is a large energy corporation that generates electricity from solar, wind, and thermal power plants, extracts coal and gas, conducts energy trading, distributes electricity, and develops a network of charging stations in Ukraine.
The company operates in the field of critical infrastructure, processes confidential personal and corporate data, and complies with regulatory requirements, making information security a strategic priority.
For , we conducted a combined penetration test using gray-box and white-box approaches. We applied both static and dynamic analysis, combining manual and automated methods. Constant communication with the client was maintained, as unstable application performance complicated the testing process.
During testing, the team managed to bypass corporate network restrictions and discovered Wi-Fi access through an unprotected device. This made it possible to demonstrate real attack vectors.
The Datami team first conducted static and dynamic testing of the mobile applications, followed by an assessment of the company’s internal infrastructure, with particular focus on the Wi-Fi network and access policies. During the process, the team had to adapt to technical issues with the applications and clarify testing scenarios.
Every
During the security assessment at , the Datami team identified several critical, as well as a number of medium and low vulnerabilities in mobile applications and internal infrastructure. Some of the risks were related to network access and security policy configurations. During the testing process, our penetration testers also noted issues in application functionality.
As a result, the client received a detailed technical report and a recommended action plan, including:
After implementing the recommendations, a reduction in the risk of data leakage and unauthorized access is expected.
As a result of the collaboration with Datami, received a detailed technical report, an assessment of the security level of its mobile applications and network infrastructure, and recommendations for vulnerability remediation.
The testing was completed within the planned timeframe — 4–5 weeks.
This case study confirms the importance of regular penetration testing for critical infrastructure companies — both for security control and regulatory compliance.
This incident occurred back in 2017, but cybersecurity experts are still studying it in detail. This case features a series of classic security failures – serving as a clear example of what not to do.
Today, all it takes to take over a car is a computer. That’s exactly what hackers demonstrated at a special competition - they hacked a Tesla in just 120 seconds, and the result became a true sensation.
Today, nearly every business is closely connected to the internet: websites, mobile apps, cloud data storage, electronic payments, and more. This brings great convenience, but at the same time, it introduces additional risks and potential financial losses