Penetration testing case studies you can check
Nine real engagements, anonymized to protect our clients: where testers started, what they reached, what was fixed and what the retest covered.
One engagement in full: the route that skipped SSO and MFA
Testers started with no accounts, only agreed domains and address ranges.
Access gatewaySSO and MFA held on the official address.
Another public route to the serverRequests skipped the gateway; the application assumed authentication upstream.
Support application
Proof, then stopOne test record retrieved, one agreed status change.
This first fix failed the retest. It was one of two in these nine.
After an infrastructure migration, a B2B service provider commissioned a black box external test to verify that its support application could only be reached through the access gateway. The complete fix made the origin accept traffic only from the approved intermediary, and the application reject requests without a verified identity.
5 tester-days, plus 1 for retesting. Read the external case study
- First fixRestricted the main interface.
- RetestAn auxiliary port left from the migration still exposed the same application.
- Complete fixAll interfaces, within four business days.
- Final retestDirect addresses, auxiliary ports, alternative hostnames and the SSO workflow.
Which engagement looks like yours?
Patched within 48 hours, retested
Fintech API penetration test
European neobank and payment processor, grey box
One customer could read another’s transaction history, and simultaneous requests withdrew funds twice.
Retested after the complete fix
Business logic penetration test
B2B procurement platform, grey box
An ordinary employee could raise an order’s value after approval, without invalidating the approval.
Retest confirmed every fix
Black box test before Black Friday
Multi-national e-commerce retailer
Perimeter breached within 4 days: SQL injection on a forgotten landing page exposed the customer database.
Retest confirmed all three fixes
GDPR and HIPAA web application test
Telemedicine SaaS for hospitals, white box
A doctor at one hospital could open another hospital’s patient records.
Retested after six business days
Partner API test (SSRF)
Logistics platform, grey box
A webhook worker followed a redirect to an agreed internal test endpoint without revalidating the destination.
Retest: path closed, one exception
AWS penetration test
SaaS provider, serverless application, white box
A deployment role with no direct access to secrets could update a function whose role could read unrelated secrets.
Final retest: assessed routes closed
External penetration test
B2B service provider, black box
The login worked, but it was not a mandatory route into the application.
Retest two weeks later: path closed
Active Directory penetration test
Industrial distributor, grey box
A standard domain account authenticated as a prepared admin account, shown only in an isolated copy.
Retest: no retrieval outside the flow
Android application penetration test
Field-service company, white box
A test app on the same device could read a service report the technician had not selected.
More penetration testing resources: a sample report, pricing and buyer guides.
Last updated: November 2026
How can you check an anonymized case study?
“Pentestica found logic bugs our automated scans had never flagged. Their manual approach saved us from a potential PR disaster.”
Questions about these case studies
Are these real engagements or illustrative examples?
Real engagements, with client names removed. Not illustrative scenarios.
What do these nine engagements show?
All nine were retested after the fixes. Four were grey box, three white box and two black box. Seven state tester-days: 5 to 10, in six of them plus 1 to 2 for retesting. Seven state where the test stopped. These counts describe these nine, not a market benchmark.
What happens when the first fix fails?
When that happened in these engagements, the client fixed the finding again and a further retest followed. On the procurement platform, the first fix missed line-item import, so the finding was marked partially remediated; the final fix added shared version checks across all modification paths.
A retest is available after fixes; whether it is in the price depends on the engagement. Section 8 of the 25-page sample report shows how each finding’s retest status is recorded.
What should a penetration testing case study include?
A useful case study states the scope and access the testers had, what they reached, where the test stopped, what the client fixed and what the retest confirmed. The more of those fields a record states, the easier it is to tell a tested result from a marketing story.
Which services are behind these engagements?
Web application, API, mobile, cloud, external, internal, network and compliance testing. See all services.
For typical tester-days by test type and the fixed price for an agreed scope, see penetration testing pricing.
Get a fixed-price quote for your pentest
Tell us what to test. You get a written scope, the number of tester-days and a fixed price before any testing starts. No hidden fees. Most tests take 1–3 weeks plus a few days for the report.
Web app or API: $2,500–$5,500 · Infrastructure or cloud: $5,000–$12,000+ · Red teaming: from $15,000. All prices