- Sector
- Payments
- Services
- Red team, Cloud security
- Duration
- Two weeks of operations, one week of debrief
A payments processor asked how far an attacker could get in two weeks.
An objective-based red team starting from the public internet reached customer transaction data through an exposed staging API and an over-permissioned cloud role.
Read the engagement