(929) 590-5818 [email protected]
en
en

Case: Scheduled Penetration Testing of Mobile Applications and Internal Network

Client:
— the largest private investor in Ukraine’s energy sector
Industry:
Energy
Focus:
Security assessment of mobile applications and network infrastructure as part of the annual audit
 
Main challenge:
Identifying potential vulnerabilities that could lead to data leakage
Market:
Local (Ukraine)
Services provided:
Mobile app pentesting, infrastructure penetration testing
Key Takeaways
  • Critical, medium, and low vulnerabilities were identified in mobile applications and the network
  • Risks were demonstrated through public Wi-Fi access and bypassing network restrictions
  • Gray-box and white-box penetration tests were conducted using both automated and manual methods
  • A report was prepared with recommendations to strengthen cybersecurity
    • 2
    strategies used for penetration testing
    < 5
    weeks total testing time
    A report
    with recommendations was prepared
    Case: Scheduled Penetration Testing of Mobile Applications and Internal Network
    Jun 20, 2025
    How can you be sure your critical infrastructure is truly secure? Penetration testing is the best way to verify it in practice. During a scheduled security assessment at , Datami specialists discovered a number of vulnerabilities in mobile applications and internal infrastructure. Thanks to the penetration test, a potential data breach was prevented.

    is a large energy corporation that generates electricity from solar, wind, and thermal power plants, extracts coal and gas, conducts energy trading, distributes electricity, and develops a network of charging stations in Ukraine.

    The company operates in the field of critical infrastructure, processes confidential personal and corporate data, and complies with regulatory requirements, making information security a strategic priority.

    Tasks and challenges
    approached Datami to conduct a scheduled penetration test of mobile applications and internal infrastructure as part of the annual security assessment. The task was to identify potential threats to digital assets processing confidential information and to provide technical recommendations for improving the protection of critical infrastructure.
    • Conduct gray-box penetration testing of mobile applications for clients and employees
    • Test the internal network (white-box), including Wi-Fi, with a focus on access policies
    • Provide a technical report with findings and recommendations to mitigate risks
       
    icon
    Web pentest + mobile pentest
    Gray-box testing with user and administrator accounts
    icon
    Infrastructure pentest
    Review of network restrictions, access controls, and security configurations
    icon
    Report and recommendations
    Document with identified risks and recommendations for mitigation
    Datami Methodology: Security Assessment
    Our approach

    For , we conducted a combined penetration test using gray-box and white-box approaches. We applied both static and dynamic analysis, combining manual and automated methods. Constant communication with the client was maintained, as unstable application performance complicated the testing process.

    During testing, the team managed to bypass corporate network restrictions and discovered Wi-Fi access through an unprotected device. This made it possible to demonstrate real attack vectors.

    White-box
    White-box
    Internal infrastructure testing with access to network configurations and policies
     
    Gray-box
    Gray-box
    Mobile application testing using administrator and user accounts, without full access to the source code
     
    Key work stages and solutions

    The Datami team first conducted static and dynamic testing of the mobile applications, followed by an assessment of the company’s internal infrastructure, with particular focus on the Wi-Fi network and access policies. During the process, the team had to adapt to technical issues with the applications and clarify testing scenarios.

    • Preparation
      Analysis of initial data, access levels, and testing scenarios; selection of tools for mobile and network testing
       
    • Security testing
      Gray-box testing of mobile applications and white-box assessment of Wi-Fi and internal network; network restriction bypass; detection of configuration vulnerabilities
       
    • Analysis and reporting
      Preparation of a technical report detailing critical and medium vulnerabilities, along with recommendations for mitigation
       
    Cybersecurity starts with action
    How we can help you?

    Every cybersecurity case study we solve involves deep analysis, tailored solutions, and measurable results.
    Datami has already helped over 600 companies strengthen their digital defenses — and we can do the same for your business.
    Ready to take action?

    Let’s start with a free consultation!
    Results and recommendations
    Fewer critical risks — more confidence
    Results and recommendations

    During the security assessment at , the Datami team identified several critical, as well as a number of medium and low vulnerabilities in mobile applications and internal infrastructure. Some of the risks were related to network access and security policy configurations. During the testing process, our penetration testers also noted issues in application functionality.

    As a result, the client received a detailed technical report and a recommended action plan, including:

    1. Remediation of vulnerabilities in mobile applications
    2. Restriction of Wi-Fi access and protection of public devices
    3. Review and update of network access policies
    4. Strengthening control over internal privileges

    After implementing the recommendations, a reduction in the risk of data leakage and unauthorized access is expected.

    Our certificates
    Key project results

    As a result of the collaboration with Datami, received a detailed technical report, an assessment of the security level of its mobile applications and network infrastructure, and recommendations for vulnerability remediation.

    The testing was completed within the planned timeframe — 4–5 weeks.

    This case study confirms the importance of regular penetration testing for critical infrastructure companies — both for security control and regulatory compliance.

    Direction
    Before the project
    After implementation
    Security status
    Limited visibility into mobile applications and the network
    A number of critical, medium, and low vulnerabilities identified; remediation plan developed
    Critical vulnerabilities
    Not previously detected or considered
    Identified during the penetration test
    Wi-Fi access
    Public devices could store confidential passwords
    Recommended to restrict access and review interaction points
    Security compliance
    Partial compliance with expectations
    Improved transparency and access control
    Timeline
    Planned — 4–5 weeks
    Completed on time, including additional checks
    More success stories with Datami
    Browse other project case studies
    Distribution Company Case: Penetration Test with Red Teaming Elements

    Distribution Company Case: Penetration Test with Red Teaming Elements

    • 21 vulnerability identified: 8 medium, 12 low, and 1 informational
    • Simulated internal attack: Wi-Fi password successfully cracked
    Services:
    Black-box penetration test with elements of Red Teaming
    Jun 6, 2025
    Case Fraudline: Scheduled Pentest of a Whistleblowing Platform

    Case Fraudline: Scheduled Pentest of a Whistleblowing Platform

    • Identified 6 technical vulnerabilities: 5 low-risk and 1 informational
    • Performed additional manual testing of business logic
    Services:
    automated gray-box pentest, audit of secure coding practices, additional manual review of business logic
    May 23, 2025
    P2P Platform Case Study: Comprehensive Security and GDPR Compliance Audit

    P2P Platform Case Study: Comprehensive Security and GDPR Compliance Audit

    • Identified 10 vulnerabilities, including 3 critical ones
    • Improved GDPR compliance and avoided potential financial losses of up to $300,000
    Services:
    Penetration testing, smart contract audit, code security review, testing for SQLi, XSS, and RCE vulnerabilities, OSINT analysis, and cloud infrastructure security assessment
    May 9, 2025
    Back to all cases
    Security image
    Ready to assess your project's security?
    Contact Datami — we’ll help you identify risks, strengthen your cybersecurity, and confidently pass certification.
    The Equifax Data Breach: A Preventable Catastrophe Datami Newsroom
    Datami Newsroom

    The Equifax Data Breach: A Preventable Catastrophe

    This incident occurred back in 2017, but cybersecurity experts are still studying it in detail. This case features a series of classic security failures – serving as a clear example of what not to do.

    Jun 30, 2025 3 min
    Unconventional Records: Pentesters Hacked a Tesla in Just 2 Minutes Datami Newsroom
    Datami Newsroom

    Unconventional Records: Pentesters Hacked a Tesla in Just 2 Minutes

    Today, all it takes to take over a car is a computer. That’s exactly what hackers demonstrated at a special competition - they hacked a Tesla in just 120 seconds, and the result became a true sensation.

    Jun 27, 2025 3 min
    Top 5 Reasons to Invest in Penetration Testing in 2025 Datami Newsroom
    Datami Newsroom

    Top 5 Reasons to Invest in Penetration Testing in 2025

    Today, nearly every business is closely connected to the internet: websites, mobile apps, cloud data storage, electronic payments, and more. This brings great convenience, but at the same time, it introduces additional risks and potential financial losses

    Jun 25, 2025 3 min
    Order a free consultation
    By submitting this form, I confirm that I have read and agree to the Privacy policy
    We value your privacy
    We use cookies to enhance your browsing experience, serve personalized ads or content, and analyze our traffic. By clicking "Accept All", you consent to our use of cookies. Cookie policy