(929) 590-5818 [email protected]
en
en

Security Testing of Mobile App & Internal Network

Client:
The private investor in Ukraine’s energy sector
 
Industry:
Energy
Focus:
Security assessment of mobile applications and network infrastructure as part of the annual audit
 
Main challenge:
Identifying potential vulnerabilities that could lead to data leakage
Market:
Local (Ukraine)
Services provided:
Mobile app pentesting, infrastructure pentesting
Key Takeaways
  • Simulated attack via public Wi-Fi to expose real-world risks
  • Identified critical issues across app, API, and infrastructure
  • Gray-box and white-box penetration tests were conducted using both automated and manual methods
  • A report was prepared with recommendations to strengthen cybersecurity
    • 2
    strategies used for penetration testing
    < 5
    weeks total testing time
    A report
    with recommendations was prepared
    Security Testing of Mobile App & Internal Network
    Upd: 22.09.2025
    How can you be sure your critical infrastructure is truly secure? Penetration testing is one of the most effective ways to verify it in practice. During a scheduled security assessment, Datami specialists discovered several vulnerabilities in the client company’s mobile applications and internal infrastructure. Thanks to the penetration test, a potential data breach was prevented.

    A major energy corporation in Ukraine operates across the full energy cycle: generating electricity from solar, wind, and thermal power plants; extracting coal and gas; engaging in energy trading; distributing electricity; and developing a nationwide network of charging stations.

    The company operates in the field of critical infrastructure, processes confidential personal and corporate data, and complies with regulatory requirements, making information security a strategic priority.

    Tasks and challenges
    Datami was engaged to conduct a scheduled penetration test of mobile applications and internal infrastructure as part of an annual security assessment. The objective was to identify potential threats to digital assets that process confidential information and to provide technical recommendations for strengthening the protection of critical infrastructure.
    • Conduct gray-box penetration testing of mobile applications for clients and employees
    • Test the internal network (white-box), including Wi-Fi, with a focus on access policies
    • Provide a technical report with findings and recommendations to mitigate risks
       
    icon
    Web pentest + mobile pentest
    Gray-box testing with user and administrator accounts
    icon
    Infrastructure pentest
    Review of network restrictions, access controls, and security configurations
    icon
    Report and recommendations
    Document with identified risks and recommendations for mitigation
    Datami Methodology: Security Assessment of Critical Infrastructure

    Our approach

    A combined penetration test was conducted using both gray-box and white-box approaches. We applied both static and dynamic analysis, combining manual and automated methods. Constant communication with the client was maintained, as unstable application performance complicated the testing process.

    During testing, the team managed to bypass corporate network restrictions and discovered Wi-Fi access through an unprotected device. This made it possible to demonstrate real attack vectors.

    White-box

    White-box

    Internal infrastructure testing with access to network configurations and policies
     
    Gray-box

    Gray-box

    Mobile application testing using administrator and user accounts, without full access to the source code
     
    Key work stages and solutions

    The Datami team first conducted static and dynamic testing of the mobile applications, followed by an assessment of the company’s internal infrastructure, with particular focus on the Wi-Fi network and access policies. During the process, the team had to adapt to technical issues with the applications and clarify testing scenarios.

    • Preparation
      Analysis of initial data, access levels, and testing scenarios; selection of tools for mobile and network testing
       
    • Security testing
      Gray-box testing of mobile applications and white-box assessment of Wi-Fi and internal network; network restriction bypass; detection of configuration vulnerabilities
       
    • Analysis and reporting
      Preparation of a technical report detailing critical and medium vulnerabilities, along with recommendations for mitigation
       
    Cybersecurity starts with action
    How we can help you?

    Every cybersecurity case study we solve involves deep analysis, tailored solutions, and measurable results.
    Datami has already helped over 600 companies strengthen their digital defenses — and we can do the same for your business.
    Ready to take action?

    Let’s start with a free consultation!
    Results and recommendations
    Fewer critical risks — more confidence

    Results and recommendations

    During the security assessment at , the Datami team identified several critical, as well as a number of medium and low vulnerabilities in mobile applications and internal infrastructure. Some of the risks were related to network access and security policy configurations. During the testing process, our penetration testers also noted issues in application functionality.

    As a result, the client received a detailed technical report and a recommended action plan, including:

    1. Remediation of vulnerabilities in mobile applications
    2. Restriction of Wi-Fi access and protection of public devices
    3. Review and update of network access policies
    4. Strengthening control over internal privileges

    After implementing the recommendations, a reduction in the risk of data leakage and unauthorized access is expected.

    CONFIRMED EXPERTISE OF DATAMI

    Our certificates

    Datami is a cybersecurity firm whose qualifications are confirmed by 26 certifications and international standards. This allows us to perform tasks of varying complexity while complying with security, confidentiality, and ethical practice requirements.
    Key project results

     

    As a result of the collaboration with Datami, the organization received a detailed technical report, an assessment of the security level of its mobile applications and network infrastructure, and recommendations for vulnerability remediation.

    The testing was completed within the planned timeframe — 4–5 weeks.

    This case study confirms the importance of regular penetration testing for critical infrastructure companies — both for security control and regulatory compliance.

    Direction
    Before the project
    After implementation
    Security status
    Limited visibility into mobile applications and the network
    A number of critical, medium, and low vulnerabilities identified; remediation plan developed
    Critical vulnerabilities
    Not previously detected or considered
    Identified during the penetration test
    Wi-Fi access
    Public devices could store confidential passwords
    Recommended to restrict access and review interaction points
    Security compliance
    Partial compliance with expectations
    Improved transparency and access control
    Timeline
    Planned — 4–5 weeks
    Completed on time, including additional checks
    More success stories with Datami
    Browse other project case studies
    Cloudflare Zero Trust & SIEM for SaaS
    Cloudflare Zero Trust & SIEM for SaaS
    • MTTD reduced to 1–2 hours
    • False positives reduced by 50–65%
    Services:
    Cloudflare Zero Trust and Wazuh SIEM implementation
    Aug 4, 2026
    WordPress Website Recovery After a Hack
    WordPress Website Recovery After a Hack
    • Backdoor infections and web shells were completely removed.
    • 9 unauthorized admin accounts were removed.
    Services:
    WordPress Security Audit (White-box)
    Aug 4, 2026
    SIEM Wazuh Implementation for a Financial Company
    SIEM Wazuh Implementation for a Financial Company
    • PCI DSS & ISO 27001 audit-ready
    • Reduced false positives by 60–70%
    Services:
    SIEM Implementation (Wazuh)
    Jul 1, 2026
    Back to home page
    Security image
    Ready to assess your project's security?
    Contact Datami — we’ll help you identify risks, strengthen your cybersecurity, and confidently pass certification.
    Datami articles
    What Does AI Penetration Testing Include? A Practical Breakdown of 12 Critical Security Checks Oleksandr Filipov
    Oleksandr Filipov
    What Does AI Penetration Testing Include? A Practical Breakdown of 12 Critical Security Checks

    AI Penetration Testing checks not only for prompt injection but also for RAG, memory, agent privileges, and integrations. Find out which 12 tests help identify real risks in AI systems.

    4 min Aug 20, 2026
    Modern LLM Pentesting Goes Far Beyond Prompt Injection Oleksandr Filipov
    Oleksandr Filipov
    Modern LLM Pentesting Goes Far Beyond Prompt Injection

    LLM pentesting goes beyond prompt injection: it audits data leaks, permission bypasses, and harmful actions. Discover what a full AI audit must cover.

    4 min Aug 20, 2026
    Why AI Tokens Introduce a New Class of Smart Contract Risks Oleksandr Filipov
    Oleksandr Filipov
    Why AI Tokens Introduce a New Class of Smart Contract Risks

    A smart contract can pass a Solidity audit without a remark and still be exploitable - if part of the decision-making sits with a model. What a real audit with 40 findings reveals, and what to check before listing.

    4 min Aug 4, 2026
    Show all articles
    Order a consultation
    By submitting this form, I confirm that I have read and agree to the Privacy policy
    We value your privacy
    We use cookies to enhance your browsing experience, serve personalized ads or content, and analyze our traffic. By clicking "Accept All", you consent to our use of cookies. Cookie policy