користування у будь-який час без попереднього повідомлення. Подальше використання сайту означає вашу згоду з оновленими умовами.

7. Контакти

Якщо у вас є запитання щодо цих Умов користування, будь ласка, зв’яжіться з нами:[email@example.com]

#### Ресурси
URL: https://velstadt.com/ua/resources/

#### Сертифікації та кваліфікації
URL: https://velstadt.com/ua/certifications-credentials/

### Media

#### Amazon Web Services (AWS)
AWS (Amazon Web Services) logo representing a global leader in cloud computing, used within Velstadt’s technology ecosystem to support scalable, secure, and high-performance cybersecurity solutions.

#### avatar
URL: https://velstadt.com/?attachment_id=618

#### case
URL: https://velstadt.com/?attachment_id=617

#### Cisco Technology Partner
Cisco logo representing a global technology leader in networking and cybersecurity solutions, used in the context of Velstadt’s technology ecosystem and partnerships.

#### cloud_2025 1 (2)
URL: https://velstadt.com/?attachment_id=960

#### cloud_2025 1 (3)
URL: https://velstadt.com/?attachment_id=962

#### Cloudflare Security & Performance
Cloudflare logo representing a leading provider of internet security, DDoS protection, and performance optimization services, used within Velstadt’s technology ecosystem to secure applications, networks, and digital infrastructure at the edge.

#### Clutch Champion Award - Fall 2024
This image represents the Clutch Champion Award for Fall 2024, recognizing Velstadt as one of the top-performing companies based on verified client reviews, service quality, and market presence in cybersecurity.

#### Clutch Global Award - Fall 2024
This image represents the Clutch Global Award for Fall 2024, recognizing Velstadt for outstanding performance, verified client reviews, and strong presence in the global cybersecurity services market.

#### Clutch Global Award - Spring 2024
This image represents the Clutch Global Award for Spring 2024, recognizing Velstadt for outstanding service quality, verified client reviews, and strong presence in the global cybersecurity services market.

#### CrowdStrike Falcon Platform
CrowdStrike logo representing a leading cybersecurity company specializing in endpoint detection and response (EDR) and threat intelligence, used within Velstadt’s technology ecosystem to detect, prevent, and respond to advanced cyber threats in real time.

#### Database Records and Password Hashes
A screenshot from an authorized penetration test showing access to database records containing administrative account information and password hashes. Sensitive values are redacted. The evidence demonstrates that the compromise path extended beyond remote code execution and allowed access to sensitive database contents.

#### Devlight - Velstadt Client
Devlight logo representing a technology client of Velstadt, highlighting experience in delivering cybersecurity services for software development companies and digital product environments.

#### Devlight Mobile Application Security Success Story
Visual for the Devlight success story showing a smartphone with a secure digital interface and Devlight branding. The image represents Velstadt’s mobile application security assessment and tailored penetration testing approach.

#### Exposed elFinder File Manager
A screenshot from an authorized penetration test showing an exposed elFinder web file manager accessible without authentication. The interface allowed access to server directories and file management actions, creating a direct path to further exploitation.

#### featured
URL: https://velstadt.com/home/featured/

#### file
URL: https://velstadt.com/home/file/

#### Follow Velstadt on Bluesky
Bluesky icon linking to Velstadt’s official profile, where the company shares cybersecurity insights, threat intelligence expertise, and updates on emerging threats.

#### Follow Velstadt on Facebook
Facebook icon linking to Velstadt’s official page, where the company shares cybersecurity insights, updates, and industry expertise.

#### Follow Velstadt on Instagram
Instagram icon linking to Velstadt’s official page, where the company shares cybersecurity insights, updates, and industry expertise.

#### Follow Velstadt on LinkedIn
LinkedIn icon linking to Velstadt’s official page, where the company shares cybersecurity insights, threat intelligence expertise, and industry updates.

#### Follow Velstadt on X
X (Twitter) icon linking to Velstadt’s official profile, where the company shares real-time cybersecurity updates, threat intelligence insights, and expert commentary on emerging threats.

#### G2 High Performer 2026 - Velstadt
This image represents the G2 High Performer 2026 badge awarded to Velstadt, recognizing strong customer satisfaction scores and positive verified reviews in the cybersecurity market.

#### Google Cloud & Security
Google logo representing a global technology leader in cloud computing, data analytics, and cybersecurity solutions, used within Velstadt’s technology ecosystem to support scalable, secure, and high-performance services.

#### Google Cloud & Security
Google logo representing a global technology leader in cloud computing, data analytics, and cybersecurity solutions, used within Velstadt’s technology ecosystem to support scalable, secure, and high-performance services.

#### hero
URL: https://velstadt.com/hero/

#### How Email Attacks Disrupt Business - A Practical Guide to Email Security
This image supports an article about email security and the business impact of email attacks, including Business Email Compromise (BEC), phishing, spoofing, credential harvesting, spam, email flooding, and QR code phishing. It highlights how email-based threats lead to financial loss, account compromise, operational disruption, and increased business risk, while emphasizing the need for stronger email protection, identity security, and business resilience.

#### How Email Attacks Disrupt Business - A Practical Guide to Email Security
This image supports an article about email security and the business impact of email attacks, including Business Email Compromise (BEC), phishing, spoofing, credential harvesting, spam, email flooding, and QR code phishing. It highlights how email-based threats lead to financial loss, account compromise, operational disruption, and increased business risk, while emphasizing the need for stronger email protection, identity security, and business resilience.

#### Ihor Polych CEO DEVLIGHT.jpg
URL: https://velstadt.com/cases/devlight-mobile-app-security-assurance/ihor-polych-ceo-devlight-jpg/

#### IITD - Velstadt Client
URL: https://velstadt.com/ua/golovna/iitd/

#### image (2)
URL: https://velstadt.com/?attachment_id=965

#### image (3)
URL: https://velstadt.com/?attachment_id=967

#### image (4)
URL: https://velstadt.com/?attachment_id=969

#### image (5)
URL: https://velstadt.com/?attachment_id=971

#### Image wrap
URL: https://velstadt.com/?attachment_id=974

#### ING - Velstadt Client
ING logo representing an international financial institution client of Velstadt, highlighting experience in delivering cybersecurity services for banking environments with high requirements for security, compliance, and operational resilience.

#### IT Ukraine Association - Velstadt client
IT Ukraine Association logo representing Velstadt’s membership and involvement in the national IT and cybersecurity ecosystem

#### lightning
URL: https://velstadt.com/home/lightning/

#### medal (3) (1) 1 (1)
URL: https://velstadt.com/?attachment_id=958

#### Microsoft Technology
Microsoft logo representing a global leader in cloud computing, enterprise software, and cybersecurity solutions, used within Velstadt’s technology ecosystem to support secure, scalable, and resilient business operations.

#### Netcracker - Velstadt Client
Netcracker logo representing an enterprise client of Velstadt, highlighting experience in delivering cybersecurity services for large-scale IT and telecommunications environments requiring high reliability, security, and operational resilience.

#### Nova Post - Velstadt Client
Nova Post logo representing a logistics sector client of Velstadt, highlighting experience in delivering cybersecurity services for large-scale operations, critical infrastructure, and high-volume digital environments.

#### Nova Post Proactive Threat Response with Velstadt
Success story image for Nova Post and Velstadt, illustrating external threat intelligence, dark web monitoring, brand impersonation monitoring, and proactive cyber defense for logistics operations.

#### Phantom Threat Intelligence Platform - Advanced Cyber Threat Analytics
This image showcases the Phantom Threat Intelligence Platform, a proprietary solution developed by Velstadt to provide real-time monitoring, analysis, and correlation of cyber threats across multiple sources, including dark web, forums, and messaging platforms. Phantom enables organizations to identify emerging threats, detect compromised data, and enhance incident response through actionable intelligence, improving overall cybersecurity posture and business resilience.

#### Phantom Threat Intelligence Platform - Advanced Cyber Threat Analytics
This image showcases the Phantom Threat Intelligence Platform, a proprietary solution developed by Velstadt to provide real-time monitoring, analysis, and correlation of cyber threats across multiple sources, including dark web, forums, and messaging platforms. Phantom enables organizations to identify emerging threats, detect compromised data, and enhance incident response through actionable intelligence, improving overall cybersecurity posture and business resilience.

#### PHP Web Shell Command Execution
A screenshot from an authorized penetration test showing a PHP web shell used to validate command execution on the affected server. The web shell was uploaded through the exposed elFinder file manager into a web-accessible directory, confirming remote code execution under the permissions of the web service account.

#### RCE
A minimalist cyber-themed illustration for a Velstadt case study on remote code execution. The image represents a remote attacker using a laptop to execute code against distant server infrastructure, with subtle data streams, dark-blue tones, and atmospheric fog.

#### Read Velstadt on Medium
Medium icon linking to Velstadt’s official publication, where the company shares in-depth articles on cybersecurity, threat intelligence, and analysis of emerging cyber threats.

#### report
URL: https://velstadt.com/resources/it-contractor-security-self-assessment-checklist/report/

#### resource
URL: https://velstadt.com/resources/it-contractor-security-self-assessment-checklist/resource/

#### Security Misconfiguration and Path Traversal
A conceptual cybersecurity illustration showing a leaking bucket with a path traversal folder symbol and footprints leading into an open server room. The image represents how security misconfiguration and unsafe file-handling logic can expose sensitive local files and create a path toward further infrastructure compromise.

#### Sheriff - Velstadt Client
Sheriff logo representing a client of Velstadt, highlighting experience in delivering cybersecurity services and supporting the protection of digital infrastructure and operational resilience.

#### SNT - Velstadt Client
SNT logo representing a client of Velstadt, highlighting experience in delivering cybersecurity services and supporting business resilience through advanced security solutions.

#### SOAP_requests_bash_history
Screenshot of a crafted SOAP request sent to a WSO2 file management service. The request uses directory traversal sequences in the file_name parameter to access the server’s .bash_history file, illustrating how local file read can expose operational commands and potentially sensitive environment details.

#### SOAP_requests_etc_passwd
Screenshot of a crafted SOAP request sent to a WSO2 file management service. The request uses directory traversal sequences in the file_name parameter to move outside the intended directory and retrieve /etc/passwd, demonstrating path traversal leading to unauthorized local file read.

#### Splunk SIEM Platform
Splunk logo representing a leading SIEM and data analytics platform, used within Velstadt’s technology ecosystem to enable real-time threat detection, log analysis, and security event correlation across enterprise environments.

#### stars
URL: https://velstadt.com/home/stars/

#### Stfalcon - Velstadt Client
Stfalcon logo representing a client of Velstadt, highlighting successful collaboration in delivering cybersecurity services and supporting the protection of digital infrastructure and business operations.

#### Tenable Technology
Tenable logo representing a leading provider of vulnerability management and exposure assessment solutions, used within Velstadt’s technology ecosystem to enhance security visibility and risk reduction.

#### Top Dark Web Monitoring Company 2025 (Clutch)
This image represents the Clutch award recognizing Velstadt as a Top Dark Web Monitoring Company for 2025. The recognition is based on verified client reviews, market presence, and the company’s ability to detect data leaks, monitor dark web sources, and provide actionable threat intelligence insights.

#### Top Managed SIEM Service Company - New York 2025 (Clutch)
This image represents the Clutch award recognizing Velstadt as a Top Managed SIEM Service Company in New York for 2025. The award is based on verified client reviews, market presence, and the company’s ability to deliver high-quality SIEM and security monitoring services.

#### Top Software Testing Company - New York 2025 (Clutch)
This image represents the Clutch award recognizing Velstadt as a Top Software Testing Company in New York for 2025. The recognition is based on verified client reviews, service quality, and the company’s ability to deliver effective testing and cybersecurity solutions.

#### Top Threat Intelligence Service Company 2024 (Clutch)
This image represents the Clutch award recognizing Velstadt as a Top Threat Intelligence Service Company for 2024. The recognition is based on verified client reviews, market presence, and the company’s ability to deliver advanced threat intelligence and cybersecurity services.

#### top_clutch.co_dark_web_monitoring_company_united_states_2026 1
URL: https://velstadt.com/?attachment_id=954

#### top_clutch.co_managed_siem_services_company_new_york_2026 1
URL: https://velstadt.com/?attachment_id=956

#### top_clutch.co_software_testing_company_new_york_city_2026 1
URL: https://velstadt.com/?attachment_id=952

#### Ukrgasbank - Velstadt Client
Ukrgasbank logo representing a financial sector client of Velstadt, highlighting experience in delivering cybersecurity services for organizations with high requirements for security, compliance, and operational resilience.

#### Velstadt
The Velstadt logo represents a cybersecurity provider delivering offensive and defensive security services, including SOC-as-a-Service, Penetration Testing, Threat Intelligence, and Dark Web Monitoring. Powered by the proprietary Phantom Threat Intelligence Platform, Velstadt helps organizations detect threats, respond to incidents, and strengthen long-term cyber resilience through tailored strategies aligned with international security standards.

#### Velstadt
The Velstadt logo represents a cybersecurity provider delivering offensive and defensive security services, including SOC-as-a-Service, Penetration Testing, Threat Intelligence, and Dark Web Monitoring. Powered by the proprietary Phantom Threat Intelligence Platform, Velstadt helps organizations detect threats, respond to incidents, and strengthen long-term cyber resilience through tailored strategies aligned with international security standards.

#### Velstadt
The Velstadt logo represents a cybersecurity provider delivering offensive and defensive security services, including SOC-as-a-Service, Penetration Testing, Threat Intelligence, and Dark Web Monitoring. Powered by the proprietary Phantom Threat Intelligence Platform, Velstadt helps organizations detect threats, respond to incidents, and strengthen long-term cyber resilience through tailored strategies aligned with international security standards.

#### Velstadt
The Velstadt logo represents a cybersecurity provider delivering offensive and defensive security services, including SOC-as-a-Service, Penetration Testing, Threat Intelligence, and Dark Web Monitoring. Powered by the proprietary Phantom Threat Intelligence Platform, Velstadt helps organizations detect threats, respond to incidents, and strengthen long-term cyber resilience through tailored strategies aligned with international security standards.

#### Velstadt earned four Clutch 2025 awards
Velstadt's four 2025 Clutch leadership recognitions: #2 of 154 in Top Dark Web Monitoring Companies (New York), #7 of 563 in Top Managed SIEM Services Companies (New York), #17 of 154 in Top Dark Web Monitoring Companies (United States), and #17 of 175 in Top Software Testing Companies (New York City). All recognitions are based on independently verified client reviews and Clutch's market-presence and service-quality scoring methodology.

#### Velstadt in G2 Grid® Report - MSSP Category
This image presents the G2 Grid® Report for Managed Security Services Providers (MSSP), where Velstadt is featured among cybersecurity vendors evaluated based on customer satisfaction and market presence. The report reflects verified user feedback and highlights Velstadt’s capabilities in delivering SOC-as-a-Service, Threat Intelligence, and advanced managed security solutions.

#### Velstadt Recognized Among 2025’s Top Cloud Consulting Firms by Techreviewer.co
This image represents the recognition of Velstadt among the top cloud consulting firms in 2025 by Techreviewer.co. The ranking highlights the company’s expertise in cloud consulting, secure infrastructure design, and the integration of cybersecurity into cloud environments to support scalable and resilient business operations.

#### velstadt-ms-sql-injection-rce-production-crm-cover
Featured cover image for Velstadt's technical case study titled "Anatomy of a Critical Pentest Finding: From MS SQL Injection to Remote Code Execution in a Production CRM." The article explains how an unauthenticated MS SQL injection in a CRM feedback-form endpoint led to database compromise, exposure of customer PII and production API keys, excessive SQL Server privileges, and escalation to operating-system command execution through xp_cmdshell.

#### velstadt-pentest-provider-buyers-guide-2026-cover
URL: https://velstadt.com/how-to-choose-penetration-testing-provider-2026/how-to-choose-the-right-penetration-testing-provider-in-2026/

#### velstadt-pentest-provider-buyers-guide-2026-cover
Featured cover image for Velstadt's 2026 buyer's guide titled "How to Choose the Right Penetration Testing Provider in 2026: A Decision Framework for Security Leaders." The guide includes the Velstadt 12-Point Provider Evaluation Framework, a boutique-vs-continuous PTaaS decision tree, a compliance-mapping matrix covering DORA, NIS2, PCI DSS v4.0, SOC 2, ISO 27001, HIPAA, and real 2026 pricing ranges drawn from observed engagements ($4K–$400K+ per engagement type).

#### View Velstadt on Clutch
Clutch icon linking to Velstadt’s profile, where potential clients can explore verified reviews, ratings, and company performance in cybersecurity services.

#### View Velstadt on Clutch
Clutch icon linking to Velstadt’s profile, where potential clients can explore verified reviews, ratings, and company performance in cybersecurity services.

#### View Velstadt on G2
G2 icon linking to Velstadt’s profile, where users can view verified reviews, ratings, and feedback on cybersecurity services and solutions.

#### View Velstadt on G2
G2 icon linking to Velstadt’s profile, where users can view verified reviews, ratings, and feedback on cybersecurity services and solutions.

#### Visit Velstadt website
Link icon directing users to an external page or resource, such as the Velstadt website, providing access to cybersecurity services, threat intelligence solutions, and expert insights.

#### WSO2_services
Screenshot of a WSO2 /services endpoint that lists deployed services and available operations. In the case study, this public service listing helped identify file-handling functionality and reduced the effort required to understand the application’s exposed attack surface.

### Cases

#### Devlight Brings Enterprise-Grade Security Assurance to Mobile Applications with Velstadt
Executive Summary

Devlight is an IT company specializing in mobile app development, helping businesses become the number one brand on users’ smartphones. For over 10 years, Devlight has worked with businesses from the “Top 100 Forbes Ukraine” list, supporting companies across different sectors in building mobile products, improving customer experience, and moving toward a mobile-first business model.

With 120 projects created and 40M+ app downloads, Devlight builds mobile experiences for brands where reliability, usability, and trust are part of the product itself. When mobile applications become a primary channel between a business and its customers, security can no longer be treated as a final technical checkbox.

For enterprise mobile products, automated scanning can identify many common issues, but it rarely provides the full picture. Authentication and authorization flaws, insecure session management, sensitive data leakage, insecure local storage, weak cryptographic implementation, insecure network communication, and insufficient resilience against reverse engineering or tampering often require manual validation and a deep understanding of how the application is intended to work.

Velstadt supported Devlight as a mobile application security partner, bringing a tailored penetration testing approach that combined automated analysis, manual testing, reverse engineering, business logic validation, and practical remediation guidance.

The assessment was aligned with OWASP MASVS and OWASP MASTG, covering both technical vulnerabilities and business-relevant risks. Velstadt assessed mobile applications through static and dynamic analysis, secure data storage testing, secure communication testing, authentication and authorization testing, API interaction testing, reverse engineering, and mobile-specific attack scenarios.

The final deliverables went beyond a list of findings. Devlight received a detailed technical report with step-by-step reproduction guidance, severity explanation, business impact, remediation and mitigation recommendations, as well as an executive-level summary for C-level stakeholders.

This gave Devlight and its clients a clearer understanding of mobile application risks, helped prioritize remediation, reduced the likelihood of security issues reaching production, and strengthened confidence in the security of enterprise mobile products.

The Challenge

The goal was to validate enterprise mobile applications against real-world security risks and provide both technical teams and management with clear, actionable findings.

Velstadt Approach

We applied a structured mobile penetration testing process aligned with  OWASP MASVS,  OWASP MASTG, and recognized penetration testing lifecycle practices.

Planning & Preparation

Defined the testing scope, target mobile platforms such as iOS and Android, rules of engagement, escalation contacts, test accounts, application builds, and access requirements for the test environment.

Reconnaissance

Reviewed available application context, including app store presence, metadata, documentation, exposed endpoints, technology stack, third-party SDKs, libraries, and external integrations.

Static Analysis

Analyzed the mobile application package without executing it to identify insecure configurations, hardcoded secrets, weak cryptographic implementation, excessive permissions, insecure storage patterns, and gaps in binary protections.

Dynamic Analysis

Tested the application during runtime to validate network communication, TLS usage, certificate handling, authentication and authorization flows, session behavior, local data storage, and error handling.

Manual Testing

Performed manual validation of business logic, API interactions, client-side protections, root and jailbreak detection, abuse scenarios, and mobile-specific attack paths that automated tools may miss.

Vulnerability Triage & PoC

Filtered false positives, prioritized findings based on technical severity and business context, and prepared controlled proof-of-concept evidence for key vulnerabilities.

Reporting & Remediation Support

Delivered a technical report with evidence, steps to reproduce, business impact, and remediation or mitigation guidance, along with an executive-level summary for management.

#### Nova Post Strengthens Proactive Threat Response with Velstadt
Executive Summary

Nova Post is a leading Ukrainian logistics and express delivery company that provides parcel, document, and cargo delivery services for private customers and businesses across Ukraine and Europe.

As Nova Post continued to expand its logistics operations across multiple regions, the company needed earlier visibility into external cyber threats that could affect customers, employees, digital services, and business continuity.

For a large logistics brand, external threats often appear before they are visible inside the corporate environment. Phishing infrastructure, fake delivery notifications, lookalike domains, leaked credentials, stealer log records, underground discussions, and breached datasets can create risk long before a confirmed security incident occurs.

Velstadt helped Nova Post strengthen its proactive security model with external threat intelligence from Phantom Threat Intelligence Platform , including dark web monitoring, stealer log visibility, lookalike and typosquatting domain detection, and phishing infrastructure monitoring. Velstadt also supports takedown request workflows for malicious or impersonating digital assets identified during monitoring.

Curated threat feeds are delivered in the industry-standard STIX/TAXII format and integrated with the customer’s SIEM, enabling correlation between external intelligence and internal security telemetry.

This helps Nova Post identify relevant indicators of compromise, threat actor activity, associated CVEs, leaked data, and compromised credentials earlier, giving security teams the context needed to prioritize response and reduce the likelihood of external exposure turning into a real incident.

The Challenge

Nova Post operates in a high-speed logistics environment where digital trust, service availability, and customer communication directly affect business continuity.

As the company expanded across multiple regions, its external exposure increased. Attackers can abuse logistics-related scenarios through phishing pages, fake delivery notifications, lookalike domains, fraudulent customer communications, credential theft, and brand impersonation.

At the same time, security teams needed earlier visibility into external threat signals that are not always visible through internal telemetry alone. This included mentions of the company and executives in underground sources, leaked datasets, stealer log records, exposed employee or customer credentials, sector-specific indicators of compromise, and vulnerabilities associated with active threat campaigns.

Velstadt Approach

The engagement follows a clear operating model: monitor what happens outside the perimeter, enrich what matters, integrate intelligence into security operations, and support response.

Monitor

Identify dark web exposure, stealer log records, phishing infrastructure, and brand impersonation activity.

Enrich

Add operational context to IOCs, actor profiles, associated CVEs, and campaign references, including confidence, relevance, and source context.

Integrate

Deliver curated intelligence through STIX/TAXII-based feeds for SIEM correlation.

Respond

Support remediation, blocking, investigation, and takedown workflows.

### Resources

#### IT Contractor Security Self-Assessment Checklist
Evaluate your information and cybersecurity readiness across access control, monitoring, incident resilience, and third-party risk.

#### Чекліст самооцінки безпеки IT-підрядника
Оцініть рівень вашої інформаційної та кібербезпеки за напрямками контролю доступу, моніторингу, стійкості до інцидентів та ризиків третіх сторін.

### Awards

#### High Performer
URL: https://velstadt.com/?awards=high-performer

#### Top Cloud Consulting Company
URL: https://velstadt.com/?awards=top-cloud-consulting-company

#### Top Cloud Consulting Company
URL: https://velstadt.com/?awards=top-cloud-consulting-company-2

#### Top Dark Web Monitoring Company
URL: https://velstadt.com/?awards=top-dark-web-monitoring-company

#### Top Dark Web Monitoring Company
URL: https://velstadt.com/ua/?awards=top-dark-web-monitoring-company

#### Top Managed SIEM Services Company
URL: https://velstadt.com/?awards=top-managed-siem-services-company

#### Top Software Testing Company
URL: https://velstadt.com/?awards=top-software-testing-company

### Certificates

#### Certified ISO/IEC 27001 Lead Auditor
URL: https://velstadt.com/?certificates=certified-iso-iec-27001-lead-auditor

#### Cloud Digital Leader
URL: https://velstadt.com/?certificates=cloud-digital-leader

#### CREST PSA Certificate
URL: https://velstadt.com/?certificates=crest-psa-certificate

#### Maltego Advanced
URL: https://velstadt.com/?certificates=maltego-advanced

#### Maltego Advanced
URL: https://velstadt.com/ua/?certificates=maltego-advanced