The penetration test is complete and the report has arrived. For business leaders, that document should help decide where to act and which risks to address. Before filing it away, it is worth asking: did we also test the paths an attacker might use? The Wind Tre case provides a practical reason to ask.
Tests were performed. Was the coverage adequate?
The Garante's decision concerns two incidents at separate retail outlets. Through social engineering phone calls, attackers obtained remote access to devices and acquired authentication factors.
In the second incident, application queries reached the data of 365,048 customers. Identifiers were incremented sequentially to retrieve further records. For 41,359 people, payment method information was also involved, with the card number partially masked.
Wind Tre reported protective measures and regular testing. The Garante found inadequate coverage of the APIs, the interfaces through which software components exchange requests and data. The authority refers to an incorrectly defined assessment scope and/or insufficient depth of testing. The fine concerns a set of technical and organisational shortcomings, including certificate and credential management.
The scope must follow real workflows
An application includes both the page the user sees and the functions working behind it. If a search calls secondary APIs, those interfaces form part of the path to assess. Operations available after login also deserve attention: a compromised credential can become the starting point for abuse.
NIST SP 800-115 addresses planning through the selection of objectives, systems, techniques and assessment rules. For management, this means agreeing which business processes should be tested and making exclusions explicit.
Scenarios reveal the depth of testing
A system can recognise a user and still allow them to do too much. OWASP lists inadequate controls over access to individual objects among API risks: changing an identifier should not allow someone to view another person's information.
Scenarios like these require exploring roles, requests and application sequences. In the Wind Tre case, the Garante considers that targeted API checks could reasonably have identified the shortcomings later exploited.
That is an assessment of this particular case. No penetration test can promise to anticipate every attack; it can, however, clearly document which paths were explored, how and with what results.
Three questions before the next engagement
To assess the work, ask which workflows and interfaces are included; which scenarios can begin from access already obtained; and which evidence and limitations will accompany the conclusions. A vulnerability assessment helps identify and classify weaknesses; a penetration test checks whether they can be exploited within the agreed scope.
Fixes, retesting and scope updates need to follow changes to systems. The value of a report lies in turning observations into decisions while keeping what remains untested visible.