Sports Betting Operator
A real-world purple team engagement inside a multi-jurisdiction sports betting operator | Fully anonymised | ISO 17025 accredited methodology
ISO 17025 accredited · MITRE ATT&CK v15 · Conducted under explicit written authorisation.
Sector
Sports Betting
Engagement
Purple Team Exercise
ATT&CK Tactics
MITRE ATT&CK v15
Location
United States & Europe
Purple Team Case Studies — Gaming & Lottery
ISO 17025 Accredited
MITRE ATT&CK v15
Conducted under explicit written authorisation
Confidentiality Notice: These case studies are anonymised; any resemblance to specific organisations is coincidental.
CASE STUDY GAM-CS-04
Trading System Integrity and Market Manipulation Detection Testing — Sports Betting Operator
Testing odds feed security, trading infrastructure, and suspicious betting pattern detection under adversarial conditions
Organisation
A multi-jurisdiction sports betting operator licensed in 9 US states and 4 European jurisdictions with $1.4B in annual gross gaming revenue (anonymised)
Sector
Gaming — Sports betting, retail and online, regulated across US and EU
Location
Multi-jurisdiction — US and European operations
Engagement
Purple Team Exercise — Trading System Security, Odds Feed Integrity, and Suspicious Betting Detection Simulation
Duration
8 weeks (3-week scoping, 3-day exercise, 2-week remediation and reporting)
Frameworks
UKGC Licence Conditions | State Gaming Commission Minimum Standards (9 states) | IMGL Standards |Â GLI-33 | OWASP API Security Top 10 2023 | MITRE ATT&CK Enterprise v15
Core Challenge
The operator had received intelligence from a sporting integrity body that coordinated suspicious betting patterns on a specific league had been detected across multiple operators, with the operator’s account flagged as a potential conduit.
The engagement required testing four areas: whether a compromised trading desk account could manipulate published odds before detection; whether the odds feed from the primary data supplier could be intercepted and modified in transit; whether the suspicious betting detection system would identify coordinated wagering patterns consistent with match-fixing intelligence; and whether the operator’s regulatory reporting workflows were capable of meeting the 24-hour suspicious activity report deadline required by multiple jurisdictions simultaneously.
Engagement Phases
Trading Infrastructure Access and Privilege Testing
Mapped trading desk access controls and tested for privilege escalation from a trading analyst account. Found:Â the trading analyst role had read access to all markets including pre-match and in-play. A SQL injection vulnerability in the internal trading dashboard allowed escalation to database-level write access on the market odds table. Simulated odds manipulation on a single market was undetected for 23 minutes before the trading manager noticed a pricing anomaly.
Odds Feed Integrity Testing
Tested the data feed from the primary odds supplier for interception and modification vulnerabilities. Found:Â the feed was received over an authenticated SFTP connection. The feed processing script executed without validating the digital signature included in the feed package. A man-in-the-middle simulation that modified odds values before the signature check would pass undetected. This was a supply chain integrity failure specific to the feed ingestion pipeline.
Suspicious Betting Pattern Detection Testing
Tested the operator's trading fraud and suspicious betting detection system with a coordinated wagering simulation designed to mirror match-fixing patterns. Used 23 synthetic accounts to place correlated bets on specific outcomes across two simulated markets. The detection system flagged 3 of 23 accounts for velocity anomalies. The coordinated nature of the pattern — the actual indicator of match-fixing — was not identified.
KYC and Account Verification Bypass Testing
Tested whether synthetic accounts could pass the operator's KYC verification process. Found:Â the document verification provider returned a confidence score rather than a binary pass/fail. Accounts with a confidence score above 0.72 were automatically verified. Testing with synthetic ID documents achieved a 0.74 confidence score, bypassing manual review. The threshold had been set for conversion optimisation rather than fraud prevention.
Regulatory Reporting Workflow Testing
Tested the suspicious activity reporting (SAR) workflow against the requirements of 9 state gaming commissions and UKGC. Found: the SAR workflow was a manual process requiring the compliance director's approval. Out-of-hours testing confirmed that the compliance director was not reachable within the 4-hour escalation window. The workflow had no multi-jurisdiction template — each report would need to be prepared individually.
Detection and Response Validation
Tested the SOC detection of the trading dashboard SQL injection, odds feed modification, and coordinated account wagering. The SOC detected the SQL injection attempt in 34 minutes via database activity monitoring. Odds feed modification was not detected. Coordinated wagering pattern was not detected by the automated system — a trading analyst noticed a pricing anomaly manually after 23 minutes.
MITRE ATT&CK Detection Results
| ATT&CK ID | Technique | Detection Result |
|---|---|---|
| T1190 | Exploit Public-Facing Application (Trading Dashboard SQLi) |
DETECTED
Database activity monitoring alert in 34 minutes. |
| T1565.002 | Transmitted Data Manipulation (Odds Feed MitM) |
NOT DETECTED
Feed signature not validated at ingestion. No alerting. |
| T1583 | Acquire Infrastructure (Synthetic Account Creation via KYC Bypass) |
NOT DETECTED
Confidence score threshold set for conversion, not security. |
| T1657 | Financial Theft (Coordinated Wagering Pattern) |
NOT DETECTED
Pattern-level detection absent. Individual velocity only. |
| T1070 | Indicator Removal (Odds Modification Audit Trail) |
Partial
Database log captured change. No real-time alert generated. |
| T1078 | Valid Accounts (Trading Analyst Privilege Escalation) |
DETECTED
Database activity monitor flagged unusual write query. |
| T1590 | Gather Victim Network Information (Feed Pipeline Mapping) |
NOT DETECTED
No monitoring on feed processing script execution. |
Outcomes
| Metric | Before | After |
|---|---|---|
| Trading dashboard SQL injection | Unpatched — database write access from analyst role | SQL injection remediated — parameterised queries enforced |
| Odds feed signature validation | Signature present but not validated at ingestion | Signature validation enforced in feed ingestion pipeline |
| Suspicious betting detection | Velocity-only — coordinated patterns undetected | Network analysis layer added — correlated account betting detection deployed |
| KYC confidence threshold | 0.72 automatic approval — synthetic docs at 0.74 | Threshold raised to 0.85 — manual review queue for 0.72–0.85 range |
| Multi-jurisdiction SAR workflow | Manual, sequential, single-director approval | Multi-jurisdiction template created — out-of-hours escalation path documented |
| Odds manipulation detection time | 23 minutes — manual discovery only | Automated price anomaly detection deployed — target: 90-second alert |
| State gaming commission reports | 0 of 9 commission reports producible simultaneously | Templated workflow: all 9 reports producible within 4 hours |
“
The odds feed finding was the one that changed our supplier relationship. We had assumed the signature was being validated because the infrastructure team had implemented it. The application team had never connected the two. That gap — between what is implemented and what is actually running — is exactly what adversarial testing exists to find.
Chief Compliance Officer, Regional P&C Carrier (anonymised)
Test your sports betting security before the season starts
Strengthen your cybersecurity posture and protect your organization from evolving threats. Discover how GLI Secure reduces risk, simplifies compliance, and protects customer trust.