What a normal user can see
The answer is usually far more than anyone intended.
- Shares, drives and document stores
- Internal applications without further login
- Domain and host enumeration
- Credentials sitting in scripts and files
Full-scope red teaming spends a large part of the budget getting in at all - and if your perimeter holds, you have bought an expensive confirmation of that and learned nothing about the inside. Assumed breach skips the argument. We are handed a normal user account, or a laptop on your network, which is exactly where a phishing email or a bought credential leaves somebody. Everything after that is the part you wanted measured.
Every statistic on initial access points the same way: somebody will eventually click, or a credential will be bought, or a supplier will be compromised. Spending a third of a red team budget proving that again is a poor use of it.
So we assume it has happened and measure what follows. In most environments the honest answer is domain administrator inside a day - not because anything was unpatched, but because of how Active Directory was configured years ago and never revisited. That is a finding you can act on, and it is the one that decides how bad a bad day gets.
The same sequence a real intrusion follows once somebody is inside, mapped to MITRE ATT&CK.
The answer is usually far more than anyone intended.
The currency of everything that follows.
Usually the shortest path in the whole exercise.
Host to host, zone to zone.
What an attacker would actually leave with.
Recorded as we go and compared with your logs at the end.
Which account, which machine, and what is out of bounds.
Enumeration first, before anything is attacked.
From a normal user to whatever the environment allows.
Toward the data you asked us to try for.
The route, the fixes in priority order, and a free retest of the ones you close.
Two documents and a conversation. Written so the person who signs the invoice and the person who writes the fix can both use them.
The work follows MITRE ATT&CK, NIST SP 800-115 and PTES, so the coverage can be checked rather than taken on trust, and the report maps to what your auditor or your enterprise customer already recognises.
This page is one part of our red teaming service. Where a finding needs a different kind of engagement to answer properly, we say so in the report rather than selling you the test we happen to be running.
It is a cheaper one that answers the more useful question for most organizations. The part it skips - getting in from outside - is the part your penetration test already covers and the part real attackers find easiest.
An ordinary one. A new starter in a non-technical role is ideal, because that is who gets phished. Giving us an administrator account measures nothing except how fast we can type.
No, and there is usually nothing for them to notice. There is no phishing campaign and no pretext calling unless you ask for it, so this can be run without any internal communication at all.
Yes, in almost every case. We work from a VPN account, a virtual machine on your network, or a small device we ship to you and somebody plugs in. That keeps the cost down considerably for clients outside Pakistan.
We will not give you a number, because a firm that promises one is telling you what it wants to be true rather than what it has found. What we will say is that in most environments we have tested it takes less than the client expected, and the cause is almost never a missing patch.
Tell us what you need tested. Our team will reply with a clear scope and quote.
An assistant, not a person, so check anything important with us. Please do not type passwords or card numbers here. Messages are kept so we can answer you better.