Talk to a specialist

Cybersecurity case studies

Experiences consolidated from real engagements. Each file groups similar interventions and summarizes the need, the services delivered and the documented results.

We group experiences without identifying clients or publishing sensitive data. Results correspond to the documented scope of each engagement.

  • Consolidated experience 01

    Multi-sectorPentesting

    Internal security and corporate identity

    Problem
    Weaknesses in configuration, services and identity could make unauthorized access easier inside the organizations assessed.
    Results
    • Privileged access paths validated in controlled tests.
    • Weaknesses and effective controls documented by scope.
    • Technical priorities based on the impact observed.

    Identities withheld

  • Consolidated experience 02

    Multi-sectorPentesting

    External exposure, web applications and digital risks

    Problem
    Applications, public services and information exposure called for a technical review to identify risks and guide fixes.
    Results
    • Findings prioritized by application and asset.
    • Information and component exposures identified.
    • Recommendations specific to the risk observed.

    Identities withheld

  • Consolidated experience 03

    Multi-sectorPentesting

    Mobile application security and technical code review

    Problem
    The applications assessed needed their authentication, communication, storage and software-component controls checked.
    Results
    • Weaknesses in mobile controls documented.
    • Observations separated by platform and application.
    • Fix priorities delivered for follow-up.

    Identities withheld

  • Consolidated experience 04

    Multi-sectorPentesting

    WiFi, access control and network segmentation

    Problem
    It was necessary to verify access to wireless networks and the communication boundaries between segments with different functions.
    Results
    • Actual reach of access and communication documented.
    • Effective controls and excessive permissions identified.
    • Recommendations for restriction and network hardening.

    Identities withheld

  • Consolidated experience 05

    Multi-sectorAudit

    Vulnerabilities, follow-up and verification of fixes

    Problem
    Organizations needed to prioritize technical exposures and to check which risks persisted after corrective measures were applied.
    Results
    • Obsolescence and risky configurations prioritized.
    • Fixes checked in documented revalidations.
    • Residual and pending risks made visible for follow-up.

    Identities withheld

  • Consolidated experience 06

    Multi-sectorAudit

    Controls audit and security governance

    Problem
    Organizations needed to review controls, responsibilities and operating conditions to inform their security decisions.
    Results
    • Security policies and responsibilities documented.
    • Controls and observed conditions recorded.
    • Recommendations for reviewing and improving controls.

    Identities withheld

  • Consolidated experience 07

    Multi-sectorProtection

    Email, cloud identity and configuration hardening

    Problem
    Email, account, permission and connectivity configurations needed review and adjustment to reduce exposure and improve their controls.
    Results
    • Email, identity and permission changes documented.
    • Fixes and controls with a recorded close-out.
    • Partial measures and dependencies identified.

    Identities withheld

  • Consolidated experience 08

    Multi-sectorProtection

    Data protection, detection and security monitoring

    Problem
    Different organizations needed to centralize information controls and improve visibility of security-relevant events.
    Results
    • Devices and policies centralized, depending on scope.
    • Event and alert integration documented.
    • Monitoring rules and tests recorded.

    Identities withheld

  • Consolidated experience 09

    Multi-sectorAwareness

    Social engineering, awareness and technical training

    Problem
    Organizations and participants needed to assess how they respond to deception and to strengthen their knowledge of protection and technical security.
    Results
    • Interactions measured by scenario and group.
    • Findings to guide awareness actions.
    • Training and protection content documented.

    Identities withheld

  • Consolidated experience 10

    Multi-sectorForensics

    Incident investigation and ransomware response

    Problem
    Intrusion and encryption incidents called for reconstructing access, understanding how the attack spread and guiding response actions.
    Results
    • Timelines of access and propagation documented.
    • Findings on impact and exposed controls.
    • Containment and hardening recommendations.

    Identities withheld

  • Consolidated experience 11

    Multi-sectorForensics

    Expert examination of digital evidence and specialized forensic analysis

    Problem
    Suspicions, fraud and disputes needed to be clarified through evidence from email, documents, software or devices.
    Results
    • Timelines and traceability of digital evidence.
    • Assessment of integrity, authenticity and consistency.
    • Technical conclusions with the limits of the evidence stated expressly.

    Identities withheld

  • Consolidated experience 12

    Multi-sectorInfrastructure

    Network configuration and enterprise infrastructure support

    Problem
    Connectivity, segmentation and operational needs called for diagnosis, configuration changes and infrastructure support.
    Results
    • DNS and network changes documented.
    • Segments and services configured, depending on scope.
    • Network and cabling work with supporting service records.

    Identities withheld

Consolidated experience 01

PentestingMulti-sector

Internal security and corporate identity

Sectors served

  • Banking
  • Government
  • Aviation
  • Legal
  • Private sector

Services offered / delivered

  • Internal penetration testing
  • Active Directory and AD CS assessment
  • Analysis of privileges and internal services

Context

This experience brings together internal assessments of corporate networks and identity services. Scope, controls and results varied between organizations.

Documented interventions

  • Review of internal services, authentication, privileges and configuration.
  • Controlled validation of access chains across identity services where the scope allowed it.
  • Documentation of successful tests, blocked attempts and mitigation recommendations.

Documented results

  • In some engagements, paths to critical privileges were demonstrated; in others, controls were observed that blocked techniques that had been tested.
  • The reports separated identified vulnerabilities from proven exploitation and made it possible to prioritize risk treatment.

Scope of the result

The results belong to the scope of each assessment. We do not claim that every organization or system was compromised, nor any later remediation where there is no revalidation.

Methodology

Controlled penetration testing, identity review and correlation of technical evidence.

Identities withheld

Consolidated experience 02

PentestingMulti-sector

External exposure, web applications and digital risks

Sectors served

  • Banking
  • Government
  • Aviation
  • Legal
  • Private sector

Services offered / delivered

  • External and web/API penetration testing
  • Black-box and gray-box assessments
  • OSINT and digital exposure intelligence

Context

This experience consolidates work on public-facing surfaces and applications, together with digital exposure investigations. Each engagement kept its own scope and methodology.

Documented interventions

  • Assessment of authentication, sessions, configuration and controls in web/API applications.
  • Review of published services, components, certificates and administrative surfaces.
  • In intelligence work, identification of public assets and of exposed identities or information.

Documented results

  • Findings and recommendations were delivered separately for each application, service or exposure investigated.
  • Some surfaces produced no findings in their tests. That result was not extended to other assets or to the organization as a whole.

Scope of the result

Exposure in external sources does not prove valid credentials, active sessions or an intrusion. A client's reply about fixes is not the same as an independent retest.

Methodology

Controlled testing of applications and services; research in external sources for the intelligence work.

Identities withheld

Consolidated experience 03

PentestingMulti-sector

Mobile application security and technical code review

Sectors served

  • Banking
  • Private sector

Services offered / delivered

  • Android and iOS mobile penetration testing
  • Static analysis and binary review
  • Code and API review in documented scopes

Context

This group brings together mobile assessments, each with its own testing approach and depth of analysis.

Documented interventions

  • Review of authentication, biometrics, communications and information protection.
  • Analysis of components, storage and application behavior.
  • Static, binary, code or API review only in the engagements that document those activities.

Documented results

  • The reports identified specific weaknesses and countermeasures by platform and application.
  • Risks in mobile controls and components were documented without turning each observation into evidence of malicious use by third parties.

Scope of the result

Not every application had a code review. The assessment reports do not establish that all fixes were implemented.

Methodology

Mobile testing and technical analysis of controls, with static analysis or code review depending on scope.

Identities withheld

Consolidated experience 04

PentestingMulti-sector

WiFi, access control and network segmentation

Sectors served

  • Banking
  • Aviation
  • Private sector

Services offered / delivered

  • WiFi and access control penetration testing
  • Segmentation and VLAN hopping tests
  • Assessment of communication between segments

Context

This group combines wireless assessments and segmentation validations carried out in independent scopes.

Documented interventions

  • Tests of association, access and visibility from wireless networks.
  • Comparison of authorized communication with the restrictions between segments.
  • Validation of segmentation-crossing techniques and a record of which tests were blocked or allowed.

Documented results

  • Some engagements documented wireless access and service visibility that called for tighter restrictions.
  • In other assessments VLAN hopping was not achieved, although recommendations on permitted traffic flows remained.

Scope of the result

Reaching a network or a service does not demonstrate exploitation of, or authentication to, that service. Failing to achieve VLAN hopping does not establish absolute isolation or PCI certification.

Methodology

Controlled wireless access testing and comparison of communications between segments.

Identities withheld

Consolidated experience 05

AuditMulti-sector

Vulnerabilities, follow-up and verification of fixes

Sectors served

  • Banking
  • Government
  • Legal
  • Private sector

Services offered / delivered

  • Vulnerability analysis and management
  • Assessment of critical infrastructure and SWIFT environments, depending on scope
  • Periodic assessments and technical prioritization
  • Retest and revalidation of remediation

Context

This group brings together assessment cycles, technical matrices and revalidations. Differences in scope and date were preserved in each engagement.

Documented interventions

  • Identification of unsupported software, pending patches and insecure configurations.
  • Organization of findings and recommendations by severity and impact.
  • Comparison of initial and later results where a documented revalidation exists.

Documented results

  • In some revalidations, critical and high risks within the scope assessed were no longer recorded; in others, relevant exposures remained.
  • The documentation made it possible to distinguish verified fixes, residual risks and findings that needed follow-up.

Scope of the result

Not every assessment had a retest. Differences between scans can depend on scope, date or plugins. We do not promise that risk is eliminated entirely.

Methodology

Vulnerability analysis, technical review and comparison of evidence between cycles.

Identities withheld

Consolidated experience 06

AuditMulti-sector

Controls audit and security governance

Sectors served

  • Government
  • Aviation
  • Banking
  • Private sector

Services offered / delivered

  • Diagnosis of security governance and controls
  • Drafting of policies and guidelines
  • Inspection of physical and environmental controls

Context

This experience consolidates controls reviews, document drafting and physical inspections. These were separate engagements that fed into security governance.

Documented interventions

  • Review of controls and responsibilities through interviews, documentation and checklists.
  • Drafting of access, secure development, network, password and acceptable use policies in the engagements that included that service.
  • Inspection of physical, environmental and operational conditions at the facilities assessed.

Documented results

  • Guidelines and documents on responsibilities and operation were delivered in the document-based consulting projects.
  • The assessments and inspections recorded responses and observed conditions, with recommendations bound by the scope of each report.

Scope of the result

We do not claim ISO certification, full compliance or operational adoption of every policy. An inspection describes conditions observed, not permanent compliance.

Methodology

Document review, interviews, checklists and on-site inspection, depending on the engagement.

Identities withheld

Consolidated experience 07

ProtectionMulti-sector

Email, cloud identity and configuration hardening

Sectors served

  • Legal
  • Private sector

Services offered / delivered

  • Microsoft 365 audit and remediation
  • Email protection and identity controls
  • Firewall and service reconfiguration, depending on scope

Context

This group covers engagements to review and adjust email, identity and connectivity-security configurations.

Documented interventions

  • Review of accounts, privileges, authorized applications and email protection settings.
  • Application of documented changes to authentication, permissions and publishing controls.
  • Record of close-outs, partial mitigations and dependencies on infrastructure or licensing.

Documented results

  • There are reports with changes applied and close-outs recorded, alongside items that were mitigated or remain pending.
  • The documentation distinguishes email and identity controls from residual infrastructure tasks and from data policies that remain in monitoring.

Scope of the result

Remediation is not presented as complete where dependencies or partial items remain. A DLP rule in monitoring mode is not described as preventive blocking.

Methodology

Configuration audit, documented changes and validation of controls based on the evidence available.

Identities withheld

Consolidated experience 08

ProtectionMulti-sector

Data protection, detection and security monitoring

Sectors served

  • Banking
  • Private sector

Services offered / delivered

  • Centralized management and DLP implementation
  • Policy configuration and information classification
  • Honeypots and event integration with a SIEM

Context

Two lines of experience come together here: data protection and event detection. They are not stages of a single project or a universal deployment.

Documented interventions

  • Data protection: centralization of devices and creation of documented rules, including policies in monitoring mode and test rules.
  • Detection: honeypot configuration, event ingestion and integration of rules and alerts in specific engagements.
  • Additional integrations: phases that have only planning, instructions or progress without a close-out are kept as partial.

Documented results

  • The reports support configured controls and tests or monitoring, within their respective scopes.
  • In detection engagements, active decoys, event ingestion and enabled rules were documented.

Scope of the result

We do not claim general DLP blocking, a complete CASB deployment, prevention of all leaks or a 24/7 SOC. A description of use cases does not prove that real attacks were detected.

Methodology

Control configuration, documented testing and review of event ingestion and integration.

Identities withheld

Consolidated experience 09

AwarenessMulti-sector

Social engineering, awareness and technical training

Sectors served

  • Banking
  • Government
  • Private sector
  • Education

Services offered / delivered

  • Phishing, vishing and attachment simulation
  • In-person social engineering and USB tests, depending on scope
  • Awareness and technical security training

Context

This experience consolidates authorized campaigns and training services. Simulation measurements and training services are kept as separate evidence.

Documented interventions

  • Design and execution of email, phone-call, attachment, in-person pretext or USB scenarios, according to the documented scope.
  • Recording of interactions and responses, including physical validation controls where they were assessed.
  • Delivery of awareness and technical training content, with documentation supporting the service.

Documented results

  • The campaigns and in-person tests produced measurements and observations on responses, identity validation and access.
  • The training documents support the content and services delivered, but on their own do not establish a change in behavior or certification of participants.

Scope of the result

Simulated attachments are not described as real infections. Campaigns are not added up as unique people, and no measured reduction in clicks is promised without a later evaluation.

Methodology

Authorized simulation, recording of interactions and documented training.

Identities withheld

Consolidated experience 10

ForensicsMulti-sector

Incident investigation and ransomware response

Sectors served

  • Legal
  • Private sector

Services offered / delivered

  • Incident response and infrastructure forensic analysis
  • Ransomware and lateral movement investigation
  • Correlation of logs and indicators

Context

This group brings together investigations of affected infrastructure and response support, with the evidence and limits specific to each incident.

Documented interventions

  • Analysis of logs, account activity, connections and tools associated with the incident.
  • Construction of timelines and cross-checking across systems, sources and indicators.
  • Documentation of impact and recommendations for containment, recovery and improved controls.

Documented results

  • Traceability of access, propagation and control exposure was provided in the cases investigated.
  • The reports distinguished documented facts, indications and recommendations for the response.

Scope of the result

We do not claim full recovery, restoration times or losses avoided without evidence. Attributions of ransomware family or authorship that are inconsistent or inconclusive are left out.

Methodology

Forensic analysis of logs and artifacts, temporal correlation and documentation of evidence.

Identities withheld

Consolidated experience 11

ForensicsMulti-sector

Expert examination of digital evidence and specialized forensic analysis

Sectors served

  • Banking
  • Aviation
  • Legal
  • Private sector
  • Individuals

Services offered / delivered

  • Email forensics and fraud analysis
  • Document and image authentication
  • Expert software examination
  • Forensics of computers, storage and mobile devices

Context

This experience consolidates independent expert examinations and investigations. The file represents experience by specialty, not a single dispute or person.

Documented interventions

  • Email and documents: reconstruction of communications and cross-checking of headers, dates, attachments and metadata.
  • Software: review of repositories, change requests, contracts and infrastructure as sources of traceability.
  • Computers, storage and devices: review of artifacts, logs and available evidence; assessment of the feasibility of mobile recovery in the specific engagements.

Documented results

  • The reports provided timelines and elements of traceability, integrity or authenticity for the evidence examined.
  • Some mobile reviews did not identify conclusive indicators of compromise. A recovery assessment that did not manage to recover the data was documented as a technical limitation.

Scope of the result

An expert conclusion does not imply a favorable ruling or acceptance by the court. We do not claim authorship of the fraud, a universal absence of spyware, a complete physical extraction or a successful recovery beyond what is documented.

Methodology

Preservation and analysis of artifacts, integrity checks and cross-checking of metadata and documentary sources.

Identities withheld

Consolidated experience 12

InfrastructureMulti-sector

Network configuration and enterprise infrastructure support

Sectors served

  • Legal
  • Private sector

Services offered / delivered

  • Network and service diagnosis and configuration
  • Switching, VLANs and connectivity
  • Structured cabling and IT support
  • Collaboration and file diagnostics

Context

This experience gathers documented network, connectivity and operational support services. Related proposals do not automatically become installations carried out.

Documented interventions

  • Diagnosis of DNS, network identity services and connectivity problems.
  • Documented configuration of devices, segments, routes and services in infrastructure engagements.
  • Cabling services backed by commercial documentation, and diagnosis of collaboration or file incidents, depending on the engagement.

Documented results

  • There are records of changes implemented and of the configuration of network segments and services.
  • The cabling work has supporting service records; the collaboration diagnoses document probable causes and recommendations.

Scope of the result

We do not claim long-term stability, adoption of every recommendation or certification of each cabling point without the corresponding tests. Offers with no close-out remain outside these results.

Methodology

Technical diagnosis, configuration review and documentation of work and service records.

Identities withheld

Tell us what you need to protect

A SoluProTec specialist reviews your request and contacts you through the channel you provide.

Talk to a specialistIs there an incident in progress?