10 real engagements · 5 detailed + 5 on blog · Names anonymised

Real findings. Real impact.

Every case study below is from a real ThreatRiX engagement. Client names are anonymised. Severity ratings, technical details, and outcomes are not.

Detailed case studies

5 deep-dive engagements — full technical detail

Fintech
OTP flooding on payment gateway
No rate limiting — 10,000 req/min brute force possible. CVSS 9.3
✓ Account takeover risk eliminated
 SaaS
JWT signing secret in API response
Complete token forgery possible for any user. CVSS 10.0
✓ Auth rebuilt before breach
 Startup
Public S3 bucket pre-launch
847 customer data files publicly accessible. CVSS 9.1
✓ Breach avoided pre-launch
 E-commerce
File upload bypass → RCE
PHP webshell executed on production server. CVSS 9.8
✓ RCE prevented
 Healthcare
Patient PII via IDOR in records API
Any user could read any patient record. CVSS 8.8. HIPAA risk.
✓ PHI exposure resolved in 48hrs
More case studies

Additional engagements — on the blog

Five more real ThreatRiX engagements published on blog.threatrix.ai — Intune deployments, firewall breaches, Zero Trust, BEC attacks, and BFSI vulnerability reduction.

Intune · Device Mgmt
300 unmanaged devices brought to full compliance in 14 working days with Intune
Full device inventory, Intune enrolment, compliance policies, and conditional access — all in under 3 weeks
✓ 300 devices compliant · 14 days · Zero rollout failures
 Network · Firewall
Critical firewall misconfiguration fixed — data breach prevented in 24 hours
Exposed internal services discovered during passive assessment — firewall rule gap allowing unauthorised external access
✓ Breach prevented · Remediated in 24 hrs · Firewall hardened
 Zero Trust · Architecture
From zero security posture to Zero Trust architecture in 90 days
No MFA, no identity governance, flat network — full Zero Trust programme designed and implemented from scratch
✓ Zero Trust live · 90 days · MFA + conditional access + segmentation
 BEC · Email Security
BEC attack detected and blocked — ₹2 crore saved
Business Email Compromise attack in progress — fraudulent payment instruction intercepted before transfer executed
✓ ₹2 Cr saved · Attack blocked · DMARC + mail flow secured
 BFSI · Vulnerability Mgmt
Active vulnerabilities reduced by 70% for BFSI client in 60 days
Full vulnerability assessment across banking infrastructure — prioritised remediation programme delivered with patch tracking
✓ 70% reduction · 60 days · RBI compliance readiness achieved
View all case studies on blog.threatrix.ai →

Could your application have similar vulnerabilities?

Run a free scan first — see what ThreatRiX finds passively. No login, no install.

Run free scanBook full assessment