Phase 09 · Executive reporting · Export-ready layout
Project Nightwatch — Security Assessment Report
Synthetic Mid-Market SaaS Organization · v1.0 (portfolio demonstration) · Prepared by Rachel Love
This is an on-screen, export-ready report layout demonstrating how findings are communicated to leadership. No real client report exists and no real organization was assessed.
1 · Executive summary
This portfolio simulation models an authorized, time-boxed assessment of the Synthetic Mid-Market SaaS Organization environment, in which 12 findings were validated across 8 in-scope synthetic assets: 1 Critical, 3 High, 5 Medium, and 3 Low. The dominant theme was authorization enforced inconsistently between the interface and the server, compounded by identity entitlements broader than their documented purpose. Individually moderate configuration weaknesses combined into 3 illustrative attack paths, two of which remain open pending segmentation and non-human-identity work.
9 findings have been remediated or closed and 9 passed retest against reviewed evidence, including the single Critical access-control issue. Remaining exposure is concentrated in internal containment rather than internet-facing entry points, which lowers immediate likelihood while keeping consequence high if a foothold is ever obtained. The recommended focus is completing segmentation tightening, retiring unowned service identities, and restoring privileged-action audit coverage.
2 · Scope statement
In scope (synthetic)
- portal.lab.invalid — synthetic customer portal (WEB-01)
- api.lab.invalid — synthetic public API gateway (API-01)
- id.lab.invalid — synthetic identity service (IAM-01)
- 198.51.100.0/24 — documentation range representing the lab perimeter
- 10.20.0.0/16 — synthetic internal lab range (authenticated review only)
Out of scope
- Any real production system, domain, or IP address
- Third-party SaaS, payment processors, and hosting provider control planes
- Employee endpoints, personal accounts, and physical facilities
- Any asset not explicitly listed in the authorized scope table
3 · Methodology
- 01
Authorization & scope
Confirm written authorization, agree rules of engagement, define in-scope assets, stop conditions, and the escalation path before any activity.
- 02
Asset discovery
Build an inventory of synthetic assets, owners, exposure, and authentication boundaries.
- 03
Attack-surface analysis
Group assets by trust zone and identify where the meaningful boundary transitions actually are.
- 04
Validation
Confirm each candidate weakness with the minimum non-destructive interaction needed, and record confidence honestly.
- 05
Attack-path analysis
Chain moderate findings to show where combined risk exceeds the sum of individual severities.
- 06
Risk rating
Rate on business impact and realistic exploitability, not scanner output.
- 07
Remediation guidance
Give owners specific, testable fixes plus compensating controls for the interim.
- 08
Retest
Re-validate against evidence. A change alone is not closure; the retest result decides.
- 09
Executive reporting
Communicate risk, decisions, and residual exposure in language leadership can act on.
4 · Risk summary
1
validated findings
3
validated findings
5
validated findings
3
validated findings
5 · Top findings
Critical and High severity synthetic findings.
EH-001
Broken access control in synthetic admin workflow
Allows a standard lab user to perform administrative actions across tenant boundaries, undermining the primary trust boundary of the platform.
Recommendation: Enforce authorization server-side on every administrative operation, deny by default, and add automated tests asserting role checks per endpoint.
EH-002
Overly broad permissions assigned to synthetic test role
Any account holding the test role gains far more capability than intended, widening the blast radius of a single account compromise.
Recommendation: Rebuild the role from least-privilege requirements, separate test roles from production role hierarchies, and review entitlements quarterly.
EH-003
Overly permissive network path between synthetic application and data tiers
Reduces containment: a foothold in any application workload reaches the data tier directly rather than through a controlled service interface.
Recommendation: Tighten segmentation to the required service port, move to identity-based service authorization, and alert on unexpected tier-to-tier connections.
EH-004
Insecure test upload validation on lab endpoint
Weak content validation increases the likelihood of unsafe file handling downstream and of storage being used as an untrusted content channel.
Recommendation: Validate content server-side, restrict accepted types by allow-list, store uploads outside the application root, and serve with non-executable content headers.
6 · Attack-path summary
AP-01
Portal exposure to synthetic tenant administration
Three individually moderate weaknesses combine so that a standard lab account reaches an administrative workflow across a tenant boundary.
Internet-Facing → Application → Application → Identity
AP-02
API abuse to synthetic account enumeration
Missing throttling plus verbose errors and banner disclosure make low-cost guessing against lab accounts practical and quiet.
Internet-Facing → Internet-Facing → Identity
AP-03
Retired integration identity to internal data tier
A forgotten service account combined with broader-than-designed segmentation shortens the route from a workload foothold to tenant data.
Internal → Application → Internal
7 · Prioritized remediation plan
| Priority | Finding | Owner | Target date | Status | Retest |
|---|---|---|---|---|---|
| P1 | EH-001 | Platform Engineering (synthetic) | 2026-03-20 | Closed | Pass |
| P1 | EH-002 | Identity Engineering (synthetic) | 2026-03-22 | Closed | Pass |
| P2 | EH-004 | Platform Engineering (synthetic) | 2026-03-27 | Retested | Pass |
| P2 | EH-005 | API Platform (synthetic) | 2026-03-30 | Closed | Pass |
| P2 | EH-006 | Platform Engineering (synthetic) | 2026-04-02 | Closed | Pass |
| P2 | EH-008 | Data Platform (synthetic) | 2026-04-08 | Evidence Review | Pass |
| P2 | EH-003 | Infrastructure (synthetic) | 2026-04-17 | In Progress | Not Retested |
| P2 | EH-009 | Integration Team (synthetic) | 2026-04-21 | In Progress | Not Retested |
| P3 | EH-007 | Platform Engineering (synthetic) | 2026-04-05 | Closed | Pass |
| P3 | EH-012 | Platform Engineering (synthetic) | 2026-04-30 | Planned | Not Retested |
8 · Retest summary
9 of 12 findings passed retest against reviewed evidence, including EH-001 (broken access control) and EH-002 (over-permissioned test role). Three findings remain in remediation with compensating controls in place and no retest yet performed: EH-003 (segmentation), EH-009 (stale service identity), and EH-012 (privileged-action logging). No finding was closed on the basis of a change alone.
9 · Residual risk
Current position
After the retested fixes, no Critical exposure remains in the synthetic environment. Residual risk is rated Medium overall and is driven by internal containment: the application-to-data-tier network path is still broader than designed, and one unowned service identity remains enabled. Both reduce the cost of lateral movement after any initial foothold, and weak privileged-action auditing extends the time to detect it.
Recommended next steps
- Complete segmentation tightening to the single required service port (EH-003).
- Disable the retired service identity and assign owners to all non-human identities (EH-009).
- Emit structured privileged-action audit events with alerting (EH-012).
- Re-run attack-path AP-03 after the above and re-rate residual risk.
10 · Limitations and assumptions
- The engagement, client, assets, and findings are synthetic; no real environment was assessed.
- Findings reflect the state of the lab environment at a point in time and do not predict future exposure.
- Coverage was limited to the assets listed in the authorized scope; unlisted assets were not examined.
- Validation was deliberately non-destructive, so some weaknesses are recorded at Moderate confidence.
- Framework mappings are analytical aids, not certification, compliance, or formal assessment outcomes.
- Absence of a finding is not evidence of absence of a weakness.