Case Study: DAVITOO UKRAINE – LMS Security Testing Before HIPAA Certification

Client:

DAVITOO UKRAINE LLC — a developer of e-learning and analytics software

Industry:

Healthcare

Focus:

Ensuring the security of the LMS Collaborator platform for HIPAA compliance

Main challenge:

Identifying critical vulnerabilities in web applications and server infrastructure to prevent leaks of medical and personal data

Market:

International

Services provided:

Gray-box penetration testing and security audit of the web platform, containerized environments, and network interactions

Key Takeaways

Completed a full security audit and gray-box penetration test of LMS Collaborator

Identified 15 vulnerabilities, including 5 critical issues, resolved within 24 hours

Delivered a detailed report with recommendations for ongoing security improvements

Increased the platform’s resilience to cyberattacks by 95%

Achieved full compliance with HIPAA requirements

vulnerabilities identified

95%

increase in attack resilience

100%

compliance with HIPAA requirements

Case Study: DAVITOO UKRAINE – LMS Security Testing Before HIPAA Certification

May 11, 2025

14 min

DAVINTOO UKRAINE LLC was preparing for HIPAA certification and requested a security testing of its LMS platform, which handles sensitive data. Datami performed a full security audit and gray-box penetration test. As a result, after addressing the identified vulnerabilities, LMS Collaborator now fully meets security requirements.

DAVINTOO UKRAINE LLC is an international IT company specializing in software solutions for the e-learning sector. Its flagship product, LMS Collaborator, is a web-based platform for learning, communication, and analytics, used daily by over 5,000 users.

Given that DAVINTOO handles both personal and medical data, HIPAA compliance is critical to ensuring the security of its digital products.

Objectives and challenges

DAVINTOO UKRAINE LLC initiated a comprehensive security testing of its LMS Collaborator platform as part of its preparation for HIPAA certification. The primary challenge lay in identifying potential vulnerabilities within the web platform, its applications, and the underlying server infrastructure.

The project aimed to ensure compliance with international security standards and to reduce the risk of data breaches.

Conduct a penetration test and security audit of the web platform, servers, and web applications.
Deliver a comprehensive report with recommendations following HIPAA standards.
Complete the assessment with maximum accuracy within the defined 4-week timeline.

Pentest and security audit

Gray-box testing of LMS, servers and web applications for vulnerabilities

Vulnerability detection

Threat detection, security enhancement, and risk minimization

Report preparation

Report preparation with recommendations for HIPAA certification

Datami Methodology: Security Testing for DAVINTOO UKRAINE LLC

Our approach

Datami conducted a comprehensive security audit of the internal infrastructure of DAVINTOO UKRAINE LLC, covering the web platform, servers, and applications.

Regular communication with the client — including weekly status meetings and interim reports — ensured effective task management and rapid incident response.

To assess risks and identify vulnerabilities, we applied a gray-box approach, conducting tests with partial access to the client's technical documentation.

We combined manual analysis techniques with automated scanning tools, utilizing Metasploit and Paros Proxy.

Gray-box

The team had limited access to internal information — this approach allowed us to effectively combine an external perspective with an internal system analysis.

Key project stages and solutions

During the project, the Datami team carried out a highly accurate, full-scale security assessment of the LMS Collaborator web platform, servers, and applications. A gray-box approach was chosen for the penetration test, combining both automated and manual testing methods.

The team made strategic decisions to enhance access control and strengthen the security of web applications.

Key project stages:

Preparation

Review of technical documentation, agreement on the approach, and identification of critical assets for testing.
Testing

Execution of gray-box penetration testing using Metasploit, Paros Proxy, and manual auditing to identify vulnerabilities.
Analysis and Reporting

In-depth analysis of identified risks, and preparation of a report with recommendations for risk mitigation and HIPAA compliance.

Results and recommendations

At the start of the project, LMS Collaborator was assessed as having a high-risk level due to vulnerabilities in web applications and potential data leaks, posing a threat to HIPAA compliance.

During the penetration test, the Datami team identified 15 vulnerabilities, 5 of which were critical. Some of these could have been exploited to gain unauthorized access to user accounts or extract sensitive information.

The client received the following recommendations:

regular security testing and updates;
strengthening access control;
cyber hygiene training for staff.

After implementing the recommended measures, LMS Collaborator achieved full HIPAA compliance, and its overall security level significantly improved. Two-factor authentication and regular security updates were introduced. All critical vulnerabilities were eliminated within 24 hours of reporting, preventing data breaches, penalties, and reputational damage.

The project was completed in 4 weeks, outperforming the industry average of 6 weeks.

Key project outcomes

DAVINTOO UKRAINE LLC successfully enhanced the cybersecurity resilience of LMS Collaborator and achieved full HIPAA compliance. The company gained a clear understanding of its threat landscape, a thorough technical audit, and actionable recommendations for strengthening its security systems. All project objectives were met within the planned timeframe.

This case study demonstrates that security testing and compliance are not just formalities, but essential safeguards against real-world threats and reputational damage.

Aspect

Before the project

After implementation

Security status

High risk due to critical vulnerabilities

HIPAA compliance achieved, risks reduced, regular updates implemented

Critical vulnerabilities

Potential data leaks and unauthorized access

5 critical vulnerabilities resolved within 24 hours

Account compromise risk

Unreliable authentication

Two-factor authentication (2FA) and enhanced access control implemented

Security compliance

Partial HIPAA compliance

Full readiness for certification

Timeline

Industry standard: 6 weeks

Completed in 4 weeks

Case Study Grindset Software: Payment System Pentest for PCI DSS Compliance

Conducted a black-box penetration test of critical payment system components
Discovered 15 vulnerabilities; 5 critical issues were resolved within 48 hours

Services provided:

Black-box penetration testing of the payment system, including assessment of web applications, servers, databases, and communication channels

May 11, 2025

BookingSync Case Study: API Pentest for Personal Data Protection

Conducted a gray-box pentest of API endpoints
Identified several low-level vulnerabilities

Services provided:

Gray-box API pentest using Burp Suite API Scan and manual testing methods

May 11, 2025

Case Study: Consulting Company – Security Testing of Web Resources and Infrastructure

Conducted black-box pentest of two web resources and infrastructure components
Identified 19 vulnerabilities: 1 critical, 8 medium, 7 low, and 3 informational

Services provided:

Black-box pentest of two web resources with different domain zones (UA and UK), and assessment of related infrastructure components

May 10, 2025

Back to all cases

Datami articles

Internal Network Penetration Testing: Identify Vulnerabilities Before Attackers Do

Oleksandr Filipov: Security engineer at Datami, author of articles

Internal Network Penetration Testing: Identify Vulnerabilities Before Attackers Do

Learn what an Internal Network Penetration Test is and how to prepare for it. Discover the meaning, stages, and challenges of conducting an Internal Network Pen Testing.

May 8, 2025

Network Penetration Testing: What Is It?

Oleksandr Filipov: Security engineer at Datami, author of articles

Network Penetration Testing: What Is It?

What is network penetration testing? Learn more about the approaches and types of network pentests, the key stages, and the outcomes of a network penetration test.

May 1, 2025

Cybersecurity in healthcare: why hospitals have become a favorite target for hackers

Oleksandr Filipov: Security engineer at Datami, author of articles

Cybersecurity in healthcare: why hospitals have become a favorite target for hackers

Cybersecurity in healthcare is at risk: hospitals face more cyberattacks than banks. Learn how to protect medical data with expert tips from Datami.

Apr 24, 2025

Show all articles

On this page you will learn what cookies are and how and when we use them. Definition of the term Cookies Cookies are pieces of data that a web server generates and that a website stores on your user device (computer, smartphone, tablet, etc.). Each website or third-party service sends cookies to the browser installed on your device only if your browser allows it. This is possible if you have not set any restrictions in your browser settings to save cookies. Browsers are a very well thought out technology. They protect personal data and allow websites to access only cookies that were previously sent to them. Cookies are divided into: session cookies. They are stored in the memory of the browser only during your session, after leaving the site immediately removed. permanent. They are stored in the memory of the browser for a long time. Definition of the term “browser” A browser is an application for browsing websites. The most popular browsers are Chrome, Internet Explorer, Firefox and Safari. All listed browsers are safe. In the settings of these browsers, cookies can be easily disabled, as well as change the settings of their work. You can: accept all cookies; ask the browser to notify when cookies are used; do not accept cookies. Cookies on ak1-3.com.ua and how we use them We use cookies to: our site is more functional; to understand how you navigate on the site, what content you consume better, to develop the content strategy of the site; understand how many visits to the site were per day, month, year. Analyze the geographical identity of users of the site, the number of repeated visits and other data. Cookies that we use on our site. Third-party cookies. The buttons of social networks, videos and some other services of our site are the property of other companies. These companies may also use cookies on your device if you have used them on our site or have been previously registered with them. The privacy policy of the use of personal data by these services can be found on the websites of these services. Blocking cookies All browsers allow simple actions to disable cookies. To disable them, you must go to your browser settings and find cookies in them. But we must remember that blocking cookies can have a negative impact on the performance of many websites. How to delete files You can also always delete cookies that are stored on your computer. To do this, follow the instructions of your browser Again, deleting cookies can have a negative effect on the performance of many websites.