One goal, and whether you notice.
Most breaches start with a person, not a server. We pick an objective, such as reaching your payment system, and pursue it the way a determined attacker would: through your people, your premises and your systems. The question is not only whether we get there, but whether your team sees us and responds.
- Price
- Set in your written proposal
- You receive
- The attack step by step, mapped to MITRE ATT&CK, with what was detected, what was missed, results by team and the fixes.
Scope, timeline and price in writing before any work starts.
The routes we use. Agreed in writing first.
- 01
Email phishing
Campaigns built around your real suppliers, tools and routines, from broad mailings to targeted messages.
- 02
Phone and SMS
Calls and texts that test help desks, finance teams and the processes for resetting passwords and changing bank details.
- 03
Multi-factor authentication
Whether staff approve prompts or share codes they did not request.
- 04
Physical entry
Doors, reception, badges and unattended devices, tested by testers carrying a signed authorization letter.
- 05
Technical attack
The same techniques as our penetration tests, used quietly toward one goal.
How an exercise runs. Controlled throughout.
- 01
Objectives
One or two goals agreed with a small control group on your side, who can stop the exercise at any time.
- 02
Campaign
Days to weeks of work across the agreed routes.
- 03
Detection review
For each step, whether your tools alerted and your team responded.
- 04
Debrief and awareness
A session with your defenders that replays the attack, and short training built from the exercise’s own examples.
Questions, answered.
01Red team or penetration test?
A penetration test finds as many weaknesses as possible within a scope. A red team tests whether your people and tools notice a real attack. Most companies need regular penetration tests first.
02Will employees be named?
We report patterns by team and technique, not individuals, unless you ask otherwise and your employment and privacy law allows it.
03Do you store the passwords people enter?
No. Our pages record that a password was entered, not the password.
Know where you stand before an attacker does.
Tell us what you run and what worries you. We will come back with a scope, a timeline and a price.