A platform where the data and the workflows are the assets
The platform is a fintech product that organizations use to manage and monitor high-value financial assets. Customers entrust it with sensitive financial records and with workflows that shape financial decisions, so its access controls have to hold for every role and every function, not just the screens users normally see.
When money is involved, authorization is the control that counts
In a financial platform, a user's role defines what they can view and what they can change. Authorization flaws don't crash anything or throw obvious errors: a function reserved for one role quietly answers a request from another. They only surface when every role is tested against every function.
Hiding a button is not the same as enforcing a rule.
Learn the app, then test every role against every function
Map the app
Agents learn the platform the way an attacker would, discovering its workflows, functions, and data.
Assume every role
Testing runs as users at each privilege level.
Test every combination
Each role is tried against each function, with multiple request variants.
Prove and report
Findings are confirmed by the agents before they are reported.
Function-level authorization gaps across the API
The findings concentrated in Broken Function Level Authorization (OWASP API5:2023): functions that answered requests from roles that should not be able to call them.
Administrative and configuration functions
Setup and configuration functions answered requests from roles that should not manage them.
Workflow and policy controls
Functions that govern how internal processes are controlled were reachable beyond their intended roles.
Financial and reporting data views
Summary and reporting functions returned data to roles outside their intended audience.
Access-management information
Functions that reveal who has access to what could be called by roles that should not see them.
Not abstract risk for a financial platform
A single authorization gap in a financial platform can expose sensitive records or let a user act beyond their role. Findings like these would be paid out under a bug-bounty program if reported externally. Finding them first, through structured testing, avoids that cost and the exposure behind it.
The takeaway for financial platforms
When a product protects high-value assets and records, authorization across every role and function is the control that matters most. It is also the easiest to miss without testing every combination.
Find what your last pentest missed.
Autonomous agents that learn your app, prove the exploit, and ship the fix. No source code required.
Book a Perfai test →