A mature enterprise security platform, trusted by SOC teams worldwide, asked Perfai Security to validate its access controls. In under two days, with no source code, our agents proved more than 60 Critical and High authorization flaws that a decade of pentests had missed.
A security vendor held to a higher standard
Security platforms are judged more harshly than the applications they protect. A vendor whose own access controls can be bypassed undermines the trust its customers place in it, and authorization defects are notoriously hard to find at scale. They do not show up as crashes or obvious errors. They surface only when you test every role against every function across the entire app surface — a combinatorial problem that grows faster than any manual team can keep up with.
This platform had matured over 13 years into a large, multi-tenant system with hundreds of testable functions across its UI and API, and several distinct user roles. Periodic pentests and internal QA kept the product stable, but they sampled the attack surface rather than exhausting it. Broken Function Level Authorization, where a restricted role can invoke privileged operations, was exactly the kind of defect that point-in-time testing tends to miss.
The team wanted a definitive answer to a simple question: can a low-privilege user do things they are not authorized to do?
Learn the app, then test every role against every function
Perfai deployed its autonomous agents against the platform with nothing more than test credentials — no code, no SDK, no instrumentation. The agents mapped the app the way an attacker would, then executed the full authorization matrix, proving each violation before reporting it.
Less than 48 hours from credentials to a proven, exploit-backed findings list
One read-only role, privileged access everywhere
Every Critical and High finding traced back to a single, systemic root cause: Broken Function Level Authorization (OWASP API5:2023). A limited, read-only role could invoke functions reserved for higher-privilege accounts across a wide swath of the API.
In total, more than 60 Critical and High severity issues were confirmed, alongside additional lower-severity findings. Because each issue was proven rather than merely flagged, the engineering team received a clean, exploit-backed list with no false-positive triage overhead.
API keys reachable from read-only
Critical / HighA restricted, read-only role could view stored API keys — turning a low-privilege session into full-organization access.
Approve & poison community intel
Critical / HighA low-tier role could approve observables and create community intelligence — quietly corrupting the very data customers depend on.
Restricted data, cross-org exposure
Critical / HighRestricted data access accepted requests from roles that should never see another organization's records or investigations.
Submit to sandbox & privileged jobs
Critical / HighRestricted roles could submit jobs to the analysis sandbox and trigger privileged backend processing reserved for admins.
Audit functions reachable
Admin-only audit functions answered for non-admin roles — the same telemetry meant to catch abuse was readable by the roles that could abuse it.
Investigations across entity types
Investigation functions had no role check across entity types, so a restricted role could enumerate cases meant for senior analysts.
Not abstract risk for a threat-intel vendor
Exposed API keys meant a low-privilege user could escalate to act as the organization. The ability to approve observables and create community intelligence from a restricted role meant the data customers depend on could be quietly corrupted. And for a security company, a finding that the platform fails its own authorization checks is material in every customer security review and audit it faces.
Sampling can't beat combinatorics
For 13 years, conventional approaches kept the platform stable without surfacing this class of flaw. Pentests run on a fixed schedule and sample a subset of the surface. Manual QA validates intended behavior, not the full space of what each role can abuse. Neither approach can practically test every role against every function across 278 functions — which is precisely where BFLA hides.
What a decade of scheduled testing had not surfaced, Perfai found, proved, and handed over in under two days.
Server-side authZ, key rotation, continuous re-testing
The platform team moved immediately to enforce server-side authorization on every function, rotate the exposed keys, and adopt continuous, autonomous re-testing of the full role-by-function matrix so that new routes cannot silently regress.
When your product is trusted to enforce other people's controls, authorization across your own product is the most expensive thing to get wrong — and the half that sampling-based testing was never built to cover.
Find what your last pentest missed.
Autonomous agents that learn your app, prove the exploit, and ship the fix. No source code required.
Book a Perfai test →