Interactive tool · 9 attacks · 6 layers
Which attacks get through your defences?
Most organisations rely on the edge alone. Switch layers on and off and watch which attacks are stopped, which are only seen, and which walk straight in.
- Gets through
SQL injection on the login form
Malicious input tries to read the customer database.
- Gets through
Credential stuffing
Bots replay leaked passwords at scale against login and OTP.
- Gets through
Broken object-level authorisation
A valid user changes an account ID in an API call and reads someone else’s data.
- Gets through
Forgotten shadow API
An old, undocumented API version is still live and unprotected.
- Gets through
Exploit of a known library flaw
An unpatched component with a public exploit is attacked.
- Gets through
Application-layer flood
High-volume requests try to take customer services offline.
- Gets through
Repackaged banking app
A modified copy of your app is distributed to steal credentials.
- Gets through
Runtime hooking on a rooted phone
Malware hooks the app at runtime to intercept transactions.
- Gets through
Slow data exfiltration
Legitimate-looking API calls drain data over weeks.
The layers
What each defence layer actually does.
Each layer maps to one of the six areas I assess. Open one to see what I check and the red flags I most often find.
- Edge WAF / WAAPFilters malicious requests at the edge before they reach your servers.Stops 3 of 9 here
- Bot managementSeparates people from automation on login, OTP and other business flows.Stops 2 of 9 here
- API securityKnows every API you expose and checks who may call what.Stops 3 of 9 here
- Mobile app protectionLets the mobile app defend itself on a device you do not control.Stops 2 of 9 here
- Testing & patchingFinds and fixes weaknesses before an attacker can use them.Stops 2 of 9 here
- Monitoring & SIEMMakes sure someone sees an attack while it is happening.Stops 0 of 9 here
Is the attack simulator based on real attacks?
Yes. The nine attacks are common, well-documented patterns against banking and enterprise applications, such as credential stuffing, broken object level authorisation (BOLA) and repackaged mobile apps. Which layer stops or only detects each one reflects general practice, not any vendor’s product claims.
If every attack shows as stopped, am I secure?
Not necessarily. The simulator assumes each layer is deployed, configured and tuned. In real assessments the gaps are usually inside a layer: a web application firewall (WAF) left in monitoring mode, an API inventory with holes, or logs that never reach the security operations centre (SOC).
How do I find out which layers I really have?
Take the free maturity scorecard for a quick self-assessment, or book a call. An assessment tests each layer with evidence, not questionnaires, and gives you a prioritised plan for the gaps that matter.