Case Study HIDEEZ: Security Testing of Encryption and Authentication Before Product Release

Client:

HIDEEZ — a developer of digital identity solutions

Industry:

Healthcare

Focus:

Protecting personal and corporate data for B2B users

Main challenge:

Security verification of a custom AES-256 encryption implementation and authentication mechanism prior to new product release

Market:

Ukraine, with a focus on international B2B markets

Services provided:

White-box penetration testing with source code analysis of encryption and authentication modules; static code analysis (SAST) and dynamic application security testing (DAST), aligned with OWASP ASVS best practices

Key Takeaways

Conducted a white-box pentest of cryptography and authentication mechanisms

Identified 6 vulnerabilities: 1 critical, 2 medium, 3 low

Reduced the risk level of cryptographic attacks to low

Implemented recommendations based on OWASP ASVS

First critical vulnerability remediated in under 48 hours

hours to fix a critical vulnerability

vulnerabilities identified and resolved

weeks total project duration

Case Study HIDEEZ: Security Testing of Encryption and Authentication Before Product Release

Feb 14, 2025

14 min

Can encryption and authentication mechanisms be production-ready in just 3 weeks? Yes! HIDEEZ turned to Datami to assess its custom solutions — AES-256 encryption and authentication modules. Datami’s experts conducted a white-box pentest, identified critical vulnerabilities, and helped reduce the risk of data compromise to a low level.

HIDEEZ is a Ukrainian small and medium-sized enterprise (SME) that develops innovative digital identity solutions. Its product lineup includes wearable devices and software components for authentication, tailored for a B2B audience.

Operating in a high-risk cybersecurity domain and handling both personal and corporate data, HIDEEZ considers security a critical factor in maintaining customer trust.

Objectives and Challenges

HIDEEZ initiated a security review of its encryption and authentication system ahead of a major product update to validate the robustness of its custom AES-256 encryption and authentication implementation.

The project aimed to identify vulnerabilities, assess security risks, and verify the resilience of critical system components.

Conduct a white-box pentest with access to the source code of the encryption and authentication modules
Perform static application security testing (SAST) and dynamic application security testing (DAST) with a focus on cryptographic mechanisms
Deliver a comprehensive report detailing identified vulnerabilities and technical recommendations for strengthening system security

Pentest execution

White-box testing of cryptographic and authentication components

Vulnerability identification

SAST code analysis, DAST testing, and manual attack simulation

Report and recommendations

Detailed risk descriptions and technical recommendations for security improvement

Datami methodology: HIDEEZ security testing

Our approach

Datami conducted a targeted security assessment of HIDEEZ’s encryption and authentication modules, analyzing source code and authorization logic.

The primary method was a white-box pentest, in which the team had access to source code to review critical components in depth.

We combined static code analysis using tools, manual functionality auditing, attack simulation, and thorough encryption verification.

Despite limited access to only parts of the codebase, the team successfully identified significant vulnerabilities and proposed effective improvements.

White-box

Testing was performed with full access to the source code, enabling realistic attack simulations and providing an objective view of the product’s security posture.

Key project stages and solutions

During the project, Datami analyzed the provided fragments of HIDEEZ’s source code, focusing on encryption and authentication. Reviewing the authorization logic and cryptographic implementation helped identify critical risk areas.

Due to limited access, the team created a simulated environment and adapted the testing process without requiring full product deployment.

Preparation

Review of source code, clarification of technical details, creation of a simulation environment, and planning of test scenarios focused on cryptography and AES-256-related authentication risks.
Testing

White-box pentest using Graudit, Burp Suite, custom scripts, SAST analysis, decompilation, and manual attack simulation to identify weaknesses in encryption and authorization logic.
Analysis and reporting

A detailed report outlining identified vulnerabilities, risk assessments, and recommendations for enhancing security.

Fewer critical risks — more confidence

Results and recommendations

Before the project began, the security level of the HIDEEZ product was assessed as high risk due to insufficient review of custom encryption and authentication implementations.

During the white-box pentest, the Datami team identified 6 vulnerabilities: 1 critical (in data encryption), 2 medium (in authentication logic), and 3 low (e.g., hardcoded values in the code).

HIDEEZ received clear recommendations to enhance security:

updating the cryptographic library and improving the AES-256 implementation;
reviewing the security of API calls and eliminating potential vulnerabilities;
conducting regular code reviews and integrating SAST into CI/CD processes.

After implementing the recommendations, the risk level was reduced from high to low. The successful security optimization helped avoid potential data leaks and reputational damage.

The project was completed in 3 weeks instead of the typical 4–5. The critical vulnerability was resolved by the client in under 48 hours.

Key project outcomes

Thanks to Datami, HIDEEZ received a targeted security testing of its cryptographic mechanisms and authentication systems in just 3 weeks.

During the project, the submitted code was reviewed prior to release, and 6 vulnerabilities were identified. The implemented recommendations reduced the risk level from high to low. All tasks were completed on time.

The case study demonstrates that even cybersecurity companies need independent audits.

Aspect

Before the project

After implementation

Security status

High risk due to untested encryption modules

Risk level reduced to low after implementing changes

Account compromise

Potential risk due to authentication logic

Reduced after updating algorithms and validation mechanisms

Security compliance

Partial alignment with OWASP security standards

OWASP ASVS practices implemented, access control strengthened

Timeline

Market average: 4–5 weeks

Completed in 3 weeks

Case: Scheduled Penetration Testing of Mobile Applications and Internal Network

Critical, medium, and low vulnerabilities were identified in mobile applications and the network
Risks were demonstrated through public Wi-Fi access and bypassing network restrictions

Services:

Mobile app pentesting, infrastructure penetration testing

Jun 20, 2025

Distribution Company Case: Penetration Test with Red Teaming Elements

21 vulnerability identified: 8 medium, 12 low, and 1 informational
Simulated internal attack: Wi-Fi password successfully cracked

Services:

Black-box penetration test with elements of Red Teaming

Jun 6, 2025

Case Fraudline: Scheduled Pentest of a Whistleblowing Platform

Identified 6 technical vulnerabilities: 5 low-risk and 1 informational
Performed additional manual testing of business logic

Services:

automated gray-box pentest, audit of secure coding practices, additional manual review of business logic

May 23, 2025

Back to all cases

Datami articles

The Equifax Data Breach: A Preventable Catastrophe

Datami Newsroom

The Equifax Data Breach: A Preventable Catastrophe

This incident occurred back in 2017, but cybersecurity experts are still studying it in detail. This case features a series of classic security failures – serving as a clear example of what not to do.

Jun 30, 2025 3 min

Unconventional Records: Pentesters Hacked a Tesla in Just 2 Minutes

Datami Newsroom

Unconventional Records: Pentesters Hacked a Tesla in Just 2 Minutes

Today, all it takes to take over a car is a computer. That’s exactly what hackers demonstrated at a special competition - they hacked a Tesla in just 120 seconds, and the result became a true sensation.

Jun 27, 2025 3 min

Top 5 Reasons to Invest in Penetration Testing in 2025

Datami Newsroom

Top 5 Reasons to Invest in Penetration Testing in 2025

Today, nearly every business is closely connected to the internet: websites, mobile apps, cloud data storage, electronic payments, and more. This brings great convenience, but at the same time, it introduces additional risks and potential financial losses

Jun 25, 2025 3 min

Show all articles

On this page you will learn what cookies are and how and when we use them. Definition of the term Cookies Cookies are pieces of data that a web server generates and that a website stores on your user device (computer, smartphone, tablet, etc.). Each website or third-party service sends cookies to the browser installed on your device only if your browser allows it. This is possible if you have not set any restrictions in your browser settings to save cookies. Browsers are a very well thought out technology. They protect personal data and allow websites to access only cookies that were previously sent to them. Cookies are divided into: session cookies. They are stored in the memory of the browser only during your session, after leaving the site immediately removed. permanent. They are stored in the memory of the browser for a long time. Definition of the term “browser” A browser is an application for browsing websites. The most popular browsers are Chrome, Internet Explorer, Firefox and Safari. All listed browsers are safe. In the settings of these browsers, cookies can be easily disabled, as well as change the settings of their work. You can: accept all cookies; ask the browser to notify when cookies are used; do not accept cookies. Cookies on ak1-3.com.ua and how we use them We use cookies to: our site is more functional; to understand how you navigate on the site, what content you consume better, to develop the content strategy of the site; understand how many visits to the site were per day, month, year. Analyze the geographical identity of users of the site, the number of repeated visits and other data. Cookies that we use on our site. Third-party cookies. The buttons of social networks, videos and some other services of our site are the property of other companies. These companies may also use cookies on your device if you have used them on our site or have been previously registered with them. The privacy policy of the use of personal data by these services can be found on the websites of these services. Blocking cookies All browsers allow simple actions to disable cookies. To disable them, you must go to your browser settings and find cookies in them. But we must remember that blocking cookies can have a negative impact on the performance of many websites. How to delete files You can also always delete cookies that are stored on your computer. To do this, follow the instructions of your browser Again, deleting cookies can have a negative effect on the performance of many websites.