CASSPT case studies
CASSPT · Put your knowledge to work in context.
The CASSPT is a professional certification exam focused on security analysis and threat assessment practice. It is aimed at practitioners who already work with security operations, architecture, or risk functions and want a credential that tests applied judgement across the full security lifecycle rather than a single tool or vendor product. The CASSPT case studies are 5 cases and about 4,121 words.
1Prioritising Two Critical Findings with One Sprint of Capacity
Your team runs vulnerability management across an estate of 1,850 servers and 6,200 endpoints. The scanner reports 12,400 open findings, and policy sets remediation SLAs at 7 days for CVSS critical and 30 days for high.
830 words, about 4 min2Per-Tenant Keys and Isolation for a Multi-Tenant SaaS Platform
You architect a multi-tenant SaaS platform for 40,000 tenants on shared PostgreSQL with row-level security keyed on tenant id, deployed in three regions. Ninety-four percent of tenants are small; twelve enterprises generate 60% of revenue and each has negotiated different security terms.
836 words, about 4 min3Enforcing Artifact Signing Without Stopping Delivery
Your organisation runs 120 repositories on GitHub Actions, 14 product teams and about 60 production deploys per day. Build jobs assume a long-lived AWS access key stored as an organisation secret and print environment variables on failure; three leaked credentials have appeared in build logs in the past 90 days, the most recent used to read a staging S3 bucket containing masked test data.
764 words, about 4 min4Token Theft and 800 GB Out the Door at 02:40
At 02:14 UTC on a Tuesday, EDR alerts on a developer laptop for LSASS access by an unsigned binary; the analyst isolates the host at 02:26. At 02:40, cloud detection fires: a service principal authenticates from an ASN in a country where the company has no staff, MFA was satisfied, and Graph calls enumerate storage accounts.
851 words, about 4 min5Renewing a High-Risk Vendor in 21 Days
A health insurer with 3.2 million policyholders is 21 days from auto-renewing a claims-management SaaS contract. Annual spend is 2.1M, termination notice is 90 days, and the vendor holds 1.4 million records including claim narratives and dates of birth.
840 words, about 4 min