Evidence from the field
Penetration testing.
Case studies.
Anonymized engagement outcomes showing how human direction, AI-assisted breadth, and evidence-driven validation work together.
These case studies focus on what buyers need to know: the challenge, the depth of testing, what was proven, where human judgment mattered, and how the work stayed within safe boundaries. Client identities and identifying details are removed.
Application, API, and mobile assessments
Cloud Platform Web & API
A multi-tenant healthcare platform where more than 800 API operations were tested for authorization, including the large portion its own web interface never calls.
Whole-Catalogue API Assessment
A banking API assessment that found 18 confirmed object-authorization failures, including exposed services missing from the client’s original remediation inventory.
Consumer Mobile App (iOS)
An iOS application and backend assessment with 14 actionable findings and a documented negative-testing record showing what was tested and ruled out.
Mobile Banking App (Android)
A source-informed assessment that mapped more than 600 backend operations, verified customer-data isolation, and proved the weaknesses that did exist.
Network and identity compromise
Domain Compromise: Critical Infrastructure
Starting without credentials, the assessment established full directory control, identified three independent paths, and demonstrated impact across seven categories of critical systems without disrupting operations.
Four-Minute Domain Compromise
A public-sector environment where a relayed authentication led to domain control in about four minutes, followed by safe validation of access to five business-critical systems.
About Vergil. These engagements were delivered with Vergil, our governed AI penetration-testing operator. A senior consultant sets the objective, authorizes consequential actions, validates the evidence, assigns severity, and stands behind the final conclusions.
The anonymized PDFs are available after a quick, self-hosted check that deters basic automated scraping. It requires no email, account, or third-party CAPTCHA.
Reveal the case studiesAnonymized by design. Client names and identifying details have been removed. Figures are preserved unless removal or rounding was needed to protect the client. The examples are intended to show testing depth, evidence quality, and decision-making without exposing confidential environments.
What could the same depth uncover in your environment?
Tell us what you need to validate and we’ll recommend the right engagement.