DAVITOO UKRAINE: LMS Security Testing

Client:

DAVINTOO UKRAINE LLC — a developer of e-learning and analytics software

Industry:

Healthcare

Focus:

Ensuring the security of the LMS Collaborator platform for HIPAA compliance

Main challenge:

Identifying critical vulnerabilities in web applications and server infrastructure to prevent leaks of medical and personal data

Market:

International

Services provided:

Gray-box pentesting of web platform, containers, and network

Key Takeaways

Increased the platform’s resilience to cyberattacks by 95%

Identified 15 vulnerabilities, including 5 critical issues

Delivered a detailed report with recommendations for ongoing security improvements

Achieved full compliance with HIPAA requirements

Completed a full security audit and gray-box penetration test of LMS Collaborator

vulnerabilities identified

95%

increase in attack resilience

100%

compliance with HIPAA requirements

Apr 4, 2025

14 min

DAVINTOO UKRAINE LLC was preparing for HIPAA certification and requested a security testing of its LMS platform, which handles sensitive data. Datami performed a full security audit and gray-box penetration test. As a result, after addressing the identified vulnerabilities, LMS Collaborator now fully meets security requirements.

DAVINTOO UKRAINE LLC is an international IT company specializing in software solutions for the e-learning sector. Its flagship product, LMS Collaborator, is a web-based platform for learning, communication, and analytics, used daily by over 5,000 users.

Given that DAVINTOO handles both personal and medical data, HIPAA compliance is critical to ensuring the security of its digital products.

Objectives and challenges

DAVINTOO UKRAINE LLC initiated a comprehensive security testing of its LMS Collaborator platform as part of its preparation for HIPAA certification. The primary challenge lay in identifying potential vulnerabilities within the web platform, its applications, and the underlying server infrastructure.

The project aimed to ensure compliance with international security standards and to reduce the risk of data breaches.

Conduct a penetration test and security audit of the web platform, servers, and web applications.
Deliver a comprehensive report with recommendations following HIPAA standards.
Complete the assessment with maximum accuracy within the defined 4-week timeline.

Pentest and security audit

Gray-box testing of LMS, servers and web applications for vulnerabilities

Vulnerability detection

Threat detection, security enhancement, and risk minimization

Report preparation

Report preparation with recommendations for HIPAA certification

Datami Methodology: Security Testing for DAVINTOO UKRAINE LLC

Our approach

Datami conducted a comprehensive security audit of the internal infrastructure of DAVINTOO UKRAINE LLC, covering the web platform, servers, and applications.

Regular communication with the client — including weekly status meetings and interim reports — ensured effective task management and rapid incident response.

To assess risks and identify vulnerabilities, we applied a gray-box approach, conducting tests with partial access to the client's technical documentation.

We combined manual analysis techniques with automated scanning tools, utilizing Metasploit and Paros Proxy.

Gray-box

The team had limited access to internal information — this approach allowed us to effectively combine an external perspective with an internal system analysis.

Key project stages and solutions

During the project, the Datami team carried out a highly accurate, full-scale security assessment of the LMS Collaborator web platform, servers, and applications. A gray-box approach was chosen for the penetration test, combining both automated and manual testing methods.

The team made strategic decisions to enhance access control and strengthen the security of web applications.

Key project stages:

Preparation

Review of technical documentation, agreement on the approach, and identification of critical assets for testing.
Testing

Execution of gray-box penetration testing using Metasploit, Paros Proxy, and manual auditing to identify vulnerabilities.
Analysis and Reporting

In-depth analysis of identified risks, and preparation of a report with recommendations for risk mitigation and HIPAA compliance.

Results and recommendations

At the start of the project, LMS Collaborator was assessed as having a high-risk level due to vulnerabilities in web applications and potential data leaks, posing a threat to HIPAA compliance.

During the penetration test, the Datami team identified 15 vulnerabilities, 5 of which were critical. Some of these could have been exploited to gain unauthorized access to user accounts or extract sensitive information.

The client received the following recommendations:

regular security testing and updates;
strengthening access control;
cyber hygiene training for staff.

After implementing the recommended measures, LMS Collaborator achieved full HIPAA compliance, and its overall security level significantly improved. Two-factor authentication and regular security updates were introduced. All critical vulnerabilities were eliminated within 24 hours of reporting, preventing data breaches, penalties, and reputational damage.

The project was completed in 4 weeks, outperforming the industry average of 6 weeks.

Key project outcomes

DAVINTOO UKRAINE LLC successfully enhanced the cybersecurity resilience of LMS Collaborator and achieved full HIPAA compliance. The company gained a clear understanding of its threat landscape, a thorough technical audit, and actionable recommendations for strengthening its security systems. All project objectives were met within the planned timeframe.

This case study demonstrates that security testing and compliance are not just formalities, but essential safeguards against real-world threats and reputational damage.

Aspect

Before the project

After implementation

Security status

High risk due to critical vulnerabilities

HIPAA compliance achieved, risks reduced, regular updates implemented

Critical vulnerabilities

Potential data leaks and unauthorized access

5 critical vulnerabilities resolved within 24 hours

Account compromise risk

Unreliable authentication

Two-factor authentication (2FA) and enhanced access control implemented

Security compliance

Partial HIPAA compliance

Full readiness for certification

Timeline

Industry standard: 6 weeks

Completed in 4 weeks

Pentest and Protection of Platform from DDoS

Discovered 30 vulnerabilities in two web applications
Implemented DataGuard and Cloudflare for DDoS protection

Services:

Black-box web app pentesting, implementation of Dataguard

Jul 8, 2025

P2P Platform Case Study: GDPR Compliance Audit

Improved GDPR compliance and avoided potential losses
Identified 10 vulnerabilities, including 3 critical ones

Services:

Penetration testing, smart contract audit, code security review

Jun 27, 2025

Case Study: Consulting Company Security Test

Identified 19 vulnerabilities, including 1 critical, and 8 medium
Provided security compliance recommendations

Services:

Black-box pentest of web resources and infrastructure

Jun 6, 2025

Back to all cases

Datami articles

Aviation and Cyber Threats: TOP Hacker Attacks on Airports and Aircraft

Datami Newsroom

Aviation and Cyber Threats: TOP Hacker Attacks on Airports and Aircraft

The aviation industry is one of the most technologically advanced sectors, significantly influenced by digitalization. At the same time, this increases its vulnerability to cyber threats, which can have catastrophic consequences.

Jul 23, 2025 3 min

TOP-5 Cyber Threats for Gamers: What You Need to Know in 2025

Datami Newsroom

TOP-5 Cyber Threats for Gamers: What You Need to Know in 2025

Gaming is a billion-dollar market with big money in circulation, which makes gamers a prime target for cybercriminals. Even in a game, users can lose personal data, money, or access to their accounts.

Jul 21, 2025 3 min

TOP-8 Phrases in Scam Emails That Should Raise Your Suspicion

Datami Newsroom

TOP-8 Phrases in Scam Emails That Should Raise Your Suspicion

Phishing has evolved from simple deception into a complex social engineering scheme. Scammers launch mass attacks on personal data, exploiting human inattention and using template phrases to steal trust.

Jul 18, 2025 3 min

Show all articles

On this page you will learn what cookies are and how and when we use them. Definition of the term Cookies Cookies are pieces of data that a web server generates and that a website stores on your user device (computer, smartphone, tablet, etc.). Each website or third-party service sends cookies to the browser installed on your device only if your browser allows it. This is possible if you have not set any restrictions in your browser settings to save cookies. Browsers are a very well thought out technology. They protect personal data and allow websites to access only cookies that were previously sent to them. Cookies are divided into: session cookies. They are stored in the memory of the browser only during your session, after leaving the site immediately removed. permanent. They are stored in the memory of the browser for a long time. Definition of the term “browser” A browser is an application for browsing websites. The most popular browsers are Chrome, Internet Explorer, Firefox and Safari. All listed browsers are safe. In the settings of these browsers, cookies can be easily disabled, as well as change the settings of their work. You can: accept all cookies; ask the browser to notify when cookies are used; do not accept cookies. Cookies on ak1-3.com.ua and how we use them We use cookies to: our site is more functional; to understand how you navigate on the site, what content you consume better, to develop the content strategy of the site; understand how many visits to the site were per day, month, year. Analyze the geographical identity of users of the site, the number of repeated visits and other data. Cookies that we use on our site. Third-party cookies. The buttons of social networks, videos and some other services of our site are the property of other companies. These companies may also use cookies on your device if you have used them on our site or have been previously registered with them. The privacy policy of the use of personal data by these services can be found on the websites of these services. Blocking cookies All browsers allow simple actions to disable cookies. To disable them, you must go to your browser settings and find cookies in them. But we must remember that blocking cookies can have a negative impact on the performance of many websites. How to delete files You can also always delete cookies that are stored on your computer. To do this, follow the instructions of your browser Again, deleting cookies can have a negative effect on the performance of many websites.