Atleta
Improving SaaS security through penetration testing
Technology, Information and Internet I Netherlands I Penetration Testing I 1 month engagement (Feb – Mar 2025)
The Clients
- Industry:
- Technology, Information and Internet
- Location:
- Netherlands
- Delivery model:
- Project-based
- Duration:
- 1 month
- Support areas:
- Validate authentication layers + identify vulnerabilities
- Platform context:
- The #1 tool for organizing sports events, from registration to bib numbers.
The challenge
To validate whether existing security measures were effective, while also testing a newly implemented authentication layer:
• Improving the overall security posture of their SaaS software
• Testing a new authentication layer
• Verifying existing security measures to uncover potential vulnerabilities
Dealing with a similar setup? Let’s discuss your requirements.
What the client needed
Atleta required a security partner that could:
Perform a thorough security assessment of their SaaS platform
Validate the effectiveness of a new authentication layer
Identify and classify vulnerabilities through certified penetration testing
Deliver clear, actionable insights in a structured security report
What Sunbytes Delivered
Sunbytes executed a project-based engagement focused on security assessment and penetration testing, including:
Certified and standardized penetration testing
Manual and automated security testing
Identification and classification of vulnerabilities
Delivery of a detailed security assessment report
Want to see if the fit is right for your team?
Why teams choose Sunbytes
A Netherlands-led partner that connects security evidence, delivery capability, and operational follow-through
ISO 27001-certified ISMS
Sunbytes operates an ISO 27001-certified ISMS, so information handling and access control have documented governance behind them.
Evidence-first security work
Security recommendations are mapped to evidence, ownership, and next actions so buyers and auditors can review what changed.
Dutch-led communication
European stakeholders get direct scope alignment, clear escalation paths, and accountable follow-up from a Dutch-led team.
Delivery-aware remediation
Security findings can be translated into software, infrastructure, and process changes through Sunbytes delivery capability.
Continuous security route
Baseline, readiness, specialist services, and CyberCare can connect without restarting context at every new request.
One operating partner
Secure work can align with delivery teams and people operations when access, onboarding, or governance affects the control environment.
What the team covered
The engagement followed an agile approach and covered:
Pre-assessment alignment meetings to define goals and expectations
Manual and automated penetration testing of the SaaS application
Analysis and classification of identified vulnerabilities
Delivery of a security report detailing findings and deficiencies
Post-assessment discussions to explain results and offer retesting or consultancy services
Outcomes
The collaboration resulted in:
-
Delivery of a high-quality, certified penetration test
-
Clear visibility into previously unknown vulnerabilities
In their words
“We were impressed by the vulnerabilities that were discovered. We can tell that the pentesters digged deep to discover the vulnerabilities, and not just a surface scan”.
Jarno van Leeuwen
Co-Founder, Atleta
See also
- Dedicated Resources
IT staff augmentation from Vietnam: what European companies need to know
Vietnam is a delivery-fit decision before it is a rate decision. For European companies, IT staff augmentation from Vietnam works when internal product ownership is strong, senior external engineers can enter an existing delivery system, and the working day creates enough shared time for decisions. The location is a poor fit when the buyer expects […]
- Dedicated Resources
IT staff augmentation security: ISO 27001, GDPR and vendor due diligence
An NDA covers confidentiality. It does not decide who can enter production, whether a developer may download customer data, or how quickly access disappears when an engagement ends. Those controls must exist before the first sprint. IT staff augmentation security is the set of contractual, technical and operating controls that govern how external developers access […]
- Dedicated Resources
Building a security-first engineering culture in distributed teams
A security-first engineering culture is an operating model in which developers can see who owns a security decision, when a review is required and where the result must be recorded. It is not a slogan, a yearly course or a request for every engineer to become a security specialist. That distinction matters across locations. A […]
- Dedicated Resources
How many DevSecOps engineers does a mid-size SaaS need?
The useful DevSecOps team size question is not “How many security engineers should we hire?” It is “Which security responsibilities need continuous ownership, and how much capacity does that work require?” Two SaaS companies with 100 employees can need very different setups. One may run a single product on one cloud platform. The other may […]
- Dedicated Resources
In-house vs outsourced DevSecOps: cost, risk and speed comparison
The wrong DevSecOps operating model creates work in the place it was meant to remove. An internal hire can become a single point of dependency. An external team can generate findings without giving developers a clear remediation path. This in-house vs outsourced DevSecOps comparison focuses on the decision that matters: which model gives your company […]
- Dedicated Resources
IT Staff Augmentation Contract: What to Include and Watch Out For
An IT staff augmentation contract is not just a capacity order. It is the document that decides who controls delivery once an external developer has access to your codebase, your customer data, and your sprint board. Most disputes in staff augmentation engagements trace back to one of five gaps: vague scope, unclear IP assignment, missing […]
Download the full case study!
Get the complete story—challenge, delivery setup, scope, outcomes, and the full testimonial.
