What we've found, redacted to fit on a webpage.

What they came to us for: Their last manual pentest had cost $45K, taken six weeks, and produced a 12-page PDF mostly about CSRF on internal admin pages. They felt they were testing maybe 5% of their actual surface.

What we found in week one: The AI discovered an undocumented internal endpoint that accepted account IDs and returned recent transactions. The reviewer chained it: take any user's account ID, pass it to the endpoint, read their last 30 days of transaction history. No auth check at all. CVSS 9.1, BOLA class.

What we found in month two: The OAuth refresh-token endpoint accepted tokens issued for the consumer app and minted access tokens for the internal admin app, because both shared a JWT secret. Consumer token → admin token → read any account, transfer money, lock users out. CVSS 9.8.

Outcome: Fixes shipped inside 10 days for both findings. Retests confirmed within minutes of the merges. Customer used the report as evidence for their SOC 2 Type II audit. They're now on continuous coverage.

What they came to us for: A hospital-system customer demanded mobile pentest evidence as a condition of renewal, specifically a report signed by a named human with reproducible findings. Standard scanner output PDFs had been rejected.

What we found on the binary: The Android app cached patient records — name, date of birth, condition, medication list — in plaintext SharedPreferences. Reproduced with a Frida script in under an hour. HIPAA-relevant. CVSS 7.5.

What we found in the API: The "list my appointments" endpoint took an optional userId parameter. Pass someone else's userId, get their appointments. The iOS app never sent that parameter, but the endpoint accepted it. Surfaced from the OpenAPI spec; chained through the binary to confirm reachability.

Outcome: Fixes shipped inside two weeks. Customer regenerated the report after retest with all findings closed. Hospital-system contract closed. Now using us for every mobile release.

What they came to us for: Their CSPM scanner generated 1,400 findings, of which the team had triaged maybe 200. They wanted to know which mattered and what the scanner had missed. They gave us a read-only IAM role across all four production accounts.

What we found: The AI surfaced a candidate chain — an EC2 instance in staging held a role that could iam:PassRole any role into a new Lambda. The reviewer traced which roles the Lambda could assume: one was the production deployment role. Staging EC2 → PassRole → Lambda → assume prod-deploy → full admin. CVSS 9.8. The CSPM had flagged the PassRole permission but didn't compose the chain.

Second finding: A nightly snapshot of the production database was marked public — a debugging workflow nobody reverted. Discoverable through the public AWS snapshot index. Contained full customer PII. CVSS 9.1.

Outcome: Fixes shipped inside a week. Customer used the report to justify a permanent rebuild of their IAM topology. They've kept us on continuous coverage.

What they came to us for: Pre-launch. Their first enterprise contract was contingent on a pentest of the AI features specifically. Standard firms quoted four to six weeks; they had ten days.

What we found in the RAG layer: The vector store was multi-tenant, but the tenant-isolation check happened in the application layer, not at retrieval time. A crafted prompt could surface chunks from any tenant's documents within the same shard. Reproduced with a synthetic test tenant. CVSS 8.4.

What we found in the tool-call layer: The copilot's "send a calendar invite" tool trusted the LLM's stated user_id. An attacker uploads a doc that instructs the model, during summarization, to send an invite carrying the user's API key. The model called the tool with the user's session. CVSS 8.8, tool-call abuse via indirect prompt injection.

Outcome: Both findings fixed inside the ten-day window. Retest confirmed. Enterprise contract closed. Customer now uses us for every model and prompt update.