What we actually find: permissions, old plugins, AI leaks, and files left in public

When business owners picture a security review, they often imagine someone using esoteric zero-day exploits to break through a firewall. In practice, across small and mid-size companies in the US and Canada, the exposures that put customer data at risk are much more ordinary.

Here are the six issues that show up on our reports most often.

1. Permissions that drifted between accounts

This is the most common high-impact finding in customer portals and internal web apps. A regular customer or contractor signs in, changes an invoice number or user ID in the address bar, and sees another customer's records. Nothing was "broken into" in the movie sense—the developer simply checked that someone was logged in, not that the record belonged to that account.

Because everything works normally when you click through the menus, teams rarely catch this in QA. Our models find it by signing into multiple test accounts and systematically comparing what each role can reach.

2. AI assistants and RAG search quoting the wrong customer's data

Companies are adding AI chat and document search to their portals fast. Very often, every customer's PDFs or tickets are stored in one vector database table without filtering search results by the signed-in account. One customer asks a question, and the chatbot answers using another customer's confidential quote.

3. Private files sitting at public URLs

Audit summaries, customer CSV exports, price lists, and database backups uploaded to a public folder so a vendor or auditor could download them—and never deleted. Search engines and AI crawlers index these folders continuously.

4. Forgotten plugins and outdated frameworks

A marketing contractor installs a gallery or form plugin for a product launch three years ago. The launch page is gone, the contractor is gone, and the plugin is still active on the server, four versions behind and carrying public exploits that bots scan for every hour.

5. Staging sites and external links nobody remembers

A staging. subdomain from a 2023 redesign that still answers on the public internet with old code, or a footer link on your portal that points straight to an internal ERP login page. Even when an external host is outside your signed scope, we log every outgoing link we spot under Observed, Not Tested so you can lock it down.

Every one of these is fixable

None of these findings require a six-month security overhaul. Once you have a short report showing the exact URL, the proof, and what to change, a developer can usually close most of them in a few days—and our complimentary re-scan confirms they are shut for good. See a full sample report excerpt.