Anonymised engagement portfolio
Anonymised offensive security patterns from real engagement shapes, without client names. Filter by service and industry. Every card links to a full write-up.
How to read this portfolio
-
Problem classThe shape of the engagement
-
ApproachHow testing was run
-
FindingsThe kinds that typically matter
-
RetestHow remediation closed the loop
Each note describes a common engagement shape: the problem class, how we approached testing, the kinds of findings that typically matter, and how remediation and retest closed the loop. Names, logos and exact metrics are withheld on purpose. Pair with research when you want deeper technical vocabulary, or contact when you want a scoped proposal.
Filter patterns
SaaS tenant isolation review
Broken access control across workspaces in multi-tenant B2B SaaS — IDOR-style and workflow authorisation testing.
Fintech API authorisation assessment
Privilege boundaries on money-adjacent and PII-bearing APIs across customer, partner and support roles.
External perimeter hardening
Internet-facing inventory gaps, risky exposures and email-auth posture before a deeper application test.
Cloud identity attack-path review
Identity → role chain → data path in cloud-native SaaS: workload identities, over-privileged roles and reachable data stores.
Internal AD lateral-movement pattern
Meaningful Active Directory and identity findings versus scan noise — trust edges, delegation and privilege paths that matter to defenders.
Red team assumed-breach engagement
Multi-surface objectives from an assumed-breach start — detection gaps and a board narrative without dumping TTPs.
Electron desktop trust-boundary review
Preload/IPC trust-boundary classes in Electron products — local privilege and bridge abuse patterns, linked to our research series.
Architecture security assessment
Design-time review for HealthTech or multi-tenant SaaS — trust boundaries, data flows and control gaps before build debt hardens.
How these patterns are written
Each pattern is anonymised and describes the scope, the finding classes, the approach and what the retest confirmed. Client names stay confidential.
Related buyer resources
Need a scope-based engagement?
Share your application, infrastructure or security requirement and PoCForge will help define the right assessment — human-led proof, then retest.
