Illustration: a scan film, in point clouds, of the places a hotel or a building runs on: the hotel from the street at night, the lobby and its reception desk, a corridor of electronic door locks, the plant room, a guest room at night, the air handling units on the roof and the Cantic mark. The labels show synthetic readings and addresses.
HotelsOfficesShopping centresApartments
We break into your hotel or building before a criminal does.
From your booking engine and tenant portal to your lifts, doors and building systems. With Fortify, we write the fix within 24 hours.
Buildings and hospitality
A criminal needs only one way into your building.
Every line to the internet is a door.
Eclipse, our own model trained to attack, keeps going until it can prove full control.
In plain words: an attacker that works for your company.
How far Eclipse goes
- Website
- Apps
- Logins
- Cloud
- Servers
- Internal network
- Machines
What your business runs on
We know what hotels and buildings run on. So do criminals.
Outside firms
- Your IT provider
- Hotel software firms
- Facilities management firm
- Lift company
- Lock supplier
Remote access
- VPN
- Remote desktop
- Vendor portals
- Cloud dashboards
-
Reception
- Property management
- Card terminals
- Key card encoder
- Guest register
-
Bookings and tenants
- Website booking engine
- Channel manager
- Booking platforms
- Tenant portal
-
Rooms
- Electronic door locks
- Guest Wi-Fi
- Room climate control
-
Lobby and doors
- Access control
- Visitor kiosks
- Lifts
- Cameras
-
Plant room
- Building management
- Heating and cooling
- Energy meters
- Fire and alarms
-
Car park
- Barriers
- Number plate readers
- Pay stations
- EV chargers
Real attack
Attacks that reached hotels, buildings and the firms that run them.
-
Spain
A travel booking website in Spain
Luxury hotel stays were recorded as paid after €0.01 payments; police arrested a 20-year-old.
Sources INCIBE-CERT Escudo Digital
-
Barcelona, Spain
Barcelona City Council’s rental housing exchange
The contact details of about 6,800 people were exposed, the city council said.
Sources El Periódico ABC
-
International
BWH Hotels, a hotel group
Some guests’ names, contact and reservation details were accessed; payment data was not, it said.
Sources Security Affairs SecurityWeek
Compared
This is not a yearly pentest.
| A normal pentest | Cantic |
|---|---|
| Once a year | Day and night, and on every change |
| A PDF weeks later | Proof as it happens, with a replay |
| Stops at the website | From the website to the server and the machine |
| You work out the fix | We write the fix within 24 hours |
| You hope it holds | We attack again to check it holds |
Under your control
Inside the rules you sign.
Guardrails and data privacy for hotels, buildings and the people who use them.
Nothing runs until you sign
An authorisation and rules of engagement, signed by someone entitled to authorise the test.
Inside the limits you set
Your scope, hours and limits. It stops once it can prove control.
Stop it within 60 seconds
Rate-limited and time-boxed, so your systems do not slow down.
Every action on the record
Hashed and timestamped in a ledger you can inspect, and followed live.
A person on every critical finding
A named lead on our team.
No outside AI company sees your data
Eclipse is our own model, on our own servers.
Destroyed when the work is done
Deleted in several steps on our side; we do not keep it. First test reports: 14 days unless you subscribe.
Your IT provider gets the fix
Findings and fixes go to your own team or your IT provider.
Regulation
The rules a hotel or a building answers to.
- PCI DSS asks for penetration tests at least every 12 months and after any significant change (11.4.2 to 11.4.4). 1
- Spanish law requires hotels to keep a computer register of every guest, with how they paid, for three years. 2
- Heating and cooling over 70 kW needs an authorised maintenance company under contract, or qualifying own staff (RITE, article 26). 3
- A lift needs a contract with an authorised maintenance company, and two-way communication with a rescue centre (ITC AEM 1). 4
Questions
What buyers ask us
- What would you test?
- Your website, booking engine, tenant portal, email, VPNs, remote desktops and contractors’ logins, from the outside.
- Our contractors connect from outside. Will you test that?
- Yes, inside the scope you sign: Eclipse tries each contractor login, VPN and remote-desktop tool from outside.
- Does it help with PCI DSS?
- Yes: with Fortify we test after every change and keep retest evidence, but we do not certify compliance.
- We already have an IT company. Why you?
- Your IT company runs your systems and we attack them: two different jobs.
How it starts
Your results in one day.
You sign the rules
An authorisation and rules of engagement, signed before anything runs.
Eclipse tests what is in scope
From the outside, the way an attacker would. There is nothing to install.
We put the findings on the table
In plain words, with what to do. Every finding comes with proof.
Sources
- PCI Security Standards Council, Middlebury College, Payment Card Industry Data Security Standard: Requirements and Testing Procedures, Version 4.0.1, . Read on .
- Boletín Oficial del Estado (BOE), Real Decreto 933/2021, de 26 de octubre, por el que se establecen las obligaciones de registro documental e información de las personas físicas o jurídicas que ejercen actividades de hospedaje y alquiler de vehículos a motor, . Read on .
- Boletín Oficial del Estado (BOE), Real Decreto 1027/2007, de 20 de julio, por el que se aprueba el Reglamento de Instalaciones Térmicas en los Edificios, . Read on .
- Boletín Oficial del Estado (BOE), Real Decreto 355/2024, de 2 de abril, por el que se aprueba la Instrucción Técnica Complementaria ITC AEM 1 «Ascensores», que regula la puesta en servicio, modificación, mantenimiento e inspección de los ascensores, así como el incremento de la seguridad del parque de ascensores existente, . Read on .