The Project
A prominent labor union representing thousands of workers nationwide had invested heavily in a modernized online member portal: an essential platform supporting dues, benefits, training access, grievance submissions, and internal communications. Before expanding functionality, the organization wanted assurance that the portal could withstand real‑world cyber threats. They deployed Winmill’s Penetration Testing Stream (PTS) to conduct comprehensive assessments that align with industry best practices while minimizing disruption to members and staff.
Challenges
As the union expanded its digital services, several risks emerged:
- Increased attack surface: New self‑service features and integrations with internal systems created additional exposure points.
- A diverse user base: The portal served both tech‑savvy and non‑technical members, increasing the risk of inconsistent security hygiene and credential reuse.
- Sensitive personal data: The portal stored PII, training records, and member‑only documentation: high‑value targets for phishing, account takeover, or extortion attempts.
- Limited internal testing capabilities: The IT team knew a more advanced, adversarial test was needed. They needed something beyond simple, automated scans to validate the security of authentication flows, authorization logic, API endpoints, and internal administrative controls.
The leadership team needed a partner who could test not just security from the outside, but also the structural integrity of the portal’s full application stack and user journeys.
