(929) 590-5818 [email protected]
en
en

Cybersecurity Assessment of a Survey Platform

Client:
A research company that provides online survey analysis services (B2C/B2B)
Industry:
Marketing research
Focus:
Testing the online survey platform and compliance with regulatory requirements
Main challenge:
Testing survey flows without mass sending of requests to third-party services (3rd party) and preparing the platform for a regulatory audit.
Market:
International
Services provided:
Key Takeaways
  • Three online survey scenarios were tested
  • The overall level of cybersecurity was improved
  • 6 vulnerabilities were detected: 3 medium, 2 low, 1 informational
  • Protection against automated requests was enhanced
  • Risks of token and CAPTCHA abuse were eliminated
    • 3
    scenarios tested
    6
    vulnerabilities detected
    1
    month project duration
    Cybersecurity Assessment of a Survey Platform
    Nov 5, 2025
    15 min
    If the survey system starts collecting invalid data, the analytics suffer, and the platform loses clients’ trust. To avoid this, an international research company turned to Datami to check the security of its platform. The pentest revealed 6 vulnerabilities, the correction of which improved the quality of analytics and the level of cybersecurity.

    An international research company provides online survey analysis services for B2C and B2B clients. The platform allows for quickly collecting respondents’ answers and generating insights for business decisions.

    For a marketing research service, cybersecurity is crucial, as vulnerabilities can distort or destroy survey results, affect the accuracy of analytics, and undermine the company’s reputation.

    Tasks and challenges
    The research company turned to Datami to check the security of its survey platform. Within the project, it was necessary to perform penetration testing of several public survey scenarios to identify potential vulnerabilities and verify the platform’s compliance with regulatory requirements.
    • Test 3 publicly available survey scenarios.
    • Check for vulnerabilities in the security system.
    • Provide a report with recommendations for eliminating the identified issues.
    icon
    Search for vulnerabilities
    Testing survey flows for technical and logical errors
    icon
    Compliance with standards
    Assessment of the platform’s cybersecurity in accordance with international regulatory requirements
    icon
    Pentest report
    Documenting test results and recommendations for strengthening cybersecurity
    Datami methodology: Cybersecurity assessment
    Our approach

    The Datami team applied a Black-Box pentesting strategy: testing was carried out from the position of an external user, without access to the company’s code or internal infrastructure. This made it possible to simulate a cyberattack as realistically as possible.

    During the project, we combined automated and manual testing methods. To identify vulnerabilities, we used a standard set of web application pentesting tools – Burp Suite, OWASP ZAP, Nmap, and others.

    Black-box
    Black-Box
    A strategy where pentesters operate without access to the client's internal systems. This approach allows simulating an attack by external malicious actors.
    Project stages

    First, the Datami team agreed with the client on all key aspects: the scope and depth of the assessment, limitations (including restrictions on mass requests to 3rd-party services), and more. 

    Then, they scanned the survey scenarios and tested them manually. After testing, they analyzed the results and prepared a detailed report with conclusions and recommendations.

    • Preparation
      Defining the scope and limitations, creating test accounts, and planning attack scenarios.
    • Web application pentest
      Automated scanning and manual testing of 3 publicly available survey scenarios.
    • Final report
      Classification and description of identified vulnerabilities, and recommendations for better compliance with regulatory requirements.
    Cybersecurity starts with action
    How we can help you?

    Every cybersecurity case study we solve involves deep analysis, tailored solutions, and measurable results.
    Datami has already helped over 600 companies strengthen their digital defenses — and we can do the same for your business.
    Ready to take action?

    Let’s start with a free consultation!
    Results and recommendations
    Results and recommendations

    Datami assessed the cybersecurity of the web platform. We tested 3 online survey scenarios and identified 6 vulnerabilities: 3 medium, 2 low, and 1 informational.

    Based on the pentest results, Datami experts provided the client with recommendations aimed at strengthening the platform’s cyber resilience and improving compliance with regulatory requirements:

    • implement a Content Security Policy (CSP);
    • update vulnerable JavaScript libraries;
    • strengthen CAPTCHA and user request validation;
    • make token and unique link generation less predictable;
    • enable HTTP Strict Transport Security (HSTS).

    After fixing the identified issues, the platform’s level of security and compliance with standards significantly increased.

    Our certificates
    Key project results

    In the field of marketing research, client trust depends on the accuracy of data. For example, if a survey collects invalid responses, a company risks losing not only analytical value but also its reputation. 

    As this case study shows, Datami’s pentest helped identify vulnerabilities in the platform’s security system that could have distorted survey results and ensured better compliance with regulatory requirements.

    Direction
    Before the project
    After implementation
    Security status
    Vulnerabilities in survey scenarios
    6 vulnerabilities eliminated, protection level improved
    Access abuse
    Possibility to bypass CAPTCHA and recreate surveys
    Access restricted, request validation strengthened
    Regulatory compliance
    Required confirmation
    Compliance with security policies improved
    More success stories with Datami
    Browse other project case studies
    Mobile App Security Outstaff Audit

    Mobile App Security Outstaff Audit

    • Identified dangerous configurations and data leaks
    • Strengthened security before product launch
    Services:
    Nov 20, 2025
    Security Policy Audit for a Fintech Company

    Security Policy Audit for a Fintech Company

    • Seven key cybersecurity policies were reviewed and assessed
    • Regulations aligned with ISO 27001, DORA, GDPR, and NBG
    Services:
    Security policy and compliance audit
    Nov 20, 2025
    Security Testing of the DonorUA Medical Platform

    Security Testing of the DonorUA Medical Platform

    • Provided a security recommendations report.
    • No critical security threats were confirmed.
    Services:
    Web application pentest (Black-box)
    Nov 18, 2025
    Back to all cases
    Security image
    Ready to assess your project's security?
    Contact Datami — we’ll help you identify risks, strengthen your cybersecurity, and confidently pass certification.
    Datami articles
    Modern Phishing Campaigns Use PDF Files for Attacks Datami Newsroom
    Datami Newsroom

    Modern Phishing Campaigns Use PDF Files for Attacks

    Next-generation phishing campaigns disguise themselves as well-known brands and use artificial intelligence to mislead users. In 2025, companies face a wave of sophisticated attacks that are changing cybersecurity rules.

    Nov 24, 2025 3 min
    KillSec Ransomware Attacks Healthcare Datami Newsroom
    Datami Newsroom

    KillSec Ransomware Attacks Healthcare

    The hacker group KillSec has recently been actively attacking the IT systems of the healthcare sector in Latin America and other countries — the attackers have already stolen dozens of gigabytes and nearly 95,000 files.

    Nov 18, 2025
    Datami at MERGE Madrid and EBC 25 Datami Newsroom
    Datami Newsroom

    Datami at MERGE Madrid and EBC 25

    The Datami team attended MERGE Madrid and the European Blockchain Convention 2025 to share their expertise and witness how Web3 is evolving. This year, the focus shifted toward real-world solutions – security, auditing, and transparent standards.

    Nov 13, 2025 3 min
    Show all articles
    Order a free consultation
    By submitting this form, I confirm that I have read and agree to the Privacy policy
    We value your privacy
    We use cookies to enhance your browsing experience, serve personalized ads or content, and analyze our traffic. By clicking "Accept All", you consent to our use of cookies. Cookie policy