A well-defended core, serious exposures in the estate around it

A philanthropic organization's internet-facing estate: a public website behind a cloud edge service, a staging environment, a federated single-sign-on identity layer, and perimeter network appliances.

Anonymized. No client names, people, domains, addresses or locations are published.

The public website was reasonably well defended. The real question was what sat around it: the staging environment, the identity layer, and the network perimeter, where an external attacker with no credentials has room to operate.

Authorized external red team, OSINT-led, delivered as a leadership-level findings report.

• HighThe website's administrator control panel was reachable from the open internet through an inconsistency in the edge protection, on an end-of-life platform with no login lockout or rate-limiting.
• HighA public staging server exposed an unauthenticated search database holding a full copy of the site index (tens of thousands of records), readable and write-capable with no credential.
• HighThe federated identity layer retained a legacy authentication endpoint outside account-lockout and throttling.
• HighTwo perimeter appliances answered DNS for the whole internet and amplified responses to roughly 22 times the request size.

Midway through the assessment the organization tightened the control on the administrator path. The engagement then identified a second route that reached the same administrator login despite the new rule, and reported it. Remaining fixes were supplied in order.