Industrial manufacturer scales product security with the Penetration Testing Stream

The project

A global industrial technology organization with dozens of subsidiaries was facing growing pressure from customers to demonstrate the security of its products. What began as a single Winmill engagement, helping one operating company select and implement an application security solution, grew into a broader partnership: the client adopted Winmill’s Penetration Testing Stream subscription across ten of its subsidiary operating companies, spanning hundreds of teams and product lines. That first chapter is its own story. This one is about how the program works.

The challenges

• Products that outgrew their origins. Many devices were originally standalone equipment and evolved into connected IoT products: networked over wifi and other protocols, supported by mobile applications, and backed by cloud platforms. Every layer added risk.
• Customers demanding evidence. Buyers wanted proof of product security, often as a contractual obligation.
• Scale without overhead. The company needed consistent, repeatable penetration testing across web applications, IoT devices, mobile interfaces, and cloud endpoints for many business units, without the delays of traditional engagement models.

The solution

The Penetration Testing Stream’s subscription model enables continuous testing with minimal lead time and eliminates time-consuming scoping documents and change orders. Through the Winmill Pen Test Portal, each participating product team requests and manages its own tests, while global security teams keep full visibility across the entire product landscape. Product owners and engineers provide key information through the portal in advance, which streamlines scheduling and delivery.

A recent assessment shows the model in action. The scope covered two IoT products, each with an integrated web application. The assessment uncovered several significant issues that expensive scanning tools had missed, including critical-severity findings of remote code execution, insecure firmware updates, and vulnerability to credential stuffing, plus high-severity findings including improper access control, hard-coded credentials, and cross-site request forgery.

The results

• On-time, decision-ready deliverables. The client received its deliverables precisely on the proposed end date: an executive summary for management and a detailed technical findings report with remediation recommendations tailored to the internal development teams.
• Retest without disruption. After fixes were implemented, the retest slotted into the schedule without impacting other business units, and Winmill’s follow-up testing validated the resolutions. The client presented a clean report to its customers.
• A program, not a project. The organization now has a streamlined, scalable process for assessing and improving product security across its subsidiaries, meeting contractual obligations and customer expectations as its products keep evolving.