Five stages, run as one continuous operation
This is not a longer penetration test. It is a kill chain assembled the way a real group assembles one, which is what makes the probability of a successful targeted attack against you measurable.
Collecting initial data
Reconnaissance and perimeter discovery
We assess the feasibility of an attack the way an external group would: open sources, media and conference material, and private darknet resources for data about you that has already been compromised. The perimeter is scanned for exploitable vulnerabilities and configuration flaws in network devices, internet-facing services and applications.
Infrastructure penetration
Getting inside, by whichever route is weakest
The goal is to reach as many internal segments as possible, including those of subsidiaries. Once inside a segment we study what is reachable and escalate. Your named contact is told which resources were reached, so you can suspend work on a host or segment if our actions risk operational consequences.
Lateral movement
Expanding control quietly
Control is extended across the infrastructure towards the agreed objectives, escalating privileges on critical systems or taking the domain outright, while keeping our presence as hard to spot as possible.
Attainment of objectives
Reaching what you told us would hurt
Objectives are yours to define during approval. They are stated in business terms, and the route to them is our problem to solve.
Blue team response analysis
Measuring what your defence actually did
Logs from your security tooling and surrounding infrastructure are analysed against everything we did, and your response is assessed against your own internal standards and international practice. This is the part that changes how you operate.
Vulnerability classes assessed on the perimeter
The operation is objective-led, but the perimeter work underneath it is systematic. These are the classes we test for on the way in.
Rules of engagement
Primary targets are listed by you before work begins. Anything that could cause a malfunction or other negative consequence is agreed with your representative first. You designate a point of contact and we recommend you hold a current backup of the systems in scope.
What you receive
Complete information about every action taken, the attack methods used, the defects found, the results of exploiting the most critical of them, and objective evidence demonstrating each one. Zero-day findings are given to you and, with your agreement, to the vendor.
Work that sits either side of it
Penetration testing
Do this first. There is no point being covert against a perimeter with unpatched public services.
Phishing simulation
Initial access usually starts with people. Measure that continuously and separately.
Managed SOC
A red team measures detection once. A SOC is what turns the findings into standing capability.