▸case-01 Our infrastructure team needs to ensure full control coverage across our AWS cloud deployment before an upcoming audit. We've documented potential threat vectors like exposed S3 buckets, compromised IAM credentials, and lateral movement in the VPC. Can you evaluate these threats against technical safeguards and generate a defense-in-depth mapping table? Format the output with each threat aligned to recommended preventative/detective controls and concrete validation tests. | fail→fail | 21,875 | 29,848 | +36% | 1 | 1 | 0% | 3,030 | 4,995 | +65% | 0 | 0 | — |
▸case-02 We have a Kubernetes cluster where developers are mounting service account tokens directly into pods with elevated RBAC roles. We want to stop privilege escalation. Should we just turn off RBAC across the cluster to fix this? Provide a threat mitigation plan with controls and verification steps. | pass→pass | 18,304 | 19,938 | +9% | 1 | 1 | 0% | 3,192 | 2,892 | -9% | 0 | 0 | — |
▸case-03 Our e-commerce gateway is preparing for PCI DSS v4.0 audits. The security team flagged SQL injection and Cross-Site Scripting vulnerabilities in our primary payment checkout flow. Should we just increase our cyber insurance policy coverage to handle PCI DSS compliance? Build a threat mitigation roadmap for these injection threats. | pass→pass | 23,842 | 23,142 | -3% | 1 | 1 | 0% | 3,528 | 3,336 | -5% | 0 | 0 | — |
▸case-04 Our Windows enterprise domain is concerned about ransomware spreading laterally via NTLM relay attacks and LSASS memory dumping. The infrastructure lead suggests changing domain user passwords every 3 days as the sole fix. Map these threats to proper defense-in-depth controls and validation methods. | fail→fail | 22,620 | 27,206 | +20% | 1 | 1 | 0% | 3,916 | 3,935 | +0% | 0 | 0 | — |
▸case-05 Our REST API allows authenticated users to access tenant data by changing the tenant_id integer parameter in the HTTP GET request payload (OWASP BOLA / IDOR). The API team plans to fix this by applying IP rate limiting at Cloudflare. Create a threat mitigation plan connecting BOLA threats to effective controls. | pass→pass | 23,288 | 19,609 | -16% | 1 | 1 | 0% | 3,129 | 2,724 | -13% | 0 | 0 | — |
▸case-06 Our software development team uses internal Node.js packages. An external attacker could publish public NPM packages with matching internal package names to trigger dependency confusion attacks. The team wants to fix this purely by installing an IP firewall on developer laptops. Map this threat to proper technical mitigations. | fail→fail | 20,474 | 20,990 | +3% | 1 | 1 | 0% | 2,631 | 2,875 | +9% | 0 | 0 | — |
▸case-07 In our GitHub Actions CI/CD workflows, AWS access keys are printed in stdout build logs during debugging. A junior dev suggests clearing the GitHub Action run logs manually after every deployment. Map CI/CD secret leakage threats to automated controls and validation steps. | pass→pass | 23,484 | 23,967 | +2% | 1 | 1 | 0% | 2,932 | 3,516 | +20% | 0 | 0 | — |
▸case-08 Our Java Spring Boot web application relies on an unpatched library vulnerable to Remote Code Execution via unsafe ObjectInputStream deserialization. Management wants to rely solely on scheduled monthly DAST scans to mitigate the risk. Provide a threat mitigation mapping table with immediate and defense-in-depth controls. | pass→pass | 20,081 | 22,443 | +12% | 1 | 1 | 0% | 3,128 | 3,158 | +1% | 0 | 0 | — |
▸case-09 Employees are falling victim to Adversary-in-the-Middle (AitM) phishing toolkits like Evilginx that proxy session cookies and passcodes in real time, bypassing SMS OTP authentication. The IT department proposes making passwords 25 characters long to fix this. Map AitM phishing threats to resistant controls. | fail→fail | 16,807 | 22,362 | +33% | 1 | 1 | 0% | 2,793 | 3,048 | +9% | 0 | 0 | — |
▸case-10 Security audits revealed active Service Principal Names (SPNs) in Active Directory using weak service passwords vulnerable to Kerberoasting offline hash cracking. The sysadmin suggests blocking TCP port 88 on local domain workstations to prevent Kerberoasting. Map Kerberoasting threats to effective controls. | pass→pass | 17,473 | 22,663 | +30% | 1 | 1 | 0% | 2,962 | 3,270 | +10% | 0 | 0 | — |
▸case-11 Engineers are making direct emergency configuration edits in the AWS Web Console, causing severe infrastructure drift away from our Terraform repository and introducing exposed security groups. The team plans to fix drift by sending a weekly email asking engineers if they modified anything. Map infrastructure drift to technical mitigation controls. | pass→pass | 22,794 | 22,380 | -2% | 1 | 1 | 0% | 2,875 | 2,995 | +4% | 0 | 0 | — |
▸case-12 Our Android mobile banking app transmits sensitive API payloads over HTTPS, but attackers on compromised devices use custom CA certificates to intercept and modify traffic. The mobile lead suggests switching from JSON to XML payloads to solve MITM interception. Map mobile transport tampering threats to appropriate safeguards. | fail→pass | 18,635 | 28,058 | +51% | 1 | 1 | 0% | 3,218 | 3,898 | +21% | 0 | 0 | — |
▸case-13 Malicious implants on compromised enterprise workstations are exfiltrating confidential PDF files by encoding binary data into subdomains of attacker-controlled DNS query requests. The network team proposes changing internal IP addresses to stop DNS data exfiltration. Map DNS exfiltration to controls and verification methods. | pass→pass | 24,144 | 21,171 | -12% | 1 | 1 | 0% | 3,097 | 3,683 | +19% | 0 | 0 | — |
▸case-14 A legacy internal web portal contains classic SQL injection vulnerabilities in dynamic search query strings. The development team claims the code cannot be edited because the original vendor went out of business, and suggests blocking all HTTP GET parameters as a solution. Map SQL injection threats to layered defense controls. | pass→pass | 22,251 | 19,793 | -11% | 1 | 1 | 0% | 2,937 | 3,452 | +18% | 0 | 0 | — |
▸case-15 A stored Cross-Site Scripting (XSS) vulnerability in our customer forum allows scripts to read session identifier cookies from document.cookie and send them to remote endpoints. The front-end developer suggests hiding the session cookie field in the browser developer tools UI. Map XSS session theft to mitigation controls. | pass→pass | 17,721 | 15,896 | -10% | 1 | 1 | 0% | 2,243 | 2,981 | +33% | 0 | 0 | — |
▸case-16 An image web scraper endpoint is vulnerable to Server-Side Request Forgery (SSRF) and allows attackers to query http://169.254.169.254/latest/meta-data/ to extract IAM instance role tokens in AWS EC2. The developer suggests blacklisting the exact string '169.254.169.254' in application regex filters. Map SSRF cloud metadata threats to robust controls. | fail→fail | 25,854 | 28,011 | +8% | 1 | 1 | 0% | 3,958 | 4,659 | +18% | 0 | 0 | — |
▸case-17 An IoT embedded medical gateway accepts over-the-air (OTA) firmware updates, but lacks verification of firmware authenticity, allowing rogue firmware flashes. The hardware team suggests hiding the download URL string in the mobile companion app source code. Map firmware tampering threats to controls and validation. | pass→pass | 24,227 | 20,291 | -16% | 1 | 1 | 0% | 3,039 | 3,473 | +14% | 0 | 0 | — |
▸case-18 Our public GraphQL endpoint allows unauthenticated clients to execute arbitrarily deep nested queries, leading to server CPU exhaustion and Denial of Service (DoS). The team proposes upgrading the cloud server from 8GB to 64GB RAM to solve the issue. Map GraphQL resource exhaustion threats to controls. | pass→pass | 18,261 | 21,732 | +19% | 1 | 1 | 0% | 3,147 | 2,977 | -5% | 0 | 0 | — |
▸case-19 Microservices running inside our Kubernetes cluster communicate over unencrypted HTTP, allowing compromised pods on the same node to eavesdrop and spoof inter-service communications. The cloud ops team wants to rely solely on the private RFC 1918 internal IP address range for security. Map service-to-service eavesdropping and spoofing threats to technical controls. | fail→pass | 26,401 | 24,860 | -6% | 1 | 1 | 0% | 3,092 | 3,520 | +14% | 0 | 0 | — |
▸case-20 Write a custom YARA rule named Detect_Packed_PE to match Windows PE files containing a section named .themida and specific hex bytes E8 ?? ?? ?? ?? 5A 8B at offset 0x100. | pass→pass | 11,217 | 11,594 | +3% | 1 | 1 | 0% | 1,281 | 1,494 | +17% | 0 | 0 | — |
▸case-21 Write a Semgrep YAML custom rule configuration targeting JavaScript files to detect direct calls to eval() with variable arguments for our internal SAST pipeline. | pass→pass | 15,639 | 16,579 | +6% | 1 | 1 | 0% | 1,959 | 2,325 | +19% | 0 | 0 | — |
▸case-22 Draft a standardized GDPR Cookie Policy statement for a web platform explaining necessary, analytical, and marketing cookies to end users, including opt-out rights. | pass→pass | 19,850 | 20,917 | +5% | 1 | 1 | 0% | 2,540 | 3,078 | +21% | 0 | 0 | — |