For freight forwarders, carriers, 3PLs, ports and terminals, fleet and telematics providers, and mobility apps
Logistics is a chain of systems run by different companies that trust each other's messages: booking portals, warehouse and transport management, EDI links, telematics, driver apps and customs filings. We test where that trust can be abused to redirect payments, release or reroute cargo, track vehicles or stop operations.
The obvious target is operations: ransomware at a forwarder or a terminal can stop shipments for days, and the backlog can last for weeks. Other attacks leave operations running and go after the money or the cargo: attackers change the bank details on a carrier's invoice, take over a shipper's portal account to redirect a container, or use a telematics API to locate vehicles carrying high-value loads. Every company in the chain holds credentials for someone else's system, so one weak partner account can become your incident.
Transport and warehouse management systems, port community systems and the Windows estate beneath them make attractive targets because customers notice every hour of downtime. Intrusions typically start with exposed remote access or phished credentials and reach the backups before anything is encrypted.
Freight is paid against invoices exchanged by email between companies that have never met. An attacker in a compromised mailbox, or on a lookalike domain, asks for new bank details at the moment a large invoice falls due.
Booking and tracking portals often rely on a password alone, shared by several people at a customer. With a taken-over account an attacker can change delivery instructions, download shipping documents or collect container release codes.
Fleet platforms expose location history, trip data and sometimes remote commands through APIs and mobile apps. The usual flaw is a vehicle or trip identifier the API accepts without checking that it belongs to the caller's account, so one customer can see another's vehicles.
EDI, AS2 and API links between partners are often authenticated once at set-up and then trusted indefinitely. Messages are not always checked for business sense, so a forged status update or a changed consignee can pass straight into downstream systems.
Fake missed-delivery texts and emails that use a carrier's name harvest card details and credentials from the public, and the brand damage lands on the carrier. DMARC enforcement, lookalike domain monitoring and a clear way for customers to report fakes reduce the harm.
NIS2 lists transport (air, rail, water and road) among its sectors of high criticality and postal and courier services among its other critical sectors, so medium and large operators in those sectors carry risk-management duties, a 24-hour early warning and a 72-hour notification for significant incidents. Driver and customer location histories are personal data under GDPR, with breach notification to the supervisory authority within 72 hours. Shippers and platform customers often ask for ISO/IEC 27001:2022 certification or a SOC 2 report. Neither requires a penetration test, but test reports are the usual evidence for ISO control 8.8, and SOC 2's CC4.1 lists penetration testing among the separate evaluations an organisation can use.
The scoping call settles which of these apply to your systems.
Authenticated, role-aware testing of your application and its API surface, with an account for every role. We chain small findings into the access they lead to, such as a sequential invoice ID and a missing tenant check that together let one customer read another's invoices.
Duration: 5 to 10 working days
iOS and Android testing of the binary, on-device storage and transport, and of the backend API the app calls, replaying the app's own tokens to check whether one user can read another's data. On the device we check what the keychain or keystore stores, whether certificate pinning survives a bypass attempt and what deep links can trigger.
Duration: 6 to 10 working days
Internal and external network testing, including Active Directory. Where scope allows we go from an unauthenticated foothold to domain-wide impact and document the whole chain: the exposed service or sprayed credential that got us in, each privilege escalation on the way, and the accounts and hosts it reached.
Duration: 5 to 12 working days
An IAM-first review of AWS, Azure or GCP. We map what an attacker reaches after compromising one workload or one developer laptop, then rank those paths by the data at the end of each and write the Terraform or policy change that cuts it.
Duration: 4 to 8 working days
Phishing, vishing and physical pretexting run against your staff, help desk and finance team, only under written authorisation that names the targets, pretexts and limits. Results are reported by channel and pretext, never by name: how far a convincing approach got, how many people reported it and how long the first report took to reach someone who acted.
Duration: 2 to 4 weeks including campaign preparation
Hands-on help when an attacker is already inside: triage on the first call, containment that does not destroy evidence, forensic scoping of what was touched, and recovery that we verify before calling it complete. Outside a crisis we run retainers, tabletop exercises and compromise assessments, so your team has practised the first hour before it happens.
Duration: Live incidents until recovery is verified; readiness work in days
Closest written-up engagement
Logistics SaaS · About a month
The trust team was seeing partner logins with privileges nobody had granted.
Yes, as they are deployed for you. Much of the risk sits in your configuration, your integrations and the accounts you created rather than in the vendor's code. We agree what may be tested with you, and with the vendor where your contract requires it, and report vendor-side flaws in a form you can pass on.
Yes. A device test covers hardware interfaces, firmware, the credentials the unit holds and how it authenticates to your cloud. The platform API deserves equal attention, because one device's credentials should never reach the rest of the fleet, and the test follows that path.
We start with the process: who can change a supplier's bank details, what evidence they need and whether a call-back to a known number happens. If you also want to know how staff respond to a convincing request, that becomes a social engineering exercise under written authorisation, reported in aggregate rather than by name.
We pick the checks that apply to your systems and the frameworks you answer to. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.