Case Study: DAVITOO UKRAINE – LMS Security Testing Before HIPAA Certification

Client:

DAVITOO UKRAINE LLC — a developer of e-learning and analytics software

Industry:

Healthcare

Focus:

Ensuring the security of the LMS Collaborator platform for HIPAA compliance

Main challenge:

Identifying critical vulnerabilities in web applications and server infrastructure to prevent leaks of medical and personal data

Market:

International

Services provided:

Gray-box penetration testing and security audit of the web platform, containerized environments, and network interactions

Key Takeaways

Completed a full security audit and gray-box penetration test of LMS Collaborator

Identified 15 vulnerabilities, including 5 critical issues, resolved within 24 hours

Delivered a detailed report with recommendations for ongoing security improvements

Increased the platform’s resilience to cyberattacks by 95%

Achieved full compliance with HIPAA requirements

vulnerabilities identified

95%

increase in attack resilience

100%

compliance with HIPAA requirements

Case Study: DAVITOO UKRAINE – LMS Security Testing Before HIPAA Certification

May 11, 2025

14 min

DAVINTOO UKRAINE LLC was preparing for HIPAA certification and requested a security testing of its LMS platform, which handles sensitive data. Datami performed a full security audit and gray-box penetration test. As a result, after addressing the identified vulnerabilities, LMS Collaborator now fully meets security requirements.

DAVINTOO UKRAINE LLC is an international IT company specializing in software solutions for the e-learning sector. Its flagship product, LMS Collaborator, is a web-based platform for learning, communication, and analytics, used daily by over 5,000 users.

Given that DAVINTOO handles both personal and medical data, HIPAA compliance is critical to ensuring the security of its digital products.

Objectives and challenges

DAVINTOO UKRAINE LLC initiated a comprehensive security testing of its LMS Collaborator platform as part of its preparation for HIPAA certification. The primary challenge lay in identifying potential vulnerabilities within the web platform, its applications, and the underlying server infrastructure.

The project aimed to ensure compliance with international security standards and to reduce the risk of data breaches.

Conduct a penetration test and security audit of the web platform, servers, and web applications.
Deliver a comprehensive report with recommendations following HIPAA standards.
Complete the assessment with maximum accuracy within the defined 4-week timeline.

Pentest and security audit

Gray-box testing of LMS, servers and web applications for vulnerabilities

Vulnerability detection

Threat detection, security enhancement, and risk minimization

Report preparation

Report preparation with recommendations for HIPAA certification

Datami Methodology: Security Testing for DAVINTOO UKRAINE LLC

Our approach

Datami conducted a comprehensive security audit of the internal infrastructure of DAVINTOO UKRAINE LLC, covering the web platform, servers, and applications.

Regular communication with the client — including weekly status meetings and interim reports — ensured effective task management and rapid incident response.

To assess risks and identify vulnerabilities, we applied a gray-box approach, conducting tests with partial access to the client's technical documentation.

We combined manual analysis techniques with automated scanning tools, utilizing Metasploit and Paros Proxy.

Gray-box

The team had limited access to internal information — this approach allowed us to effectively combine an external perspective with an internal system analysis.

Key project stages and solutions

During the project, the Datami team carried out a highly accurate, full-scale security assessment of the LMS Collaborator web platform, servers, and applications. A gray-box approach was chosen for the penetration test, combining both automated and manual testing methods.

The team made strategic decisions to enhance access control and strengthen the security of web applications.

Key project stages:

Preparation

Review of technical documentation, agreement on the approach, and identification of critical assets for testing.
Testing

Execution of gray-box penetration testing using Metasploit, Paros Proxy, and manual auditing to identify vulnerabilities.
Analysis and Reporting

In-depth analysis of identified risks, and preparation of a report with recommendations for risk mitigation and HIPAA compliance.

Results and recommendations

At the start of the project, LMS Collaborator was assessed as having a high-risk level due to vulnerabilities in web applications and potential data leaks, posing a threat to HIPAA compliance.

During the penetration test, the Datami team identified 15 vulnerabilities, 5 of which were critical. Some of these could have been exploited to gain unauthorized access to user accounts or extract sensitive information.

The client received the following recommendations:

regular security testing and updates;
strengthening access control;
cyber hygiene training for staff.

After implementing the recommended measures, LMS Collaborator achieved full HIPAA compliance, and its overall security level significantly improved. Two-factor authentication and regular security updates were introduced. All critical vulnerabilities were eliminated within 24 hours of reporting, preventing data breaches, penalties, and reputational damage.

The project was completed in 4 weeks, outperforming the industry average of 6 weeks.

Key project outcomes

DAVINTOO UKRAINE LLC successfully enhanced the cybersecurity resilience of LMS Collaborator and achieved full HIPAA compliance. The company gained a clear understanding of its threat landscape, a thorough technical audit, and actionable recommendations for strengthening its security systems. All project objectives were met within the planned timeframe.

This case study demonstrates that security testing and compliance are not just formalities, but essential safeguards against real-world threats and reputational damage.

Aspect

Before the project

After implementation

Security status

High risk due to critical vulnerabilities

HIPAA compliance achieved, risks reduced, regular updates implemented

Critical vulnerabilities

Potential data leaks and unauthorized access

5 critical vulnerabilities resolved within 24 hours

Account compromise risk

Unreliable authentication

Two-factor authentication (2FA) and enhanced access control implemented

Security compliance

Partial HIPAA compliance

Full readiness for certification

Timeline

Industry standard: 6 weeks

Completed in 4 weeks

Case Fraudline: Scheduled Pentest of a Whistleblowing Platform

Identified 6 technical vulnerabilities: 5 low-risk and 1 informational
Performed additional manual testing of business logic

Services:

automated gray-box pentest, audit of secure coding practices, additional manual review of business logic

May 30, 2025

P2P Platform Case Study: Comprehensive Security and GDPR Compliance Audit

Identified 10 vulnerabilities, including 3 critical ones
Improved GDPR compliance and avoided potential financial losses of up to $300,000

Services:

Penetration testing, smart contract audit, code security review, testing for SQLi, XSS, and RCE vulnerabilities, OSINT analysis, and cloud infrastructure security assessment

May 27, 2025

Case Study Grindset Software: Payment System Pentest for PCI DSS Compliance

Conducted a black-box penetration test of critical payment system components
Discovered 15 vulnerabilities; 5 critical issues were resolved within 48 hours

Services:

Black-box penetration testing of the payment system, including assessment of web applications, servers, databases, and communication channels

May 11, 2025

Back to home page

Datami articles

Phishing is Evolving: What Are the Main Threats in 2025 and How to Counter Them

Datami Newsroom

Phishing is Evolving: What Are the Main Threats in 2025 and How to Counter Them

This method of digital deception has been known for several decades, yet it remains one of the most dangerous cyber threats for both individual users and companies. 75% of organizations worldwide encountered at least one phishing attempt.

Jun 20, 2025 3 min

Top 10 Cyberattacks That Brought Global Corporations to a Halt

Datami Newsroom

Top 10 Cyberattacks That Brought Global Corporations to a Halt

Cyberattacks today pose a serious threat not only to individual users but also to global corporations. Criminals use increasingly sophisticated methods, causing companies billions in losses and disrupting the operation of critical systems.

Jun 17, 2025 3 min

Datami at the Barcelona Cybersecurity Congress 2025: New Horizons in Cybersecurity

Datami Newsroom

Datami at the Barcelona Cybersecurity Congress 2025: New Horizons in Cybersecurity

Datami took part in the Barcelona Cybersecurity Congress 2025, one of Europe’s key events dedicated to cybersecurity innovations and technologies.

Jun 3, 2025

Show all articles

Order a free consultation

On this page you will learn what cookies are and how and when we use them. Definition of the term Cookies Cookies are pieces of data that a web server generates and that a website stores on your user device (computer, smartphone, tablet, etc.). Each website or third-party service sends cookies to the browser installed on your device only if your browser allows it. This is possible if you have not set any restrictions in your browser settings to save cookies. Browsers are a very well thought out technology. They protect personal data and allow websites to access only cookies that were previously sent to them. Cookies are divided into: session cookies. They are stored in the memory of the browser only during your session, after leaving the site immediately removed. permanent. They are stored in the memory of the browser for a long time. Definition of the term “browser” A browser is an application for browsing websites. The most popular browsers are Chrome, Internet Explorer, Firefox and Safari. All listed browsers are safe. In the settings of these browsers, cookies can be easily disabled, as well as change the settings of their work. You can: accept all cookies; ask the browser to notify when cookies are used; do not accept cookies. Cookies on ak1-3.com.ua and how we use them We use cookies to: our site is more functional; to understand how you navigate on the site, what content you consume better, to develop the content strategy of the site; understand how many visits to the site were per day, month, year. Analyze the geographical identity of users of the site, the number of repeated visits and other data. Cookies that we use on our site. Third-party cookies. The buttons of social networks, videos and some other services of our site are the property of other companies. These companies may also use cookies on your device if you have used them on our site or have been previously registered with them. The privacy policy of the use of personal data by these services can be found on the websites of these services. Blocking cookies All browsers allow simple actions to disable cookies. To disable them, you must go to your browser settings and find cookies in them. But we must remember that blocking cookies can have a negative impact on the performance of many websites. How to delete files You can also always delete cookies that are stored on your computer. To do this, follow the instructions of your browser Again, deleting cookies can have a negative effect on the performance of many websites.