Penetration Test · 2025
Domain admin in a day, then closed for good
Northgate Payments
17
Critical findings
<1 day
Time to domain admin
Clean
Retest result
Overview
An external and internal penetration test of a payments platform that turned a clean scanner report into a hard lesson — and then a fixed one.
The challenge
The client had passed automated scans for years and believed they were secure. Their auditors, and their largest customer, wanted proof from a real adversary rather than a tool.
Our approach
Our red team chained a forgotten subdomain, a reused credential, and a misconfigured share into full domain admin within a day, then sat with the client's engineers to remediate every link in the chain.
The outcome
Seventeen high and critical issues were closed and verified in a clean retest four weeks later. The customer signed, and the platform has held through two audits since.
Keep looking
More engagements
Concerned about something similar?
Every engagement starts with a look at your environment. Let's have that conversation.