Building Security Assurance Before Going Live

The Challenge

Mitigo Limited engaged Plainsight Security to conduct an independent penetration test of a web application being prepared for use with customer data.

By commissioning security testing before the application entered full production use, Mitigo took a proactive approach to security assurance, providing an opportunity for the application and its controls to be independently assessed before wider use.

The objective was to evaluate the application's security posture, test the effectiveness of its existing controls and provide Mitigo with independent assurance ahead of deployment.

Our Approach

Plainsight Security conducted an authorised web application penetration test covering the application's exposed functionality and security controls.

The assessment combined automated techniques with extensive manual testing, examining areas including:

• Authentication and session handling
• Access controls
• Input validation
• Application functionality
• Information disclosure
• Security configuration
• Integration with external services
• Common web application attack techniques

Testing also examined the effectiveness of existing protective measures and investigated whether application functionality could be manipulated in unexpected ways.

Potential findings were manually investigated and validated to ensure the final report contained meaningful and actionable information rather than unverified automated scanner output.

Independent Security Assurance

The assessment provided Mitigo with an independent view of the security of the application and highlighted opportunities to further strengthen its security before production use.

Where areas for improvement were identified, Plainsight Security provided clear supporting evidence, an explanation of their significance and practical remediation guidance.

This allowed Mitigo's team to quickly understand the findings and make appropriate improvements as part of the application's development process.

The Outcome

The penetration test gave Mitigo additional assurance over the security of the application ahead of its use with customer data.

The combination of independent testing and clear reporting enabled the development team to efficiently address the findings and further strengthen the application before wider deployment.

Following the engagement, Mitigo awarded Plainsight Security 5/5 in every category, including:

• Professionalism and conduct
• Technical quality
• Communication throughout the engagement
• Timeliness of delivery
• Clarity and usefulness of reporting
• Overall satisfaction
• Likelihood of recommending our services

100% Client Satisfaction

5/5 Professionalism
5/5 Technical quality
5/5 Communication
5/5 Timeliness
5/5 Reporting
5/5 Overall satisfaction
5/5 Likelihood to recommend

What the Client Said

"Very happy with the test from Mark - excellent communication throughout and high quality output that has allowed us to swiftly remediate the findings."

Tristan Hodgson
Mitigo Limited

Security Testing as Part of the Development Process

Penetration testing does not need to wait until an application is already in production.

Testing before launch provides an opportunity to independently validate security controls and identify opportunities for improvement while changes can still be incorporated into the development process.

Mitigo's approach demonstrates the value of making independent security testing part of application delivery rather than waiting for a security concern to arise.

For the Mitigo Toolbox, the assessment provided additional assurance ahead of production use while giving the development team clear, practical information that could be acted upon quickly.

Preparing to Launch a Web Application?

Plainsight Security provides independent web application penetration testing to help organisations validate security controls and gain greater confidence in their applications before deployment.

Our assessments combine automated techniques with experienced manual investigation and clear, actionable reporting.

If you're preparing to launch a new web application or significant new functionality, contact Plainsight Security to discuss independent security testing.