Testing security where sensitive health data is at stake.
Jiji Health operates claims-processing and customer-facing platforms that handle sensitive member health and claims information. Seraph Cyber was selected to conduct a comprehensive security assessment across applications, APIs, infrastructure, cloud controls and attack-path validation.
Depth of testing. Discipline in execution.
Jiji Health required security assurance across systems handling sensitive and regulated information while maintaining confidentiality and avoiding disruption to services. The assessment needed to go beyond vulnerability scanning and evaluate technical weaknesses, business logic, infrastructure controls and realistic attack paths.
- Claims-processing platforms handling sensitive health data
- Regulated information requiring strict confidentiality
- No disruption to live services
- Depth beyond automated scanning — business logic & attack paths
Our Approach
Application Security
Static and dynamic testing of applications, API security testing and business-logic testing focused on claims-processing workflows.
Data Protection
Review of personal and health-data handling against the Kenya Data Protection Act.
Infrastructure Security
Assessment of cloud configuration, identity and access management, patching, backup and recovery, third-party access and monitoring.
Penetration Testing
Internal and external penetration testing, including controlled attempts to validate privilege escalation and lateral movement.
Red Team Exercise
Controlled simulation of data exfiltration followed by a red-team exercise against agreed objectives.
Every finding backed by evidence.
Findings were supported by screenshots, logs and proof-of-concept steps and mapped to recognised approaches including OWASP, NIST Cybersecurity Framework and CIS Controls. After remediation, Seraph returned to retest identified issues and provide a clear pass or fail position. Critical findings were communicated immediately.
One assessment. Two levels of decision-making.
Plain-language explanation of business risk, priorities and required action.
Detailed evidence and remediation information for the IT team.
A validated security picture, without disruption.
The engagement provided Jiji Health with a validated security picture across applications, APIs, infrastructure, cloud security and attack paths while maintaining confidentiality and avoiding service disruption.
“What mattered was rigour and discretion, and Seraph delivered both.”
Evidence before conclusions.
Validate
Confirm technical findings before presenting them as material risk.
Escalate
Communicate urgent findings during the engagement rather than waiting for final reporting.
Explain
Give technical teams the evidence they need while giving leadership clear business context.
Verify
Where included in scope, retest remediation to confirm whether the issue has actually been resolved.
Put your security controls to the test.
Talk to Seraph Cyber about assessing your environment, validating technical risk and building a clear path to remediation.