Offensive Testing & Validation

Use Cases

Our engagements ultimately help reduce the risks and impacts of cyber incidents by testing and validating your attack surface and suggesting remediation to limit your exposure and harden your assets. In-scope assets could be applications, middleware, networks, devices, and even people.

Catalog

We offer a full range of standardized consulting services available as standalone engagements or through a prepaid retainer (10 to 50 service units). The scope for each service is fixed and includes defined outcomes; however, we can work with you to reasonably customize the scope if needed.

The Service unit value (1 Service Unit=5 hours) and sizing - (S)mall, (M)edium, (L)arge - listed in this catalog are based on your organizational or network infrastructure size and are subject to adjustment based on the specific engagement objectives and desired outcome.

All services in this catalog, including related communication and documentation, are delivered in English, remotely or on-site. Local language options may be available. Please, engage with us to get more details on the service descriptions.

Security Assessment

• Active Directory Security Assessment (S:10; M:20; L:40)
• Entra ID Security Assessment (12)
• Password Cracking and Analysis Assessment (4)
• Threat Hunting Assessment (S:10; M:18; L:24)
• Vulnerability Assessment (S:4; M:8; L:12)

Application Security Assessment

• Custom Application Security Assessment (S:16, M:24)
• Mobile Application Security Assessment (8)
• Secure Code Analysis (S:10, M:16, L:22)
• Web Application Security Assessment (S:8, M:12, L:16)
• Web Service/API Test (S:8, M:12, L:16)

Penetration Testing

• External Penetration Test (S:8, M:16, L:32)
• Internal Penetration Test (S:8, M:16, L:32)
• Physical Security Testing (16)
• Wireless Network Penetration Test (8)

Specialized Testing

• Device Penetration Test (16)
• Laptop Penetration Test (8)
• Medical Device Test (16)
• SAP Penetration Test (16)

Phishing & Vishing Drill Testing

• Phishing Drill - Click and Log (S:8; M:16)
• Phishing Drill - Credential Capture (S:16; M:24)
• Vishing Drill (S:8; M:16)

Red Teaming & Adversary Exercises

> cf. separate service description in the SOC pillar

• Adversary Emulation Exercise (red team, TI led)
  
  • Adversary Exercise Lite (S:32, Extra Time: 8 per week
  • Adversary Exercise Standard (M:64, Extra Time: 8 per week)

• Adversary Simulation Exercise (red team, Full spectrum)
  
  • Adversary Exercise Lite (S:32, Extra Time:8 per week; Physical security attacks (1 location): 16; Wireless (1 location): 8)
  • Adversary Exercise Standard (M:64, Extra Time:8 per week; Physical security attacks (1 location): 16; Wireless (1 location): 8)

Automated Security Validation

> cf. separate service description in the SOC pillar

• Breach & Attack Simulation
• Automated Penetration Testing
• Continuous Threat Exposure Management

‍

‍