Testing whether agreed objectives can be reached, and how your organisation responds
We answer ‘would we hold up against a real attack?’ with evidence from actually trying.
We set an objective worth protecting, such as customer data or a core system, and go after it as a real attacker would. It runs as an objective-based penetration test, which shows the path to the objective, or as a red team exercise, which also records how your organisation responds.
When a realistic attacker goes after an objective, how does the organisation prevent, detect and respond?
Whether the objective was reached, and where it was noticed and stopped, assessed with a record of every stage.
Reviewed
You have security tools, monitoring and response procedures, but nothing to show when someone asks ‘would we actually catch it?’
If one staff PC or account were compromised, would it spread across the company, and where along the way could it be stopped?
A real attacker does not stop at one vulnerability but chains several towards an objective. You want to see that journey, and how you respond along the way.
Your board is asking how well you would hold up against a real attack, or leadership wants a test run like the real thing, without the security team being told.
We first set an objective such as ‘can anyone reach customer data?’ and put our effort into the paths that lead there.
Analysing the threats aimed at your organisation and sector, building scenarios from them, and running the test: SAFE SQUARE does all of it itself.
Within the approved scope, phishing and social engineering, the supply chain, wireless and physical access can all be part of the scenario.
Can an attacker actually reach the objective, and by what path?
Playing the attacker, we chain weaknesses towards the objective and show, with evidence, under which conditions and by which path it was reached, or where the attempt stopped.
Would the organisation notice and stop an attacker going after the objective?
We act as a real attacker going for the objective, and record and assess, stage by stage, when your organisation notices and how it stops and responds.
To train and fix detection technique by technique together with your defenders, see Purple Teaming & Detection Exercises, part of Security Capability Development for People & AI.
We run it to that framework's requirements, led by threat intelligence.
Scenarios built from the threat intelligence relevant to you, run as a red team exercise to test detection and response.
We analyse your attack surface, exposed information and the relevant threat actors to give the TLPT scenarios their basis.
We agree with you the objective and scope, and how much your defenders are told in advance.
We prepare realistic attack scenarios for the objective we have set.
Playing the attacker, we move towards the objective and record, at each stage, what we did and how the organisation reacted.
Afterwards we go through the attack record and the response record with the teams involved.
We set out what to strengthen and, if you wish, check again after changes are made.
Keeping it safeWhere an attempt could affect operations, we go ahead ready to stop it at once.
The paths taken, how they unfolded over time, and whether the objective was reached or where the attack was stopped.
What was actually blocked, detected and reported at each stage, and how your organisation responded.
Where detection and response need strengthening, and what to check again after changes are made.
Starting point: one ordinary staff PC · Defenders: only the head of security and the approver know in advance
| Stage | Result | Evidence |
|---|---|---|
| From the staff PC to the business servers | Got through | The business servers’ admin pages were open to staff PCs on the same office network. |
| From a business server to admin rights | Got through | Every server used the same admin account, so rights on one carried straight over to the others. |
| From admin rights to the customer database | Stopped | The database sat in a separately controlled zone, so even admin rights could not reach it. |
| Detection along the way | Needs work | Use of admin rights was logged but raised no alert, so nobody noticed while it was happening. |
The response assessed here is prevention, detection and response in the cyber-attack scenarios set for the test. Whether ransomware could halt your operations and block recovery is examined in Ransomware Resilience Validation.
Related research: Offensive Engineering (EXPLOIT) — We research ways to analyse and verify vulnerabilities and their impact from an attacker's perspective.
