Offensive security for casinos

We show you exactly how players steal from you — then we close the door.

Cage Research simulates real exploitation of loyalty programs, digital wallets, and guest systems to quantify revenue loss before adversaries do.

Get a walkthrough ↗

What we test

Targeted assessments built around how money actually moves through casino and hospitality systems.

Flagship

Loyalty & Wallet Abuse Assessment

Account enumeration, credential attacks, wallet manipulation, comp exploitation — with dollar-value impact estimates for every path.

Physical + Digital

Mobile Key & NFC Access Testing

Hotel lock bypass, badge cloning and relay attacks, BLE pairing exploitation, kiosk and terminal abuse vectors.

Reservation Systems

PMS & Check-in Exploitation

Reservation manipulation, ghost bookings, check-in bypass, comp abuse through PMS inconsistencies and API flaws.

Full Scope

Custom Red Team Engagement

Casino floor to backend pivot. Player account to loyalty to comps to room. Device to BLE to internal network.

Attack narrative, not vulnerability report

Every engagement produces an exec-readable exploitation story with real financial impact — not a CVSS dump.

01

Enumerate valid loyalty accounts

Discover exposed endpoints and valid account identifiers at scale.

02

Take over or create synthetic accounts

Credential attacks, PIN brute force, or synthetic identity injection.

03

Manipulate wallet, comps, and free play

Exploit promotion logic, wallet balance flows, and comp issuance paths.

04

Convert to real-world value

Room nights, food credits, cash equivalents — quantified in dollars lost.

3-Page Executive Summary

Designed to make leadership uncomfortable. Clear exploitation paths with estimated monthly revenue impact.

Step-by-Step Attack Path

Every finding documented as a narrative — how the attack works, what it costs you, and what to fix first.

Technical Appendix

Full proof-of-concept evidence and remediation guidance for your security and engineering teams.

See how the money moves.

We'll walk through real attack paths against systems like yours — no pitch deck, no sales call, just the exploitation.

contact@cageresearch.com