This is Part 2 of our benchmark study. In Part 1, we published the empirical results comparing G4LAHAD against leading open-source solutions. In this concluding chapter, we explore the real-world findings across Insurance, Healthcare, and Banking, followed by the architectural decisions that made this outperformance possible.
Recap: The Empirical Lead
In Part 1, we evaluated autonomous penetration testing solutions across three production-grade web applications. The headline results established a decisive performance gap:
- High-Impact Volume: G4LAHAD discovered 122 medium+ findings (all manually verified by senior penetration testers) — surpassing the 2nd and 3rd place candidates combined.
- Logic Dominance: Uncovered 8x more exclusive business logic and access control vulnerabilities than all other candidates combined.
- Exclusive Vulnerability Coverage: Captured 91% (42 of 46) of all exclusive findings across the entire benchmark, outperforming the nearest competitor by 14x.
- Engineered Depth: Generated and executed 1,004 role-aware test cases — surpassing the nearest candidate by more than 4x.
While Part 1 showed what happened, Part 2 demonstrates how it happened in practice. We begin by showcasing the actual vulnerabilities uncovered, then break down the architectural design that drove these results.
ClaimFlow (Insurance Platform)
To demonstrate how architectural depth translates into real-world security impact, we examine key findings across all three target applications. These showcase G4LAHAD's ability to master business logic, craft creative payloads, and chain multi-step exploits under realistic enterprise constraints.
Before the findings, the regulatory stakes. In Malaysia, insurers regulated under the Financial Services Act 2013 (FSA) and applicable Bank Negara Malaysia (BNM) policy documents, such as the Policy Document on Claims Settlement Practices (PD CSP), are required to maintain effective internal controls, anti-fraud safeguards, risk-management procedures, and appropriate approval limits across underwriting, claims, and other multi-party workflows involving policyholders, agents, adjusters, underwriters, and service providers.
In ClaimFlow, G4LAHAD uncovered 48 medium+ findings (including 4 Critical and 28 High) and 16 exclusive findings, while other tools found at most 1.
Policy Cap Bypass via Split Claims
The Flaw: Policies enforce a maximum payout limit per calculation, but fail to track cumulative claim payouts against the policy's overall coverage cap.
The Exploit: An attacker holding a policy capped at (e.g.) $5,000 submits multiple separate claims of $4,000 each for the same policy period. Because the system checks each claim in isolation against the $5,000 ceiling, every transaction is approved, allowing the attacker to withdraw amounts far in excess of the policy limit.
Impact: Direct financial loss through unchecked policy drain. Insurers face cumulative payouts that break actuarial reserve assumptions and policy liability caps (breaching prudential and claims-settlement requirements under FSA 2013 and the PD CSP).
Why G4LAHAD Caught It: Other harnesses evaluate each claim in isolation. G4LAHAD modeled cumulative account state over time, exposing the gap between transaction validation and ledger enforcement.
Concurrent Double-Dip Payouts
The Flaw: Insurance rules enforce a strict "one incident, one payout" policy. However, the application lacks concurrency locks and uniqueness checks on claim submissions.
The Exploit: An attacker submits two identical claim requests simultaneously for the exact same incident. Due to missing concurrency locks, both requests process in parallel, creating two separate approved claim records.
Impact: Direct double-payouts on a single loss event. Duplicate claims directly siphon funds out of the claim settlement reserve pool, violating statutory fraud prevention and settlement standards.
Why G4LAHAD Caught It: G4LAHAD systematically tests race conditions and workflow constraints across critical financial state transitions.
MedPortal (Healthcare Platform)
Healthcare providers and hospital operators in Malaysia are governed by the Personal Data Protection Act 2010 (PDPA) — which legally classifies medical information as Sensitive Personal Data — as well as the Private Healthcare Facilities and Services Act 1998 (PHFSA), mandating uncompromising patient confidentiality and strict data segregation.
G4LAHAD identified 50 medium+ findings and 9 exclusive findings, while competing tools found zero exclusive vulnerabilities.
Privilege Escalation via Nested Injection
The Flaw: The patient profile update handler passes user input directly into database updates without sanitizing nested object relationships.
The Exploit: Any authenticated patient sends a single profile update request containing a specially structured nested payload: {"user":{"update":{"role":"ADMIN"}}}. While standard flat payloads fail with server errors (500), this exact nested structure successfully traverses the relation and rewrites the user's role to Admin on their next login.
Impact: Instant and complete administrative takeover by any standard patient.
Why G4LAHAD Caught It: Pure payload creativity. Standard privilege escalation payloads resulted in 500 errors, causing every other candidate (including the white-box solution, Shannon OSS, which had direct source-code access) to miss this vulnerability. G4LAHAD synthesized the exact nested relational structure required to achieve full admin takeover.
Overpermissive Healthcare Record Leak (Full PHI Exposure)
The Flaw: While the nurse portal user interface only displays a curated worklist and today's vitals for assigned patients, the underlying backend API fails to enforce row-level filtering and returns the entire medical records database.
The Exploit: An attacker with standard Nurse credentials queries the backend API directly, bypassing the UI view filters to extract all medical records across the hospital.
Impact: Unauthorized disclosure of unassigned patient medical records.
Why G4LAHAD Caught It: G4LAHAD does not trust front-end restrictions. It audits backend APIs against role-based access controls, detecting overpermissive data access and applying both application context and healthcare regulatory requirements.
VaultBank (Digital Banking Platform)
Commercial and digital banks in Malaysia operate under Bank Negara Malaysia's (BNM) strict Risk Management in Technology (RMiT) policy framework and the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA), requiring defense-in-depth across authentication, transaction monitoring, and digital identity assurance.
A Deliberate Blind Spot: The Ultimate Test of Autonomous Recon
In VaultBank, we evaluated G4LAHAD under an intentional, highly realistic operational handicap: while the platform featured five distinct role tiers (Customer, Teller, Branch Manager, Compliance Officer, and Admin), every harness was provided only baseline retail customer accounts (Silver, Platinum, and Gold tiers).
All harnesses had zero pre-seeded knowledge of internal staff accounts, back-office endpoints, or management interfaces. This mirrors how real-world adversaries target financial institutions: an attacker starts with a low-privilege retail account, then methodically maps the attack surface to discover and compromise internal bank roles. Despite this blind spot, G4LAHAD uncovered 24 medium+ findings and 17 exclusive findings, culminating in the full autonomous takeover demonstrated below.
Multi-Step Admin Account Takeover
The Flaw: Three compounding vulnerabilities:
- an unauthenticated registration error message allowing email enumeration of registered staff
- a login rate limit bypass via client-supplied
X-Forwarded-Forheader - a guessable administrator account password
The Exploit: Operating strictly from its seeded retail customer position, G4LAHAD chained all three weaknesses autonomously:
- Probed the registration endpoint with staff email patterns to confirm the existence of
admin@vaultbank.com, discovering the hidden admin namespace. - Fuzzed login attempts against
admin@vaultbank.comwhile rotating random fake IP addresses in theX-Forwarded-Forheader, completely evading rate limits without triggering lockouts or CAPTCHAs. - Guessed the default credential (
admin1234) after numerous attempts, securing an active session as the root Bank Administrator.
Impact: Complete administrative compromise of the digital bank.
Why G4LAHAD Caught It: All other harnesses look at bugs in silos; G4LAHAD connects individual data points into an offensive chain.
Post-Verification Identity Tampering (eKYC Breakdown)
The Flaw: The profile update endpoint allows authenticated customers to modify their verified legal identity attributes without revoking or recalculating their KYC verification status.
The Exploit: A customer account with an approved kyc_status: "verified" submits a profile update altering their legal name, date of birth, phone number, and address. The server saves the new attributes while keeping the "verified" badge intact, and subsequently generates official bank statement PDFs bearing the falsified identity.
Impact: Critical violation of Bank Negara Malaysia's Policy Document on Electronic Know-Your-Customer (e-KYC) and AMLA Section 16 (Customer Due Diligence). The bank is tricked into officially certifying a fraudulent or synthetic identity, enabling money mule syndicates to open bank accounts for illicit fund transfers, money laundering, and fraudulent loan applications.
Why G4LAHAD Caught It: Most harnesses treat profile editing as standard functionality. G4LAHAD applied banking domain awareness to verify that verified identity attributes remain strictly immutable.
Sub-Cent Rounding Arbitrage (Balance Inflation)
The Flaw: The funds transfer calculation rounds fractions of a cent upwards for the recipient credit while rounding downwards to zero for the sender debit.
The Exploit: An attacker initiates a micro-transfer of $0.005 between accounts. The system debits the sender $0.00 while crediting the recipient $0.01.
Impact: Free money generation through automated rounding arbitrage. An attacker scripting thousands of micro-transfers can mint arbitrary funds directly out of thin air, causing direct financial loss and unbalancing the bank's core general ledger.
Why G4LAHAD Caught It: G4LAHAD tests financial calculations and edge-case boundaries that other harnesses overlook.
Why the Outperformance: Depth Over Speed
Most AI security tools prioritize speed or specific attack types: racing through endpoints, firing generic payloads, and running a list of "specialized exploitation agents" and declaring an assessment complete. G4LAHAD takes the opposite approach: depth over speed, context before attack.
1. Deep Reconnaissance (The Foundation of Context)
G4LAHAD spends significant time upfront strictly on information gathering and contextual mapping before launching a single attack.
Without source code, thoroughness is essential for building context in black/grey-box testing. G4LAHAD dynamically curates a target-specific baseline wordlist and systematically fuzzes HTTP methods, probing overlooked verbs and routes that human testers may skip and fast harnesses often deem inefficient.
Reconnaissance goes beyond URL discovery: G4LAHAD builds a deeper understanding of the application's roles, workflows, rules, and data flows, providing the context needed before exploitation begins.
2. Wide, Role-Aware Test Coverage (1,004 Test Cases)
G4LAHAD executed 1,004 structured, role-aware test cases across three benchmark applications, more than 4x as many as the 238 produced by the nearest candidate, Strix OSS (4.2x). For other harnesses and human-led assessments, test-case coverage often remains a black box: something you're left to guess or trust.
Higher coverage reflects both broader application coverage and deeper understanding. The more context the system builds, the more targeted tests it can derive, and this depth translates into substantially broader findings coverage.
Closing: Built for Mission-Critical Security
The benchmark results across ClaimFlow, MedPortal, and VaultBank confirm that autonomous penetration testing is ready for high-stakes, highly regulated enterprise sectors.
G4LAHAD's outperformance highlights a fundamental truth: securing modern web applications requires contextual comprehension. Finding impactful vulnerabilities means testing what truly matters to businesses: financial integrity, data privacy under Malaysia's PDPA, and robust role separation everywhere.
By pairing deep reconnaissance with exhaustive, role-aware test execution, G4LAHAD delivers the thoroughness of senior human penetration testers at autonomous speed, with full transparency and auditable proof of work, at a fraction of the cost.