Case study · Security testing
Find the weaknesses before attackers do.
Leading penetration testing across an airline’s website, mobile app and booking APIs, from scoping and rules of engagement to verified fixes.
EmploymentLow-cost airline ecommerceMiddle East
The challenge
Airline channels
are a target.
An airline’s website, app and booking APIs handle payments, personal data and loyalty accounts every minute of the day. That makes them an obvious target, and a security failure costs money, trust and regulatory attention.
At a major Middle East low-cost carrier, Ross led a penetration testing programme across these channels as the airline’s Senior Manager eCommerce. Independent specialists did the testing. His role was to make sure the right things were tested, without disrupting sales, and that every finding led to a verified fix.
The approach
Test like an attacker.
Fix like a team.
Security testing only helps if it covers the right channels, avoids disrupting sales and ends with fixes that are verified.
Scope the channels.
Map what customers and attackers can reach: the website, mobile app, booking and payment APIs, the content management system and the CDN in front of them.
Commission independent testers.
Engage a specialist security firm and agree rules of engagement that protect live booking traffic, including timings, environments and escalation contacts.
Triage the findings.
Rank each finding by severity and by its risk to bookings, payments and customer data, and agree an owner and deadline for each.
Fix and retest.
Drive the fixes with engineering teams and third-party vendors, then retest to confirm each issue is closed.
What changed
Stronger channels, with evidence.
The airline gained an independent view of its digital channels and a tracked path from each finding to a verified fix.
A clear picture of risk
Findings across web, app and APIs, ranked by what mattered most to customers and revenue.
Fixes that were verified
Issues were closed and retested rather than assumed fixed.
Security in the roadmap
Security work became part of ecommerce planning rather than a one-off audit.
This was employment at the airline, not Alpha Digital Group client work. Testing was carried out by an independent specialist; the findings remain confidential and the airline is not named.
Ross’s role
Employment
As Senior Manager eCommerce (employment), Ross led the programme: scoping, vendor management, prioritising fixes with engineering and retesting.
Published October 2026 · By Ross Brannigan
A potential collaboration
Test your digital channels.
For airlines and travel businesses that need to scope, commission and follow through on security testing of their websites, apps and APIs.
- A testing scope across web, app and APIs.
- Specialist selection and rules of engagement.
- A remediation plan, tracked to verified fixes.
Related case studies
More from the work.
- Faster pages. Faster fares.Using AI-assisted analysis, Lighthouse and Firebase app data to find where an airline’s website and app were slow, and to improve speed from the booking engine to the CDN.Read the case study
- Search visibility. Security intact.Improving the foundations for Google and Bing discovery while maintaining Cloudflare security. Practical work across Next.js, Astro, crawling and measurement.Read the case study