Objective and scenario definition
A test does not begin with 'look at everything'; it begins with explicit written authorization and a defined scope. The asset worth protecting and a realistic attacker profile are established first, and the scenario follows that profile's capability. Techniques seen in your own sector take priority.
- Scope starts from an asset, not from a network range
- The attacker profile is defined by capability level
- Excluded systems and hours are written down
- An emergency stop channel exists before testing starts
Surface discovery and entry points
The externally visible surface is usually wider than an organization believes: forgotten subdomains, test environments, leaked credentials, misconfigured shares. Discovery is the first moment the inventory meets reality.
- Discovery output is compared against your inventory
- Assets missing from the inventory are reported separately
- Leaked credentials are searched in open sources
- Test environments are treated as seriously as production
Chaining the path
Findings that look low-impact alone can combine into a path that reaches the target. The simulation builds that chain: initial access, privilege escalation, lateral movement, objective. Every step is documented with evidence.
- A chain outranks individual findings in priority
- Each step is evidenced with captures and logs
- Data exfiltration is simulated, never actually performed
- Whether traces are left is agreed in advance
How the defense responded
The most valuable output is which step the defense saw. After the test, your logs are reconciled against the test log; unseen steps are marked as blind spots and become detection rule proposals.
- Test logs are reconciled with your own logs
- Every unseen step produces a detection proposal
- Steps seen but not escalated are noted separately
- Proposals transfer directly into rule authoring
