Singapore
South East Asia
A security assessment of a Singapore-based HR SaaS platform handling sensitive payroll and employee data, with testing and remediation aligned to SOC 2 compliance requirements.
Singapore
South East Asia
1
Web Application
SOC 2
Compliance Requirement
3-Round
Retesting Process
The client needed more than a security assessment. They needed a team that could understand their application, communicate clearly, support remediation, and provide documentation suitable for their compliance requirements.
A hands-on assessment approach combined with AI-assisted testing to examine the application beyond surface-level scanning.
Qualysec's experience across digital platforms and complex technology environments gave the client confidence in the engagement.
The engagement was structured around the needs of a growing SaaS business without creating unnecessary pressure on the security budget.
The assessment documentation was prepared with the client's SOC 2 requirements in mind, making the security review easier to use during the compliance process.
The client had already received positive feedback about Qualysec through someone in their professional network, which gave them additional confidence before starting the engagement.
Peer-verified
Trusted worldwide
Vertical privilege escalation requires the attacker to grant himself higher privileges. This is typically achieved by performing kernel-level operations that allow the attacker to run unauthorized code.
Potential impact: Unauthorized access to higher privileges and kernel-level code execution.
A severe vulnerability where an attacker injects malicious scripts (payloads) that are permanently stored on the target server (e.g., in databases, comment fields) .
Potential impact: Persistent malicious script execution via stored server-side data.
PDF documents could be injected with malicious scripts that would run in the systems of other users accessing the PDF.
Potential impact: Malicious script execution in users' systems via injected PDFs.
This occurs when an application exposes a reference to an internal implementation object (database ID, filename) and fails to verify that the user is authorized to access it.
Potential impact: Unauthorized access to internal implementation objects without proper checks.
This is a web security vulnerability that tricks a logged-in user’s browser into performing unwanted actions on a different website without their consent.
Potential impact: Unwanted actions performed by trusted users without their consent.
For a SaaS platform handling payroll records, employee information, and financial details, weaknesses in application controls could expose sensitive client information and create problems during the SOC 2 compliance process.
The engagement focused on more than documenting technical observations. Qualysec worked alongside the client's development team to understand the underlying issues, provide practical remediation guidance, and verify the changes through multiple testing rounds.
The assessment team examined the underlying application behaviour and provided context around the areas requiring attention.
The development team received clear remediation guidance that could be applied directly within the SaaS application.
Security documentation was prepared to support the client's SOC 2 compliance requirements and provide useful evidence for the audit process.
The application went through three retesting rounds to verify that remediation work was properly completed and remained effective.
3-Round Retesting
Multiple verification cycles were completed to validate remediation work.
SOC 2 Compliance
The security assessment supported the client's SOC 2 compliance journey.
Audit-Ready Documentation
Security findings and supporting information were structured for compliance use.
Verified Remediation
The development team received practical guidance followed by validation of the completed changes.
If you need a penetration test, let’s have a talk. Fill out this form and we will ensure you are secured and hit full compliance without any hurdles. The immediate impact you can expect:
Our sales team will reach out instantly
We skip the back-and-forth to meet your deadline perfectly
We get your testing scheduled immediately without any delay
Total No. Of Vulnerabilities
Years in Business
Assessment Completed
Trusted Clients
Countries Served