Keep the content
on the platform.

TPN is a content-security programme run by the Motion Picture Association and the Content Delivery & Security Association — closer to an ISO 27001-style controls audit than a penetration test, but it has a strong technical-testing component. The current programme uses the TPN Content Security Best Practices (MPA Common Guidelines plus the Application & Cloud Security Guidelines that landed alongside TPN+) and a self-reporting platform with a TPN-Assessed badge for vendors who pass an independent assessor review. Studios increasingly require either a TPN-Blue (self-attested) or TPN-Gold (assessor-validated) posture before approving a vendor for pre-release content. AxVeil runs the application and cloud pentest aligned to the TPN Application & Cloud Security Guidelines, hands back a TPN-mapped report and works alongside a TPN-Authorised assessor where the studio mandates Gold.

Seriously enough that downgrade and policy-misconfiguration findings remain the dominant root cause of pre-release leaks. The common failure modes are: license-server policies allowing L3 (software-only Widevine) on a stream that should require L1 (hardware-backed), HDCP enforcement disabled or downgraded to v1.4 in the manifest, robustness rules not enforced on iOS/Android (FairPlay key-rotation interval too long, persistent license TTL excessive), missing watermarking on the L3 fallback path, and clear-key fallback left enabled in non-production environments that the CDN nevertheless serves. The pentest exercises every player, every device class (browser, native iOS, native Android, smart-TV / Roku / Fire TV / tvOS / webOS / Tizen, Chromecast) and every fallback path, then walks the license-server policy logic against the studio's release-window requirements.

Three layers. First, the login, account-recovery and concurrent-session surfaces — rate limiting per IP, per email, per device fingerprint, per ASN; concurrent-stream enforcement at the manifest and license-server layer; geo-velocity heuristics; MFA enrolment friction on suspicious sessions. Second, the bot-management layer (Akamai, Cloudflare, DataDome, HUMAN, Imperva, Kasada) exercised against the modern bypass kit — residential-proxy networks, CAPTCHA-solving APIs, headless-browser fingerprint randomisation, mobile-app reverse-engineered tokens. Third, the credential-marketplace blast radius — gift-subscription transfer, stored-payment abuse, churn-prediction signal leakage. The OWASP Automated Threat Handbook (OAT-008 credential stuffing, OAT-007 credential cracking, OAT-019 account creation) is the structural reference. The report quantifies estimated ARPU recovery per control rolled out.

Ad-tech is the supply-chain attack surface in modern media — every SDK on the player or app and every tag on the web property is a third-party trust delegation. The engagement runs four workstreams. (1) SDK inventory across iOS, Android, smart-TV and web — version, vendor, permissions requested, network destinations, on-device behaviour against a residential-proxy capture. (2) ads.txt, app-ads.txt and sellers.json conformance plus SupplyChain object validation per OpenRTB 2.6 / IAB Tech Lab spec, to constrain spoofed inventory. (3) SIVT (sophisticated invalid traffic) signal review against MRC accreditation expectations — bot-driven impressions, domain-spoofing, app-bundle-ID spoofing, geo and viewability fraud. (4) Header-bidding wrapper and prebid configuration review — same-origin tag injection, lazy-load timing abuse, demand-partner script integrity. Findings are mapped to the IAB Tech Lab supply-chain standards and to the relevant MRC measurement guidelines.

COPPA (US Children's Online Privacy Protection Rule, with the FTC's 2025 amendments tightening verifiable parental consent, retention and third-party-disclosure obligations) for any service directed to under-13 audiences or where actual knowledge of an under-13 user exists. EU GDPR plus the UK GDPR, with the ICO Age-Appropriate Design Code (Children's Code) for any service likely to be accessed by children in the UK. India DPDP Act 2023 plus the 2025 Rules, which prohibit behavioural tracking and targeted advertising to children and impose verifiable parental consent. FTC Act Section 5 unfairness and deception standards for the US adult-audience services, including the FTC's 2024 amplified focus on dark patterns in subscription-cancellation flows. PCI DSS v4.0.1 for any direct card handling in the subscription billing flow (most operators outsource to a tokeniser and stay SAQ-A, but the engagement validates that the SAQ-A assumptions actually hold).