Methodemeter
Security assurance for an education platform before product launch
Education I Netherlands I Security assessment I 6 weeks engagement (Dec 2024 – Jan 2025)
The Clients
- Industry:
- Education
- Location:
- Netherlands
- Delivery model:
- Project-based
- Duration:
- 6 weeks (Dec 2024 – Jan 2025)
- Support areas:
-
Identify vulnerabilities + strengthen security + and ensure EU compliance. - Platform context:
-
The platform for efficient method selection in primary education.
The challenge
Methodemeter was preparing to launch a new education platform and needed to ensure the platform was secure, compliant, and trustworthy.
• Launching a new education platform securely
• Protecting sensitive educational data
• Addressing evolving cyber threats
• Limited internal security resources
• Maintaining customer trust
Dealing with a similar setup? Let’s discuss your requirements.
What the client needed
Methodemeter needed security assurance before launching a new digital platform handling sensitive educational data.
A secure platform launch
Identify security weaknesses before release and reduce the risk of vulnerabilities reaching production.
Protection for sensitive user data
Strengthen safeguards around personal and learning information handled by the platform.
Resilience against evolving threats
Assess whether the platform could withstand relevant attack vectors and changing security risks.
Expert security guidance
Add specialist security expertise to help the internal team understand findings and prioritize improvements.
What Sunbytes Delivered
Sunbytes conducted a focused penetration testing engagement to identify security gaps, support remediation, and prepare the platform for launch.
Black-box penetration testing
Assessed the externally exposed platform from an attacker’s perspective without relying on internal implementation details.Vulnerability identification & analysis
Used offensive testing techniques to uncover security gaps and assess their potential impact.Developer remediation guidance
Explained identified vulnerabilities and provided practical guidance on how they could be addressed.Security reporting & compliance alignment
Delivered structured findings and actionable remediation priorities, with testing aligned to relevant security and compliance requirements.
Want to see if the fit is right for your team?
Why teams choose Sunbytes
A Netherlands-led partner that connects security evidence, delivery capability, and operational follow-through
ISO 27001-certified ISMS
Sunbytes operates an ISO 27001-certified ISMS, so information handling and access control have documented governance behind them.
Evidence-first security work
Security recommendations are mapped to evidence, ownership, and next actions so buyers and auditors can review what changed.
Dutch-led communication
European stakeholders get direct scope alignment, clear escalation paths, and accountable follow-up from a Dutch-led team.
Delivery-aware remediation
Security findings can be translated into software, infrastructure, and process changes through Sunbytes delivery capability.
Continuous security route
Baseline, readiness, specialist services, and CyberCare can connect without restarting context at every new request.
One operating partner
Secure work can align with delivery teams and people operations when access, onboarding, or governance affects the control environment.
What the team covered
Security assessment
Black-box penetration testingVulnerability identification
Discovering security gaps using offensive techniquesDeveloper guidance
Explaining vulnerabilities and how to fix themReporting
Clear documentation and actionable remediation listsCompliance alignment
Testing in line with GDPR, NIS2, ISO 27001, and MIAUW standards
Outcomes
The collaboration resulted in:
-
Platform launched
Platform launched without major vulnerabilities.
-
Secure practices
Improved understanding of secure development practices.
-
Clear alignment
Better alignment between decision-makers and
the technical team -
Short cycle
Completion of the full penetration test and remediation cycle in approximately six weeks
In their words
“I knew cybersecurity mattered, but until we used Sunbytes’ pentest to prepare our new product for launch, I had no idea it was this critical. Their thorough approach uncovered risks we’d never even considered and opened my eyes to just how important it is to secure our platform from day one.”
Selina
Director, Methodemeter
See also
- Dedicated Resources
IT staff augmentation from Vietnam: what European companies need to know
Vietnam is a delivery-fit decision before it is a rate decision. For European companies, IT staff augmentation from Vietnam works when internal product ownership is strong, senior external engineers can enter an existing delivery system, and the working day creates enough shared time for decisions. The location is a poor fit when the buyer expects […]
- Dedicated Resources
IT staff augmentation security: ISO 27001, GDPR and vendor due diligence
An NDA covers confidentiality. It does not decide who can enter production, whether a developer may download customer data, or how quickly access disappears when an engagement ends. Those controls must exist before the first sprint. IT staff augmentation security is the set of contractual, technical and operating controls that govern how external developers access […]
- Dedicated Resources
Building a security-first engineering culture in distributed teams
A security-first engineering culture is an operating model in which developers can see who owns a security decision, when a review is required and where the result must be recorded. It is not a slogan, a yearly course or a request for every engineer to become a security specialist. That distinction matters across locations. A […]
- Dedicated Resources
How many DevSecOps engineers does a mid-size SaaS need?
The useful DevSecOps team size question is not “How many security engineers should we hire?” It is “Which security responsibilities need continuous ownership, and how much capacity does that work require?” Two SaaS companies with 100 employees can need very different setups. One may run a single product on one cloud platform. The other may […]
- Dedicated Resources
In-house vs outsourced DevSecOps: cost, risk and speed comparison
The wrong DevSecOps operating model creates work in the place it was meant to remove. An internal hire can become a single point of dependency. An external team can generate findings without giving developers a clear remediation path. This in-house vs outsourced DevSecOps comparison focuses on the decision that matters: which model gives your company […]
- Dedicated Resources
IT Staff Augmentation Contract: What to Include and Watch Out For
An IT staff augmentation contract is not just a capacity order. It is the document that decides who controls delivery once an external developer has access to your codebase, your customer data, and your sprint board. Most disputes in staff augmentation engagements trace back to one of five gaps: vague scope, unclear IP assignment, missing […]
Download the full case study!
Get the complete story—challenge, delivery setup, scope, outcomes, and the full testimonial.
