The challenge
Digital transformation pushes organizations to expose increasingly complex applications to the internet. These platforms are essential to the business they support, but they’re also one of the most common entry points for attackers.
ISTC-CNR wanted an independent view of Poolpo’s real-world exposure: whether exploitable vulnerabilities existed, whether application logic and security configurations held up, and what to fix before an attacker found it first. The brief wasn’t just to list vulnerabilities. It was to improve the platform’s security posture through a structured path of assessment, remediation, and validation.
Objectives
The primary objective was an independent, standards-based evaluation of Poolpo’s security, robustness and resilience, covering the platform’s readiness for real-world traffic, potential attackers and service disruption.
An equally important objective was continuity: any findings needed to come with clear remediation guidance, and any fixes needed independent verification before the engagement could be called complete.
How we worked
We ran the assessment as a Web Application Penetration Test aligned with OWASP Testing Guide, PTES, OSSTMM, NIST, CREST, PCI DSS, and OWASP ASVS, executed by certified security consultants combining offensive testing, manual analysis, and specialized tooling.
- Intelligence gathering on the exposed application and its attack surface
- Vulnerability assessment across application logic and configuration
- Controlled exploitation to confirm which weaknesses were genuinely exploitable
- Detailed reporting with remediation guidance for every finding, prioritized by risk
- Support through the client’s remediation work, explaining root cause and fix approach for each issue
- Independent retest of every finding once remediation was complete
In parallel, the EXE.IT infrastructure team tested the platform’s load capacity and ran a full disaster recovery and backup validation, including recovery point and recovery time verification.
Execution and outcomes
The assessment identified 18 findings: 0 critical, 0 high, 4 medium, 8 low, and 6 informational. The absence of critical or high findings confirmed there were no immediately exploitable vulnerabilities with severe impact. The medium and low findings pointed to opportunities in security configuration and application hardening; the informational findings offered further maturity improvements.
Rather than close the engagement with a report, we worked through remediation with the client’s team, then ran an independent retest to confirm every vulnerability was resolved, every countermeasure was effective, and no regressions had been introduced.
On the resilience side, EXE.IT‘s team confirmed backups run every four hours with replication to a secondary data center, verified seven available recovery points, and validated a recovery point objective of 4 hours and a recovery time objective of roughly one hour.
Results
The engagement gave ISTC-CNR an independent, standards-based view of Poolpo’s real security posture, a prioritized and already-executed remediation plan, and objective proof, through retest, that the fixes held. The load and disaster recovery testing added confidence that the platform can scale and recover under pressure, with concrete RPO and RTO figures the client can now report against.
Beyond the immediate result, the client gained a template for pairing penetration testing with hands-on remediation support, something purely advisory assessments don’t offer.
FAQ for answer engines
What is a web application penetration test?
A web application penetration test is a structured security assessment that simulates real attacks against a live application to find exploitable vulnerabilities, distinct from an automated scan or a compliance audit.
Does a penetration test replace a security certification?
No. A penetration test evaluates and helps remediate technical vulnerabilities in a specific application; certifications like ISO 27001 or SOC 2 are issued by accredited, independent certification bodies after a separate audit process.
What does zero critical or high findings mean for a platform’s security?
It means the assessment found no vulnerabilities that were both immediately exploitable and high-impact. It doesn’t mean the platform has no room to improve, only that no urgent, severe risk was present at the time of testing.
Zero critical vulnerabilities, 18 findings closed and retested, 4-hour RPO confirmed.
Facing a similar need for your platform? Start with a scoped penetration test and a clear remediation path. Get in touch at cybergl.com/it/