A first penetration test that changed how Kuratech build
Client story
Kuratech had never had a security assessment. A one-week engagement produced a substantial architectural change and something they now bring to customer due diligence.
Going first is the hard part
Kuratech is a platform for liquidators. Their users manage bankruptcy estates, uncover hidden assets and maximise recoveries. Creditors, debtors and the estate all have competing claims on the same money, and the platform holds the records they are arguing over. Kuratech had never had a penetration test.
That isn't unusual. Small product teams know security matters and still push the assessment to next quarter, because no customer has demanded it yet and nobody is sure what a test would involve.
What broke the deadlock was an advert. Sesar Hersisson saw the Cyber Journey Program on social media and applied. Kuratech was one of two companies selected.
What came out of it
Some findings were small and Kuratech resolved them directly. One mattered more. It led the team to add an additional access check at the database layer, a second line of enforcement beneath the application's own controls. That was a substantial piece of engineering rather than a quick fix.
The check sits below the application, so it applies to every query rather than only the paths the test happened to reach.
“For teams that haven't released or worked on bigger projects independently, trying to figure out all the security holes or problems can be overwhelming. Getting the assessment and knowing what required our attention was great.”
The report is now part of their sales pitch
Kuratech's customers are liquidators and legal professionals handling other people's money, and they ask hard security questions before adopting anything. Kuratech now brings the assessment up during that due diligence: an independent test is a clearer answer than a description of their own practices.
Thinking about a first assessment?
Most teams we work with have been putting it off. Talk to a senior consultant about what an application penetration test would involve for your product.