ScienceSoft and an anonymised grocery retailer: security testing case analysed
Verdict: what is checkable
The evidence grade (this site's label for how a case is sourced: primary with client or press confirmation, secondary when vendor-hosted only.) is secondary: the only source is the vendor's own page; of 3 metrics, 0 are verifiable yes, 0 partial and 3 no. [ev-1712]
Client profile as published
- Client
a multinational retail chain that numbers 12,000+ stores operating across more than 30 countries in Europe, Asia, Africa and Latin America
(the vendor's description; the vendor does not name the client)- Segment
- Grocery and food
- Region
- not stated in the source
- Channels
- stores, ecommerce and mobile
- Size indicators
12,000+ stores operating across more than 30 countries
;over €100 billion in revenue
;hypermarkets, supermarkets, convenience stores, cash & carry stores
The client description and size indicators are quoted from the source; segment, region and channels are this site's classification. [ev-1712]
Systems in scope
The source names no retail system for this work.
Where the source names each system is quoted or summarised from the case page. [ev-1712]
Problem as stated
A regional branch of the retailer planned to launch several web applications for its customers. Because the applications would process customers' personal information, the retailer wanted a penetration testing provider to assess their security before release. The vendor proposed adding the website the applications interact with to the test scope. [ev-1712]
supposed to process customers' personal information(quoted from the source)
Approach
- Testing types
- security (main scope: security)
- Team shape
- not stated
- Duration
- not stated
- Engagement model
- project
- Tooling named in the source
- w3af, metasploit, BurpSuite, Qualys online scanner, web-sniffer.net
Metrics claimed
What the case does not say
- Baseline before the engagement.
- Measurement method.
- Duration over which the metric held.
- Team size on both sides.
- Cost.
- Whether the client is still a client.
- Date of the work.
Reading notes for a buyer
This case speaks to the scenario “Payments and PCI scope” and feeds dimension D8 (Compliance and security evidence) of the methodology. A question to put to ScienceSoft:
How many vulnerabilities did the test find, at what severity, and did any tested application or the website handle card data? [ev-1712]
Source and verification
- Source
- Web Applications Penetration Testing for a Multinational Retail Chain
- Published
- not dated by the vendor
- Verified
- 2026-10-30
- Evidence grade
- secondary
- Corroborating sources
- none found
| Id | Claim | Source | Class | Grade | Published | Verified |
|---|---|---|---|---|---|---|
| ev-1712 | Web Applications Penetration Testing for a Multinational Retail Chain | Web Applications Penetration Testing for a Multinational Retail Chain | vendor-case-study | secondary | 2026-10-30 | |
| ev-1713 | The Customer is a multinational retail chain that numbers 12,000+ stores operating across more than 30 countries in Europe, Asia, Africa and Latin America. | Web Applications Penetration Testing for a Multinational Retail Chain | vendor-case-study | secondary | 2026-10-30 | |
| ev-1714 | As of 2015, the retailer reported over €100 billion in revenue. | Web Applications Penetration Testing for a Multinational Retail Chain | vendor-case-study | secondary | 2026-10-30 |
Vendor profile: ScienceSoft.
Positions on this page are computed from the methodology published at /methodology/ and from the evidence records linked on this page. Case study figures are the vendor's or the client's claims as published at the linked source; the "verifiable" column states what this site could check. The site does not recommend vendors, does not accept paid placement and does not publish rates. Last computed: 2026-11-03.
Published by the editor of retailqavendors.com. Last reviewed .