(929) 590-5818 [email protected]
en

Case Study HIDEEZ: Security Testing of Encryption and Authentication Before Product Release

Client:
HIDEEZ — a developer of digital identity solutions
Industry:
Healthcare
Focus:
Protecting personal and corporate data for B2B users
Main challenge:
Security verification of a custom AES-256 encryption implementation and authentication mechanism prior to new product release
Market:
Ukraine, with a focus on international B2B markets
Services provided:
White-box penetration testing with source code analysis of encryption and authentication modules; static code analysis (SAST) and dynamic application security testing (DAST), aligned with OWASP ASVS best practices
Key Takeaways
  • Conducted a white-box pentest of cryptography and authentication mechanisms
  • Identified 6 vulnerabilities: 1 critical, 2 medium, 3 low
  • Reduced the risk level of cryptographic attacks to low
  • Implemented recommendations based on OWASP ASVS
  • First critical vulnerability remediated in under 48 hours
    • 48
    hours to fix a critical vulnerability
    6
    vulnerabilities identified and resolved
    3
    weeks total project duration
    Case Study HIDEEZ: Security Testing of Encryption and Authentication Before Product Release
    May 10, 2025
    14 min
    Can encryption and authentication mechanisms be production-ready in just 3 weeks? Yes! HIDEEZ turned to Datami to assess its custom solutions — AES-256 encryption and authentication modules. Datami’s experts conducted a white-box pentest, identified criti

    HIDEEZ is a Ukrainian small and medium-sized enterprise (SME) that develops innovative digital identity solutions. Its product lineup includes wearable devices and software components for authentication, tailored for a B2B audience.

    Operating in a high-risk cybersecurity domain and handling both personal and corporate data, HIDEEZ considers security a critical factor in maintaining customer trust.

     

    Objectives and Challenges
    HIDEEZ initiated a security review of its encryption and authentication system ahead of a major product update to validate the robustness of its custom AES-256 encryption and authentication implementation.
     
    The project aimed to identify vulnerabilities, assess security risks, and verify the resilience of critical system components.
     
    • Conduct a white-box pentest with access to the source code of the encryption and authentication modules
    • Perform static application security testing (SAST) and dynamic application security testing (DAST) with a focus on cryptographic mechanisms
    • Deliver a comprehensive report detailing identified vulnerabilities and technical recommendations for strengthening system security
    icon
    Pentest execution
    White-box testing of cryptographic and authentication components
    icon
    Vulnerability identification
    SAST code analysis, DAST testing, and manual attack simulation
    icon
    Report and recommendations
    Detailed risk descriptions and technical recommendations for security improvement
    Datami methodology: HIDEEZ security testing
    Our approach

    Datami conducted a targeted security assessment of HIDEEZ’s encryption and authentication modules, analyzing source code and authorization logic.

    The primary method was a white-box pentest, in which the team had access to source code to review critical components in depth.

    We combined static code analysis using tools, manual functionality auditing, attack simulation, and thorough encryption verification.

    Despite limited access to only parts of the codebase, the team successfully identified significant vulnerabilities and proposed effective improvements.

    White-box
    White-box
    Testing was performed with full access to the source code, enabling realistic attack simulations and providing an objective view of the product’s security posture.
    Key project stages and solutions

    During the project, Datami analyzed the provided fragments of HIDEEZ’s source code, focusing on encryption and authentication. Reviewing the authorization logic and cryptographic implementation helped identify critical risk areas.

    Due to limited access, the team created a simulated environment and adapted the testing process without requiring full product deployment.

    • Preparation
      Review of source code, clarification of technical details, creation of a simulation environment, and planning of test scenarios focused on cryptography and AES-256-related authentication risks.
    • Testing
      White-box pentest using Graudit, Burp Suite, custom scripts, SAST analysis, decompilation, and manual attack simulation to identify weaknesses in encryption and authorization logic.
    • Analysis and reporting
      A detailed report outlining identified vulnerabilities, risk assessments, and recommendations for enhancing security.
    Cybersecurity starts with action
    How we can help you?

    Every cybersecurity case study we solve involves deep analysis, tailored solutions, and measurable results.
    Datami has already helped over 600 companies strengthen their digital defenses — and we can do the same for your business.
    Ready to take action?

    Let’s start with a free consultation!
    Results and recommendations
    Fewer critical risks — more confidence
    Results and recommendations

    Before the project began, the security level of the HIDEEZ product was assessed as high risk due to insufficient review of custom encryption and authentication implementations.

    During the white-box pentest, the Datami team identified 6 vulnerabilities: 1 critical (in data encryption), 2 medium (in authentication logic), and 3 low (e.g., hardcoded values in the code).

    HIDEEZ received clear recommendations to enhance security:

    1. updating the cryptographic library and improving the AES-256 implementation;
    2. reviewing the security of API calls and eliminating potential vulnerabilities;
    3. conducting regular code reviews and integrating SAST into CI/CD processes.

    After implementing the recommendations, the risk level was reduced from high to low. The successful security optimization helped avoid potential data leaks and reputational damage.

    The project was completed in 3 weeks instead of the typical 4–5. The critical vulnerability was resolved by the client in under 48 hours.

    Our certificates
    Key project outcomes

    Thanks to Datami, HIDEEZ received a targeted security testing of its cryptographic mechanisms and authentication systems in just 3 weeks.

    During the project, the submitted code was reviewed prior to release, and 6 vulnerabilities were identified. The implemented recommendations reduced the risk level from high to low. All tasks were completed on time.

    The case study demonstrates that even cybersecurity companies need independent audits.

    Aspect
    Before the project
    After implementation
    Security status
    High risk due to untested encryption modules
    Risk level reduced to low after implementing changes
    Account compromise
    Potential risk due to authentication logic
    Reduced after updating algorithms and validation mechanisms
    Security compliance
    Partial alignment with OWASP security standards
    OWASP ASVS practices implemented, access control strengthened
    Timeline
    Market average: 4–5 weeks
    Completed in 3 weeks
    More success stories with Datami
    Browse other project case studies
    Case Study: Consulting Company – Security Testing of Web Resources and Infrastructure

    Case Study: Consulting Company – Security Testing of Web Resources and Infrastructure

    • Conducted black-box pentest of two web resources and infrastructure components
    • Identified 19 vulnerabilities: 1 critical, 8 medium, 7 low, and 3 informational
    Services provided:
    Black-box pentest of two web resources with different domain zones (UA and UK), and assessment of related infrastructure components
    May 10, 2025
    Case Study: Andromeda Systems – Mobile App Pentest with Reverse Engineering

    Case Study: Andromeda Systems – Mobile App Pentest with Reverse Engineering

    • Conducted a grey-box app pentest using SAST, DAST, and reverse engineering
    • Identified critical vulnerabilities that could have led to data leaks; improved resilience to attacks
    Services provided:
    reverse engineering, full grey-box pentest using SAST, DAST
    May 10, 2025
    Case Study HIDEEZ: Security Testing of Encryption and Authentication Before Product Release

    Case Study HIDEEZ: Security Testing of Encryption and Authentication Before Product Release

    • Conducted a white-box pentest of cryptography and authentication mechanisms
    • Identified 6 vulnerabilities: 1 critical, 2 medium, 3 low
    Services provided:
    White-box penetration testing with source code analysis of encryption and authentication modules; static code analysis (SAST) and dynamic application security testing (DAST), aligned with OWASP ASVS best practices
    May 10, 2025
    Back to all cases
    Security image
    Ready to assess your project's security?
    Contact Datami — we’ll help you identify risks, strengthen your cybersecurity, and confidently pass certification.
    Datami articles
    Internal Network Penetration Testing: Identify Vulnerabilities Before Attackers Do Oleksandr Filipov: Security engineer at Datami, author of articles
    Oleksandr Filipov: Security engineer at Datami, author of articles

    Internal Network Penetration Testing: Identify Vulnerabilities Before Attackers Do

    Learn what an Internal Network Penetration Test is and how to prepare for it. Discover the meaning, stages, and challenges of conducting an Internal Network Pen Testing.

    May 8, 2025
    Network Penetration Testing: What Is It? Oleksandr Filipov: Security engineer at Datami, author of articles
    Oleksandr Filipov: Security engineer at Datami, author of articles

    Network Penetration Testing: What Is It?

    What is network penetration testing? Learn more about the approaches and types of network pentests, the key stages, and the outcomes of a network penetration test.

    May 1, 2025
    Cybersecurity in healthcare: why hospitals have become a favorite target for hackers Oleksandr Filipov: Security engineer at Datami, author of articles
    Oleksandr Filipov: Security engineer at Datami, author of articles

    Cybersecurity in healthcare: why hospitals have become a favorite target for hackers

    Cybersecurity in healthcare is at risk: hospitals face more cyberattacks than banks. Learn how to protect medical data with expert tips from Datami.

    Apr 24, 2025
    Show all articles
    Order a free consulidation
    By submitting this form, I confirm that I have read and agree to the Privacy policy
    We value your privacy
    We use cookies to enhance your browsing experience, serve personalized ads or content, and analyze our traffic. By clicking "Accept All", you consent to our use of cookies. Cookie policy