The record
Clients are never named and never identifiable. We publish the sector, the question and the outcome.
Failure point foundFintech
Saudi Arabia
262KRPS
Peak load reached
A mobile banking API, tested to the point it broke.
What they asked
A regulated investment platform wanted to know how much load their customer-facing API could take before customers noticed, and exactly where it would fail.
What we found
It broke earlier than expected. Under sustained load the service stopped answering, and the outage was visible worldwide. Customers could not sign in or open an account while it lasted. Every part of that was captured under an authorised, scheduled test rather than discovered during a real attack.
What happened next
We delivered a prioritised remediation roadmap, ordered by risk reduced against effort required, and booked a retest to confirm the fixes hold.
Fixed and re-verifiedTechnology platform
Saudi Arabia
5.89MRPS
Peak load absorbed
A critical weakness found and closed inside one engagement.
What they asked
A production platform sat behind a well-known protection layer that was switched on. They wanted confirmation that it would hold under pressure.
What we found
At first it did not. One class of traffic slipped past the defences that were supposed to stop it and took the service down. Their team was notified immediately and applied a fix while the engagement was still running.
What happened next
We retested the same weakness at higher volume and for longer, and it held. The finding closed as remediated only once the retest had shown the fix working.
Held at every levelNetwork operator
Own ASN
644Gbps
Peak traffic absorbed
Network-wide testing that came back clean.
What they asked
A network operator needed independent confirmation that their protection held across their whole address space, for every service on it. That is the kind of evidence a regulator expects on file.
What we found
It held at every level tested, from raw network floods through to attacks aimed at the applications themselves. All of it was absorbed and filtered with no downtime.
What happened next
The clean pass is documented for compliance review, and testing continues on a semi-annual cadence.
Reports stay confidential to the client. Nothing that could identify an engagement, whether names, addresses, infrastructure detail or the techniques used, is published here or anywhere else.
