A pentested security platform used by security teams asked Perfai Security to validate its access controls. In under two days, with no source code, our agents proved more than 60 Critical and High authorization flaws that years of pentests had missed.
A security vendor held to a higher standard
Security platforms are judged more harshly than the applications they protect. A vendor whose own access controls can be bypassed undermines the trust its customers place in it, and authorization defects are notoriously hard to find at scale. They do not show up as crashes or obvious errors. They surface only when you test every role against every function across the entire app surface — a combinatorial problem that is impractical to cover exhaustively within a fixed pentest budget.
This platform had matured over many years into a large, multi-tenant system with hundreds of testable functions across its UI and API, and several distinct user roles. Periodic pentests and internal QA helped keep the product stable, but they sampled the attack surface rather than exhausting it. Broken Function Level Authorization, where a restricted role can invoke privileged operations, was exactly the kind of defect that point-in-time testing tends to miss.
The team wanted a definitive answer to a simple question: can a low-privilege user do things they are not authorized to do?
Learn the app, then test every role against every function
Perfai deployed its autonomous agents against the platform with nothing more than test credentials — no code, no SDK, no instrumentation. The agents mapped the app the way an attacker would, then executed the full authorization matrix, proving each violation before reporting it.
Less than 48 hours from credentials to a proven, exploit-backed findings list
One read-only role, privileged access everywhere
Most Critical and High findings traced back to a systemic root cause: Broken Function Level Authorization (OWASP API5:2023). A limited, read-only role could invoke functions reserved for higher-privilege accounts across a wide swath of the API.
In total, more than 60 Critical and High severity issues were confirmed, alongside additional lower-severity findings. Because each issue was proven rather than merely flagged, the engineering team received a clean, exploit-backed list with far less false-positive triage.
API keys reachable from read-only
Critical / HighA restricted, read-only role could view stored API keys — turning a low-privilege session into full-organization access.
Approve & poison shared data
Critical / HighA read-only role could approve records and create shared data — quietly corrupting the very data customers depend on.
Restricted data, cross-org exposure
Critical / HighRestricted data access accepted requests from roles that should never see another organization's records or case records.
Submit privileged backend jobs
Critical / HighRestricted roles could submit jobs to the backend analysis service and trigger privileged backend processing reserved for admins.
Audit functions reachable
Admin-only audit functions answered for non-admin roles — the same logs meant to catch abuse were readable by the roles that could abuse them.
Case records across entity types
Case record functions had no role check across record types, so a restricted role could enumerate cases meant for senior users.
Not abstract risk for a security vendor
Exposed API keys meant a low-privilege user could escalate to act as the organization. The ability to approve records and create shared data from a restricted role meant the data customers depend on could be quietly corrupted. And for a security company, a finding that the platform fails its own authorization checks is material in every customer security review and audit it faces.
Dollar figures are estimates, not measured outcomes.
Sampling can't match exhaustive coverage
For years, conventional approaches kept the platform stable without surfacing this class of flaw. Pentests run on a fixed schedule and sample a subset of the surface. Manual QA validates intended behavior, not the full space of what each role can abuse. Neither approach is practically scoped to test every role against every function, with multiple request variants each, within a fixed engagement — which is precisely where BFLA hides.
What years of scheduled testing had not surfaced, Perfai found, proved, and handed over in under two days.
Server-side authZ, key rotation, continuous re-testing
The platform team moved to enforce server-side authorization on every function, rotate the affected keys, and adopt continuous, autonomous re-testing of the full role-by-function matrix so that new routes cannot silently regress.
When your product is trusted to enforce other people's controls, authorization across your own product is the most expensive thing to get wrong — and the half that sampling-based testing was never built to cover.
Find what your last pentest missed.
Autonomous agents that learn your app, prove the exploit, and ship the fix. No source code required.
Book a Perfai test →