Atleta
Improving SaaS security through penetration testing
Technology, Information and Internet I Netherlands I Penetration Testing I 1 month engagement (Feb – Mar 2025)
The Clients
- Industry:
- Technology, Information and Internet
- Location:
- Netherlands
- Delivery model:
- Project-based
- Duration:
- 1 month
- Support areas:
-
Validate authentication layers + identify vulnerabilities - Platform context:
-
The #1 tool for organizing sports events, from registration to bib numbers.
The challenge
To validate whether existing security measures were effective, while also testing a newly implemented authentication layer:
• Improving the overall security posture of their SaaS software
• Testing a new authentication layer
• Verifying existing security measures to uncover potential vulnerabilities
Dealing with a similar setup? Let’s discuss your requirements.
What the client needed
Atleta needed an independent security assessment to validate its platform, test a new authentication layer, and uncover hidden vulnerabilities.
A stronger security baseline
Assess the SaaS platform to understand its current security posture and identify areas requiring attention.
Validation of a new authentication layer
Test the newly implemented authentication mechanism against potential attack scenarios and weaknesses.
Visibility into hidden vulnerabilities
Go beyond existing controls to uncover security issues that may not have been identified internally.
Clear remediation priorities
Turn security findings into actionable priorities the team could use to plan remediation.
What Sunbytes Delivered
Sunbytes conducted a focused penetration testing engagement to identify, assess, and prioritize security vulnerabilities across Atleta’s platform.
Manual & automated penetration testing
Combined hands-on testing with automated tools to uncover vulnerabilities beyond surface-level scanning.Authentication & application security testing
Tested key application and authentication controls against realistic attack scenarios.Vulnerability analysis & prioritization
Classified identified issues by severity, impact, and exploitability to support remediation decisions.Security reporting & follow-up guidance
Delivered documented findings, actionable recommendations, and follow-up support for remediation and retesting.
Want to see if the fit is right for your team?
Why teams choose Sunbytes
A Netherlands-led partner that connects security evidence, delivery capability, and operational follow-through
ISO 27001-certified ISMS
Sunbytes operates an ISO 27001-certified ISMS, so information handling and access control have documented governance behind them.
Evidence-first security work
Security recommendations are mapped to evidence, ownership, and next actions so buyers and auditors can review what changed.
Dutch-led communication
European stakeholders get direct scope alignment, clear escalation paths, and accountable follow-up from a Dutch-led team.
Delivery-aware remediation
Security findings can be translated into software, infrastructure, and process changes through Sunbytes delivery capability.
Continuous security route
Baseline, readiness, specialist services, and CyberCare can connect without restarting context at every new request.
One operating partner
Secure work can align with delivery teams and people operations when access, onboarding, or governance affects the control environment.
What the team covered
The engagement covered the full assessment cycle, from security testing to findings, reporting, and follow-up.
Security testing across the SaaS platform
Combined manual and automated techniques to simulate realistic attack scenarios and identify vulnerabilities.Authentication layer validation
Tested the new authentication mechanism for weaknesses, reliability, and resistance to potential attacks.Vulnerability analysis & prioritization
Reviewed identified issues based on severity, impact, and exploitability to support remediation decisions.Security reporting & recommendations
Documented findings, potential risks, and practical recommendations in a structured assessment report.Post-assessment consultation & retesting
Reviewed findings with the client and supported remediation planning, retesting, and follow-up where needed.
Outcomes
The assessment resulted in:
-
Previously unknown vulnerabilities identified
The assessment uncovered security issues that had not been identified through existing controls.
-
Clear remediation priorities
Findings were classified by severity, impact, and exploitability to help the team decide what to address first.
-
Validated security findings
The assessment identified 1 high, 5 medium, 1 low, and 2 informational vulnerabilities, with no critical findings recorded.
-
Structured security evidence
Atleta received a documented report covering the findings and recommendations for follow-up remediation.
In their words
“We were impressed by the vulnerabilities that were discovered. We can tell that the pentesters digged deep to discover the vulnerabilities, and not just a surface scan”.
Jarno van Leeuwen
Co-Founder, Atleta
See also
- Dedicated Resources
IT staff augmentation from Vietnam: what European companies need to know
Vietnam is a delivery-fit decision before it is a rate decision. For European companies, IT staff augmentation from Vietnam works when internal product ownership is strong, senior external engineers can enter an existing delivery system, and the working day creates enough shared time for decisions. The location is a poor fit when the buyer expects […]
- Dedicated Resources
IT staff augmentation security: ISO 27001, GDPR and vendor due diligence
An NDA covers confidentiality. It does not decide who can enter production, whether a developer may download customer data, or how quickly access disappears when an engagement ends. Those controls must exist before the first sprint. IT staff augmentation security is the set of contractual, technical and operating controls that govern how external developers access […]
- Dedicated Resources
Building a security-first engineering culture in distributed teams
A security-first engineering culture is an operating model in which developers can see who owns a security decision, when a review is required and where the result must be recorded. It is not a slogan, a yearly course or a request for every engineer to become a security specialist. That distinction matters across locations. A […]
- Dedicated Resources
How many DevSecOps engineers does a mid-size SaaS need?
The useful DevSecOps team size question is not “How many security engineers should we hire?” It is “Which security responsibilities need continuous ownership, and how much capacity does that work require?” Two SaaS companies with 100 employees can need very different setups. One may run a single product on one cloud platform. The other may […]
- Dedicated Resources
In-house vs outsourced DevSecOps: cost, risk and speed comparison
The wrong DevSecOps operating model creates work in the place it was meant to remove. An internal hire can become a single point of dependency. An external team can generate findings without giving developers a clear remediation path. This in-house vs outsourced DevSecOps comparison focuses on the decision that matters: which model gives your company […]
- Dedicated Resources
IT Staff Augmentation Contract: What to Include and Watch Out For
An IT staff augmentation contract is not just a capacity order. It is the document that decides who controls delivery once an external developer has access to your codebase, your customer data, and your sprint board. Most disputes in staff augmentation engagements trace back to one of five gaps: vague scope, unclear IP assignment, missing […]
Download the full case study!
Get the complete story—challenge, delivery setup, scope, outcomes, and the full testimonial.
