Pre-Peak Penetration Testing for a National Retailer
Two critical payment-page exposures found and fixed six weeks before holiday trading.
Client name withheld by agreement- Client
- National retailer, 900+ stores
- Region
- United States
- Year
- 2025
- Duration
- 8 weeks
- Scope
- Web, mobile, POS and cloud
- Practice
- Offensive Security & Resilience
The challenge
What was at stake.
A national retailer with more than nine hundred stores was about to enter holiday trading with a rebuilt e-commerce checkout, a new mobile app and a cloud migration only half finished.
A breach at peak would cost more than revenue. The security team wanted adversarial proof, not a scanner report, and they needed it in weeks.
What we did
The approach, step by step.
- 01
Threat-led scoping
We prioritized the paths an attacker would take to card data and customer accounts across web, mobile, store POS and cloud.
- 02
Manual testing, start to finish
Experienced testers chained low-severity issues into real attack paths, including payment-page script injection and API authorization flaws.
- 03
Fix while we test
Critical findings were reported the same day with reproduction steps and remediation advice, and retested as soon as fixes landed.
- 04
Board-ready story
An executive summary that explained business impact plainly, alongside the technical detail engineers needed.
Outcomes
What changed, in numbers.
- 2
- critical payment-page exposures closed
- 6
- weeks of margin before peak trading
- 4
- attack surfaces tested: web, mobile, POS, cloud
- 100%
- of critical findings retested and verified
They found what mattered, told us the same day, and stayed until it was fixed.
Services delivered
Related engagements
More work in Offensive Security & Resilience.
-
Gulf Coast, U.S. · 20 weeks
Offensive Security & Resilience · 2024OT-Safe Ransomware Resilience for an Energy UtilityRecovery time for core systems proven at under 18 hours, without touching live operations.
-
Dallas, Texas · 24 weeks
Offensive Security & Resilience · 2025 · OngoingOne Evidence Model for a Fintech LenderFour frameworks mapped to one control set, with audit evidence requests down by two thirds.
-
United States · 10 weeks
Offensive Security & Resilience · 2024Business Continuity and Crisis Exercise for an InsurerA board-level crisis exercise that exposed and closed four single points of failure.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.