Vency Khunt

Goal: Lead an end-to-end cyber risk assessment for an Australian not-for-profit helping vulnerable people access home ownership.

Approach:

• Audited third-party risk and internal data exposure through SmartSheet integrations.
• Conducted OSINT-based external footprinting to identify exposed assets.
• Ran two structured stakeholder interviews to uncover data silos across the organisation.

Result: Delivered findings directly to the founder and board chair, producing a full Cyber Risk Assessment Report and an updated Information Security Policy.

Goal: Assess My1Health's environment for exploitable vulnerabilities and deliver a prioritised remediation plan for the engineering team.

Approach:

• OpenVAS introduced operational instability to the assessment environment, posing a risk to system availability. Substituted with Tenable Nessus Essentials and Nmap/Zenmap to maintain assessment continuity and protect client timelines.
• Ran OWASP ZAP against the web application to test for common vulnerability classes.
• Analysed findings against the OWASP Top 10, with attention to Insecure Design and Software & Data Integrity Failures.

Result: Identified SQL Injection, XSS, misconfigured permissions, and weak encryption. Delivered a structured Vulnerability Assessment Report with prioritised remediation steps.

Goal: Manage a simulated ransomware incident end-to-end and trace the initial point of compromise.

Approach:

• Conducted PCAP analysis in Wireshark to trace the initial compromise back to a phishing email, filtering on SMTP and HTTP streams to recover the malicious payload delivery chain.
• Filtered DNS query logs in Wireshark to isolate suspicious outbound queries and confirm malware beaconing patterns to an external C2 domain.
• Preserved indicators of compromise (IoCs) using Autopsy and FTK Imager, maintaining chain of custody throughout.

Result: Identified "patient zero" via phishing indicators, authored a full IR and Forensic Analysis Report, and developed enterprise-ready playbooks for Ransomware, Phishing, and Insider Threat scenarios.