A few day ago, I was brought in to perform a penetration test for a company that had recently raised funding…
Sujal M. — Founder @ NullStrike Security | Manual Penetration Testing for SaaS, Healthcare & Fintech | Helping Founders Pass SOC 2 Type II, HIPAA & PCI DSS With Audit-Ready Reports
A few day ago, I was brought in to perform a penetration test for a company that had recently raised funding and was preparing for compliance requirements.
But within the first day, one problem became obvious:
Nobody fully understood their own infrastructure.
There was almost no usable documentation.
No one could clearly explain:
• which assets were internet-facing
• which IAM roles were still active
• what services were considered production-critical
• how trust relationships between systems actually worked
• which old resources were abandoned versus still in use
From a penetration tester’s perspective, that creates two problems:
First, it increases risk for the client.
If defenders do not understand their environment, attackers eventually will.
Second, it makes security validation significantly harder because every action requires verification to avoid disrupting production systems nobody has mapped properly.
As the assessment continued, the issues stacked up quickly:
• Over-permissioned IAM roles
• Publicly exposed internal services
• Weak segmentation between environments
• Old access keys still active
• Misconfigured S3 buckets
• Excessive trust relationships between workloads
• Sensitive data accessible from systems that should never have had access
The technical findings were serious.
But the bigger issue was operational maturity.
The company had grown faster than its internal security processes.
Engineering moved fast. Infrastructure scaled fast. New products shipped fast.
Documentation never caught up.
What made the engagement valuable was not just identifying vulnerabilities. It was helping there Lead Enginer understand the actual security state of their environment before entering compliance audits and enterprise sales conversations.
Because compliance does not create security.
Visibility, asset ownership, documentation, and disciplined infrastructure management do.
if you every think about secure you cloud system you can contact. depending on you company we may be good fit if not I can alwasy recommed you few company founder I knew which may take you in.
6 reactions · 4 comments
Comments
Mark C.: Sujal Meghwal this signals a complete lack of awareness and "blue team" efforts within the organisation. There is clearly no governance in place which is an immediate concern to both the business, and potential investors.
Mark C.: Sujal Meghwal this signals a complete lack of awareness and "blue team" efforts within the organisation. There is clearly no governance in place which is an immediate concern to both the business, and potential investors. I#d be happy to assist this company via https://phenomlab.com
Damian K.: a ja chętnie sam zrobię swoje testy jeśli dasz namiar :) (link do strony wystarczy)
Kenneth R.: Unfortunately, this is not uncommon. I have seen questions come up on during Audits and PCI compliance reporting that no one has an answer to and this happens at large corporations with "mature" teams. Alot of times it is not because the team has not made an effort to document and address vulnerabilities and set ownership of policies, procedures, access and etc. It is because they are met with que