Reconnaissance
What a determined stranger can learn without touching you.
- Staff, roles and reporting lines from public sources
- Technology and supplier footprint
- Credentials already in breach dumps
- Physical sites and working patterns
A penetration test asks what can be exploited. This asks a harder question: if somebody decided to come for you specifically, would anyone notice before they reached what they came for? We agree one objective with your leadership - the payment system, the board papers, domain administrator - and then take whatever route works, while almost nobody on your side knows it is happening.
Coverage is explicitly not the goal. If we find three ways in and use the quietest one, the other two go into the report as observations rather than as the work. What we are measuring is not your attack surface - it is your reaction.
That means the output is a narrative rather than a list: this is what we did, in order, with timestamps, and this is what your tools recorded against each step. The uncomfortable part is usually not that we got in. It is the gap between when we got in and when anything fired.
Mapped to MITRE ATT&CK so the debrief lines up with whatever your defenders already use, and so the gaps have names.
What a determined stranger can learn without touching you.
The route a real intrusion almost always takes.
Staying in long enough to be worth the trouble.
From the first machine to the one that matters.
Proved, not taken.
The part you are actually paying for.
With your leadership, in writing, along with the rules and who on your side is in on it.
Weeks of it, usually. Nothing is touched yet.
By the quietest route that works, not by all of them.
Toward the objective, carefully, logging our own actions as we go.
Two sessions. The narrative first, then our timeline against your logs, with your defenders in the room.
Two documents and a conversation. Written so the person who signs the invoice and the person who writes the fix can both use them.
The work follows MITRE ATT&CK, TIBER-EU, CBEST and NIST SP 800-115, so the coverage can be checked rather than taken on trust, and the report maps to what your auditor or your enterprise customer already recognises.
This page is one part of our red teaming service. Where a finding needs a different kind of engagement to answer properly, we say so in the report rather than selling you the test we happen to be running.
A penetration test measures your attack surface and gives you a list to fix. An adversary simulation measures your detection and response and gives you a narrative. Most organizations need the first one every year and the second one once they have somebody watching. We have written up the difference at length.
Answer one question: who, by name, would see the alert? If you can name a person, a team or an MSSP with an escalation path, this will tell you something. If you cannot, you already know the result and the money is better spent on a penetration test and a year of getting logs in front of somebody.
Two or three. Enough that somebody senior can confirm we are us, stop the exercise, and keep it from turning into a real incident response at two in the morning. Any more and you are measuring a rehearsal.
Then the exercise has already paid for itself and we say so. We agree in advance what happens next: usually we stop, write up how we were caught, and restart from an assumed-breach position so the rest of the budget still buys you information about the inside.
No. We prove access and stop. A file is opened and screenshotted, not copied out. Everything we create during the exercise is listed in the report and removed at the end, and we will walk your team through removing anything we could not.
Tell us what you need tested. Our team will reply with a clear scope and quote.
An assistant, not a person, so check anything important with us. Please do not type passwords or card numbers here. Messages are kept so we can answer you better.