C2C Platform
Web, API and mobile penetration testing for IPO security readiness
Information technology I Japan I Penetration Testing I One-month engagement
The Clients
- Industry:
- Information technology
- Location:
- Japan
- Duration:
- 1 month
- Support areas:
-
Penetration testing and application security - Platform context:
-
A Tokyo-based technology company that develops and operates multiple online matching and marketplace platforms.
The challenge
C2C Platform needed to assess the security of one of its production-grade products as part of its preparation for an IPO security audit.
• Identify vulnerabilities across the web application and API
• Test both the iOS and Android mobile applications
• Rate findings clearly by severity
• Prioritize the issues requiring remediation
• Produce reporting suitable for the upcoming security audit
Dealing with a similar setup? Let’s discuss your requirements.
What the client needed
C2C Platform needed a penetration testing partner that could assess its product across multiple layers and turn the findings into clear remediation and audit-ready evidence.
Multi-layer testing
Assess security across web, API, iOS, and Android applications.
OWASP-aligned assessment
Evaluate relevant risks against OWASP Top 10 and API Top 10.
Clear prioritization
Rate findings by severity so the team knew what to address first.
Reproducible findings
Provide clear steps so developers could verify each identified issue.
Remediation guidance
Give practical recommendations the engineering team could act on directly.
IPO audit support
Structure findings and documentation to support IPO security audit preparation.
What Sunbytes Delivered
Sunbytes conducted a focused penetration testing engagement in a dedicated test environment, covering C2C Platform’s web, API, iOS, and Android applications.
Web application and API security testing
Tested the web application and API layer to identify exploitable weaknesses across key application flows and interfaces.iOS and Android application testing
Assessed both mobile applications for security issues across authentication, data handling, and application behavior.OWASP-aligned security assessment
Evaluated findings against relevant OWASP Top 10 and OWASP API Security Top 10 risk categories.Reproducible findings & evidence
Documented each identified vulnerability with clear severity ratings and reproduction steps for the engineering team.Prioritized remediation guidance
Provided practical recommendations and clear priorities to help developers address the identified findings efficiently.IPO audit reporting support
Adapted the reporting format and delivery coordination to support C2C Platform’s IPO security audit preparation.
Want to see if the fit is right for your team?
Why teams choose Sunbytes
A Netherlands-led partner that connects security evidence, delivery capability, and operational follow-through
ISO 27001-certified ISMS
Sunbytes operates an ISO 27001-certified ISMS, so information handling and access control have documented governance behind them.
Evidence-first security work
Security recommendations are mapped to evidence, ownership, and next actions so buyers and auditors can review what changed.
Dutch-led communication
European stakeholders get direct scope alignment, clear escalation paths, and accountable follow-up from a Dutch-led team.
Delivery-aware remediation
Security findings can be translated into software, infrastructure, and process changes through Sunbytes delivery capability.
Continuous security route
Baseline, readiness, specialist services, and CyberCare can connect without restarting context at every new request.
One operating partner
Secure work can align with delivery teams and people operations when access, onboarding, or governance affects the control environment.
What the team covered
The penetration testing engagement covered the full assessment cycle, from application testing and vulnerability validation to remediation guidance and audit support.
Web application & API security
Assessed the web and API layers for exploitable vulnerabilities across key application flows, interfaces, and exposed functionality.iOS & Android application security
Tested both mobile applications for security weaknesses affecting authentication, data handling, and application behavior.OWASP Top 10 and API Top 10 risk assessment
Mapped testing and identified risks against relevant OWASP Top 10 and OWASP API Security Top 10 categories.Vulnerability validation and severity classification
Validated each identified issue and assigned a severity rating to help the client understand impact and remediation priority.Reproduction instructions for identified findings
Documented clear reproduction steps so C2C’s engineering team could verify and investigate each vulnerability.Prioritized remediation guidance
Provided practical recommendations for each finding, helping the team address the most important security issues first.Audit-oriented reporting and clarification support
Structured the findings for IPO security audit preparation and supported the client with clarification of technical issues and reporting needs.
Outcomes
The engagement moved C2C Platform from vulnerability detection through remediation, with both project KPIs fully achieved.
-
Comprehensive findings documented
All vulnerabilities identified during the assessment were documented across the web, API, iOS, and Android layers with clear severity ratings.
-
All identified findings remediated
C2C Platform completed remediation of all identified findings using the report’s prioritized guidance and reproduction details.
-
IPO security audit preparation supported
The final report and follow-up clarification gave the team structured security evidence to support its IPO security audit preparation.
In their words
“They provided practical, prioritized remediation guidance that our team could act on immediately.”
Yoshiyuki Saigusa
CTO, C2C Platform Co., Ltd.
See also
- Cybersecurity
DevSecOps and NIS2: what Dutch companies must do before July 2026
DevSecOps NIS2 readiness means proving that your software development process has working security controls, not just written policies. Before July 2026, Dutch companies in scope for the Cyberbeveiligingswet need evidence for Article 21 controls such as secure development, supply chain security, access management and effectiveness testing. For engineering teams, the practical evidence usually comes from […]
- Cybersecurity
NIS2 penetration testing requirements: what Article 21(2) compliance looks like
NIS2 penetration testing is not a checkbox exercise. Article 21 does not name one single testing tool that every entity must use. It requires organisations to handle vulnerabilities and assess whether their cybersecurity risk-management measures work in practice. That distinction matters. A vulnerability scan can tell you that a known weakness exists. A DAST scan […]
- Cybersecurity
NIS2 implementation roadmap: a 12-week plan for EU SMEs
A NIS2 implementation roadmap should turn the directive into a sequence your management board, IT team, compliance lead, and suppliers can execute. For most EU SMEs, the work does not fail because Article 21 is unknown. It fails because scope, risk assessment, remediation, evidence, and board approval happen in the wrong order. This 12-week plan […]
- Cybersecurity
The NIS2 minimum viable evidence pack: what to prepare for Article 21 compliance
A NIS2 evidence pack is the documentation your organisation uses to prove that Article 21 cybersecurity risk-management measures are not only written down, but implemented. For EU SMEs, the problem is scattered evidence: one access review in a spreadsheet, one supplier check in procurement, one incident procedure in IT, and no single view that connects […]
- Cybersecurity
How to run a NIS2 gap analysis: the 5-step assessment framework
A NIS2 gap analysis turns regulatory pressure into a working plan. It shows which cybersecurity measures already exist, which ones are missing, which gaps create the highest risk, and what evidence the company needs to produce. For EU companies preparing for NIS2, the goal is not to create another policy document. The goal is to […]
- Cybersecurity
NIS2 Article 20: management accountability obligations for company leadership
NIS2 management accountability is no longer a topic only for the CISO or security team. Under Article 20 of the NIS2 Directive, cybersecurity governance becomes a management responsibility. NIS2 management accountability means the management body of an essential or important entity must approve cybersecurity risk-management measures, oversee their implementation, follow cybersecurity training, and keep evidence […]
Download the full case study!
Get the complete story—challenge, delivery setup, scope, outcomes, and the full testimonial.
