A telecommunications provider believed its defences held: layered security tools, compliance checks, and a team fluent in cyber risk. CovertSwarm ran a social engineering attack against that same environment and got in through an exposed API within days.
No unbreakable perimeter. No fortress. Just gaps nobody had tested.
The backdrop
This telecommunications heavyweight had built its security programme around recognised industry standards: multiple layers of tooling, compliance mechanisms, and a team that understood the nuances of cyber risk. That combination made them confident they were a difficult target.
Real attackers don’t announce themselves or wait for a scheduled test. The client understood that risk and wanted proof, not assumptions. They came to CovertSwarm to test the limits of their defences, including how they’d hold up against a social engineering attack.
The gut punch
It didn’t take long for the cracks to show. Our OSINT team found an exposed web application with a bearer token left inside accessible API code. That token let us send emails from within the client’s own domain, bypassing their basic email protections.
We didn’t stop at one email. Using the same API access, we pulled a list of authorised users and built a social engineering attack around it, a phishing campaign tailored enough to pass their filters undetected.
Next, we exploited a weakness in their customer-facing ticketing system. A portal built for routine queries became our way in. We uploaded a disguised file, a fake “critical update” link hosted on the client’s own servers, so the payload looked like it came from inside the organisation.
No external alerts triggered. Two employees clicked the link anyway.
The solution
Compromising their systems was the easy part. The real work was helping them understand why reactive, occasional testing couldn’t keep up. Continuous, adaptive attacks aren’t a hypothetical risk. They’re what real adversaries do every day.
Through detailed reporting and follow-up consultation, we worked through each vulnerability from the ground up.
- API security: locked down bearer tokens, added stricter authentication, and put active anomaly monitoring in place.
- Phishing defence: shared the exact techniques we used in the social engineering attack, to help their teams spot the growing sophistication in real phishing emails.
- Internal trust boundaries: showed how we turned their own resources against them, and how to segment trust between internal systems.
- File and system inspection: built a process to scan uploaded files and track system calls, so a payload like ours couldn’t execute unnoticed.
We didn’t hand over a report and walk away. We worked through remediation with their team and helped build stronger incident-response capability.
The revelation
The results spoke for themselves. A company that had leaned on traditional security models for years saw, for the first time, the real scale of its exposure.
- Better monitoring: IT and security teams started proactively watching every attack surface, internal and public-facing.
- Stronger processes: new internal guidelines for API use, file handling, and incident response went live within weeks.
- A new strategy: the client moved from occasional pen testing to CovertSwarm’s Constant Cyber Attack™ subscription, calling it the only proactive way to secure their operations.
As their head of security put it:
“This wasn’t just a wake-up call. It was a rallying cry. The insights and comprehensive support we got from CovertSwarm gave us not only the perspective we didn’t know we needed but the foundation to move forward confidently.”
The reckoning
The lesson here is direct. Understanding your vulnerabilities on paper isn’t the same as testing them. You need a persistent adversary working against your defences, finding the gaps before the real attackers do.
Occasional pen tests can’t keep pace with that. What CovertSwarm delivers instead is certainty: relentless, intelligent attacks that keep your business ahead of the threat actually targeting it.
Stop testing. Start attacking. Contact CovertSwarm to see what a real social engineering attack against your business would uncover.