TABLE OF CONTENTS
Modern entrepreneurs understand that one environment will not suffice. Core systems remain in a company’s own data center, but modern applications are born in the cloud. The hybrid model is a versatile approach, but it hides risks that emerge in the area between the two.
These risks are costly. According to IBM, data breaches involving data spread across different environments result in an average loss of $5.17 million, with 283 days needed to discover and eliminate the issue (IBM Cost of a Data Breach, 2024).
This case study describes how ECS provided the complete range of services in the field of Vulnerability Assessment and Penetration Testing to a healthcare diagnostics company running both on-premises and Microsoft Azure systems. ECS is one of the reputed VAPT service providers in India, and it tested both infrastructures for the first time.
The organization operates as a provider of diagnostics and healthcare operations in several cities across India, has about 1,200 employees, and is equipped with 35 collection centers and laboratories. Its name is not being disclosed per its request.
The organization uses an on-premises data center for its laboratory systems and patient information. The online report portal and the app provided to patients are available through Microsoft’s Azure cloud service. Staff members’ login information is provided partly from on-premises Active Directory, which synchronizes it into Microsoft’s Entra ID for accessing cloud services.
Taking into consideration that the organization has to deal with numerous sensitive patient information, even one successful hacker attack will cause significant reputation damage to the organization and partners’ medical institutions.
The client needed:
The ECS team identified 52 vulnerabilities: 3 critical, 12 high, 21 medium, and 16 low. These were the most serious:
ECS designed a four-phase engagement built specifically for hybrid environments. Testing was mostly manual, supported by automated scanning, and aligned with recognized frameworks like PTES and the CIS Benchmarks. All active testing ran in agreed time windows so lab operations were never disrupted.
We started by mapping every system, connection, and identity link. This uncovered 11 assets missing from the client’s inventory, including two old test servers still connected to production.
The team performed internal and external Network VAPT across firewalls, switches, and VPN gateways. This was followed by infrastructure penetration testing of servers and Active Directory to find weak configurations and privilege escalation paths.
The comprehensive cloud security assessment examined the Azure identity permissions, storage configurations, and network rules according to the CIS Microsoft Azure Foundations Benchmark (CIS). After analyzing the cloud security, the cloud penetration testing simulated real attacks to exploit each vulnerability.
This was the most critical phase. Through hybrid cloud penetration testing, the team simulated an attacker with a foothold on one side, then tried to move across the VPN and identity sync to reach the other. This exposed the admin account path and the flat network, neither of which separate tests had ever caught.
ECS delivered a prioritized fix plan ranked by real-world risk, not just severity scores. Our team worked alongside the client’s IT staff, then retested every critical and high finding to confirm it was fully closed.
“Our data center and our cloud had both been tested before, but never together. ECS showed us exactly how an attacker could move from one into the other. The team was thorough, easy to work with, and made sure every critical issue was properly fixed.”
Head of IT Infrastructure, Healthcare Diagnostics Client
This engagement shows why hybrid environments need more than separate tests. The most serious risks sat in the connections between on-premises and cloud systems, exactly where traditional testing doesn’t look.
Finding and addressing those vulnerabilities is possible thanks to the correct use of VAPT Services. ECS constantly helps companies improve their security through manual testing, understandable reporting, and remediation.
If your enterprise operates on-premises and cloud systems, it is advisable to turn to ECS VAPT services in India for a complete solution. Also, consider how often you conduct VAPT to keep your environment safe from attacks.
