Tackling API Exposure in Modern App Stacks
Industry:
Automobile
Region:
Europe
Technology:
Angular, .NET Core APIs and Azure
About the Client
A top-tier European automotive digital solutions provider, the client supports major Original Equipment Manufacturers (OEMs) with enterprise modernization and agile engineering. Their digital ecosystem spans supplier portals, customer interfaces, and microservices hosted on Azure.
Challenges
As the client transitioned to Angular-based frontends and .NET Core APIs, their platform faced increasing security concerns:
- Unauthenticated access to APIs revealed during sprint deployments
- Frequent logic flaws due to inadequate threat modeling during backlog grooming
- Limited visibility into IAM misconfigurations and network security gaps in Azure
- No structured offensive validation before production releases
Solutions
Evoke deployed a blend of Offensive Security and Product Security services to address risks across application and cloud environments:
Performed Red Team assessments
- Simulated attacker behaviors and uncovered business logic bypass, privilege escalation, and Azure exploitation paths
- Assessed the security of critical APIs
- Enabled real-time tracking, SLA monitoring, and remediation workflows
Results
- Prevented the exploitation of 14 business-critical vulnerabilities across frontend and APIs
- Identified two critical Azure misconfigurations that could have enabled lateral movement
- Embedded security checks into agile rituals, reducing last-minute release blockers by 60%
- Improved response time and collaboration between product owners and security engineers
- Enhanced product security maturity and stakeholder confidence in engineering pipelines
