C2C Platform
Web, API and mobile penetration testing for IPO security readiness
Information technology I Japan I Penetration Testing I One-month engagement
The Clients
- Industry:
- Information technology
- Location:
- Japan
- Duration:
- 1 month
- Support areas:
- Penetration testing and application security
- Platform context:
- A Tokyo-based technology company that develops and operates multiple online matching and marketplace platforms.
The challenge
C2C Platform needed to assess the security of one of its production-grade products as part of its preparation for an IPO security audit.
• Identify vulnerabilities across the web application and API
• Test both the iOS and Android mobile applications
• Rate findings clearly by severity
• Prioritize the issues requiring remediation
• Produce reporting suitable for the upcoming security audit
Dealing with a similar setup? Let’s discuss your requirements.
What the client needed
C2C Platform required a penetration testing partner that could provide:
End-to-end testing across web, API, iOS and Android
Assessment mapped to OWASP Top 10 and API Top 10 risks
Clear severity ratings for every identified finding
Reproducible steps that its engineering team could follow
Practical remediation guidance, prioritized by urgency
Reporting structured to support its IPO security audit
What Sunbytes Delivered
Sunbytes conducted penetration testing in a dedicated test environment covering the product’s web, API and mobile layers.
Web application and API security testing
iOS and Android application testing
Assessment against OWASP Top 10 and API Top 10 risks
A detailed report covering all identified vulnerabilities
Severity ratings and remediation priorities for each finding
Adjustments to the reporting format and delivery timing to support the IPO audit
Want to see if the fit is right for your team?
Why teams choose Sunbytes
A Netherlands-led partner that connects security evidence, delivery capability, and operational follow-through
ISO 27001-certified ISMS
Sunbytes operates an ISO 27001-certified ISMS, so information handling and access control have documented governance behind them.
Evidence-first security work
Security recommendations are mapped to evidence, ownership, and next actions so buyers and auditors can review what changed.
Dutch-led communication
European stakeholders get direct scope alignment, clear escalation paths, and accountable follow-up from a Dutch-led team.
Delivery-aware remediation
Security findings can be translated into software, infrastructure, and process changes through Sunbytes delivery capability.
Continuous security route
Baseline, readiness, specialist services, and CyberCare can connect without restarting context at every new request.
One operating partner
Secure work can align with delivery teams and people operations when access, onboarding, or governance affects the control environment.
What the team covered
The penetration testing engagement covered:
Web application & API security
iOS & Android application security
OWASP Top 10 and API Top 10 risk assessment
Vulnerability validation and severity classification
Reproduction instructions for identified findings
Prioritized remediation guidance
Audit-oriented reporting and clarification support
Outcomes
The engagement gave C2C Platform a clear path from vulnerability detection to remediation:
-
All findings identified during testing were documented across the web, API and mobile layers
-
Both project KPIs, vulnerability detection and remediation completion, were fully achieved
-
The final report supported
the client’s preparation
for its IPO
security audit
In their words
“They provided practical, prioritized remediation guidance that our team could act on immediately.”
Yoshiyuki Saigusa
CTO, C2C Platform Co., Ltd.
See also
- Cybersecurity
DevSecOps and NIS2: what Dutch companies must do before July 2026
DevSecOps NIS2 readiness means proving that your software development process has working security controls, not just written policies. Before July 2026, Dutch companies in scope for the Cyberbeveiligingswet need evidence for Article 21 controls such as secure development, supply chain security, access management and effectiveness testing. For engineering teams, the practical evidence usually comes from […]
- Cybersecurity
NIS2 penetration testing requirements: what Article 21(2) compliance looks like
NIS2 penetration testing is not a checkbox exercise. Article 21 does not name one single testing tool that every entity must use. It requires organisations to handle vulnerabilities and assess whether their cybersecurity risk-management measures work in practice. That distinction matters. A vulnerability scan can tell you that a known weakness exists. A DAST scan […]
- Cybersecurity
NIS2 implementation roadmap: a 12-week plan for EU SMEs
A NIS2 implementation roadmap should turn the directive into a sequence your management board, IT team, compliance lead, and suppliers can execute. For most EU SMEs, the work does not fail because Article 21 is unknown. It fails because scope, risk assessment, remediation, evidence, and board approval happen in the wrong order. This 12-week plan […]
- Cybersecurity
The NIS2 minimum viable evidence pack: what to prepare for Article 21 compliance
A NIS2 evidence pack is the documentation your organisation uses to prove that Article 21 cybersecurity risk-management measures are not only written down, but implemented. For EU SMEs, the problem is scattered evidence: one access review in a spreadsheet, one supplier check in procurement, one incident procedure in IT, and no single view that connects […]
- Cybersecurity
How to run a NIS2 gap analysis: the 5-step assessment framework
A NIS2 gap analysis turns regulatory pressure into a working plan. It shows which cybersecurity measures already exist, which ones are missing, which gaps create the highest risk, and what evidence the company needs to produce. For EU companies preparing for NIS2, the goal is not to create another policy document. The goal is to […]
- Cybersecurity
NIS2 Article 20: management accountability obligations for company leadership
NIS2 management accountability is no longer a topic only for the CISO or security team. Under Article 20 of the NIS2 Directive, cybersecurity governance becomes a management responsibility. NIS2 management accountability means the management body of an essential or important entity must approve cybersecurity risk-management measures, oversee their implementation, follow cybersecurity training, and keep evidence […]
Download the full case study!
Get the complete story—challenge, delivery setup, scope, outcomes, and the full testimonial.
