Genius is a recruitment technology and talent communications specialist founded in 2009 and based in Skipton, North Yorkshire. The company works with organisations to transform how they attract, engage, and hire talent, combining creative employer branding with purpose-built recruitment technology.

At the centre of its technology offering are two core web applications: iQATS, a platform that helps organisations attract, assess and hire talent through attractive vacancy advertisements, skills-based recruitment assessments and other integrated system tools. Then we have AndMe, a platform that supports new employees from the point they accept an offer through the early stages of employment. Together, these applications form part of a connected recruitment ecosystem designed to improve both candidate and employee experiences while supporting employers throughout the hiring journey.

As part of its ongoing security programme, CodeShield performs annual penetration testing against both web applications. The iQATS platform comprises three interconnected components. The candidate-facing interface allows job seekers to discover vacancies, create accounts, submit applications, and upload supporting documents. The administrative backend enables recruiters and platform administrators to manage candidates, configure the platform, handle communications, and generate reports, including AI-assisted functionality. A dedicated partner interface provides controlled, role-based access to relevant areas of the platform.

Alongside this, the AndMe platform enables organisations to guide new employees through the onboarding process, providing secure access to information, tasks, and communications before and after joining the business. Together, these applications process significant volumes of personal information on behalf of employers and therefore require regular independent security validation.

As Genius expanded its technology products into larger enterprise organisations, the security standards expected of both applications continued to increase. Customers increasingly required evidence of regular independent penetration testing as part of their supplier assurance processes. For platforms handling candidate and employee personal data, demonstrating an ongoing commitment to security became both a commercial requirement and an operational priority. The iQATS platform’s architecture presented a broad surface for assessment. It exposes functionality to unauthenticated users, standard authenticated users, and administrators across all three components, with distinct permission sets and data access rights at each level. The administrative backend in particular, with its access to user management, platform configuration, file imports, and AI-assisted functionality, warranted close attention to ensure that the privileges it granted were protected by controls appropriate to that level of access.

Genius required a penetration test that would examine all three components systematically across all relevant user roles and deliver findings that were actionable for the development team. The engagement also needed to be conducted by a testing partner able to demonstrate the professional accreditation increasingly required by enterprise clients and public sector procurement teams.

When evaluating testing partners, Genius identified CREST accreditation as a key requirement. CREST is the professional body for technical information security, and its accreditation framework operates at two distinct levels: company-level accreditation, which assesses an organisation’s processes and quality standards, and individual-level certification, which requires each tester to pass rigorous technical examinations to demonstrate their personal competence. The distinction matters in practice. A company may hold CREST accreditation whilst employing testers who hold no individual certification, meaning the person actually conducting the assessment has not been independently evaluated against a professional standard.

CodeShield holds CREST accreditation at the company level, and the consultants who carry out client engagements hold individual CREST certifications. For Genius, this combination was important. It meant that the tester assigned to the engagement would bring demonstrated, independently verified technical expertise to the work, and that the outcome of the assessment could be evidenced at the level of the individual who conducted it rather than simply the firm behind them. This carried real weight in conversations with enterprise clients and procurement functions that scrutinised the credentials behind the testing, not just the name of the company on the report.

The scoping process was efficient and direct. Each year, CodeShield works with the Genius team to agree the scope of testing across both web applications, defining the relevant functionality, user roles, and communication expectations before the engagement begins. This collaborative approach ensures the assessment remains aligned with product changes while providing consistent security assurance year after year.

Across the annual assessments, CodeShield has identified findings spanning authentication controls, session management, access control, and security hardening across both web applications. Each issue is documented with a clear explanation of the associated business risk and practical, prioritised remediation guidance. Reports are written to support both the development teams responsible for implementing fixes and the leadership teams responsible for demonstrating security assurance to customers and procurement stakeholders.

The engagement also confirmed a number of meaningful security strengths within the platform. Multi-tenant data separation was correctly implemented and held firm throughout testing. User accounts followed the principle of least privilege, with permissions appropriately scoped to each role. Account lockout controls provided effective protection against automated credential attacks. These observations were documented alongside the findings to give Genius an accurate and balanced picture of the platform’s security posture, rather than a list of issues in isolation.

Through annual penetration testing of both its platforms, Genius maintains an independently validated view of its security posture while demonstrating its commitment to protecting customer data. Regular assessments by CodeShield’s individually CREST-certified consultants provide ongoing assurance for both the development team and enterprise customers, helping support procurement requirements and ensuring security keeps pace with the continued evolution of the platforms.

TRUSTED UK PENETRATION TESTERS

At CodeShield, our UK penetration testing team brings 20+ years of combined expertise delivering practical, results-driven security solutions tailored to your business.

Get a FREE penetration test quote today