Case study · VAPT
Securing critical infrastructure with end-to-end VAPT
A thorough vulnerability assessment and penetration test across Xcdify's critical systems surfaced high-risk gaps and delivered clear, actionable remediation — closed out before go-live.
The challenge
Xcdify was weeks from launching a major platform update — new integrations, a redesigned API surface, and infrastructure changes that hadn't been tested since the previous year's assessment. Leadership needed independent, evidence-based confidence that none of those changes had introduced exploitable weaknesses before the update went live to customers.
The team also faced a hard deadline: findings needed to be identified, prioritised and remediated within a fixed window, without delaying the launch or disrupting production systems still serving live traffic.
Business & security risks
An untested launch carried real exposure on two fronts. Technically, a newly expanded attack surface — new API endpoints, new third-party integrations, a broader cloud footprint — meant unknown vulnerabilities could be sitting in code that had never faced adversarial testing.
- Customer trust and contractual obligations tied to security assurances
- Potential downtime or data exposure from an unpatched, exploitable flaw
- Compliance and procurement risk if a security questionnaire couldn't be answered with current evidence
Our approach & methodology
Ciqur24 ran a full black-box and grey-box assessment combining automated scanning with manual, human-led exploitation — the same techniques a real attacker would use, applied under controlled conditions with an agreed testing window to avoid disrupting production traffic.
Every finding was manually verified before being reported, so Xcdify's engineering team could trust the severity ratings and skip the noise of unvalidated scanner output.
Methodology
The VAPT process
A five-stage engagement, from first recon to final sign-off.
Reconnaissance & scoping
Mapped the full attack surface — domains, APIs, cloud assets and third-party integrations — and agreed the testing window with Xcdify's team.
Automated & manual scanning
Combined industry-standard scanning tools with hands-on manual testing to surface both common misconfigurations and logic-level flaws scanners miss.
Exploitation & validation
Attempted controlled exploitation of every candidate finding to confirm real-world impact and eliminate false positives before reporting.
Reporting & remediation support
Delivered a prioritised report with clear reproduction steps and fix guidance, then worked directly with engineering through remediation.
Re-test & sign-off
Re-tested every remediated finding to confirm the fix held, and issued a clean sign-off ahead of the go-live date.
What we found
Key findings
Broken access control
An API endpoint allowed access to another account's data under specific request conditions.
Outdated dependencies
Several third-party libraries carried known, publicly disclosed vulnerabilities.
Weak session handling
Session tokens did not expire predictably, extending the window for token replay.
Solution implemented
Xcdify's engineering team remediated every finding using Ciqur24's prioritised, reproducible guidance — starting with the three critical-severity issues, then working through medium- and low-severity items within the same testing window.
Fixes included tightened authorization checks on the affected API endpoint, a dependency upgrade pass across the flagged libraries, and a revised session-expiry policy applied platform-wide.
Outcomes
Security improvements
Verified, clean sign-off
Every finding re-tested and confirmed closed before launch — not just reported and assumed fixed.
Audit-ready evidence
A documented report Xcdify can hand to customers and auditors on request.
Hardened dependency posture
Outdated libraries upgraded and flagged for ongoing monitoring.
On-schedule launch
Remediation completed within the original go-live window — no delay to the release.
Technologies & tools
Final business impact
Xcdify launched on schedule with independently verified evidence that its updated platform had been tested against real-world attack techniques — not just scanned. The engagement gave the team a repeatable process they now run ahead of every major release, and a report they can put directly in front of customers and auditors when asked.
Get started
Ready for your own VAPT?
Get a scoped vulnerability assessment and penetration test built around your infrastructure, your timeline and your launch date.