TLPT Threat Analysis
Threat Intelligence & Scenario Analysis for TLPT
We connect our Exposure Intelligence to actual Threat-Led Penetration Testing (TLPT).
We analyse your attack surface, the information exposed outside, and the threat actors and attack methods relevant to you, and develop them into TLPT attack scenarios suited to your organisation's actual environment. From the threat analysis to carrying out the TLPT, we do the work ourselves.
Which attackers and scenarios should our TLPT be based on?
We analyse your attack surface, exposed information and the relevant threat actors and methods, and set them out as TLPT attack scenarios that fit your environment.
Reviewed
When it fits
- A supervisor or parent company requires TLPT
You need to prepare threat-led scenarios under a set framework. We confirm the framework's requirements first and carry out the threat analysis to meet them.
- You want to test against the threats aimed at you
Even without a set framework, you want red teaming to follow the methods of threat actors who target your organisation and industry, rather than a generic attack.
- You want exposure findings carried into scenarios
You want your exposed attack surface and signs of leaks and impersonation to become the basis of scenarios that assume a real attack path.
- Last round's scenarios need updating
Your environment or the relevant threats have changed since the last TLPT, and you want the scenarios brought up to date.
What we look at
We look together at what the scenarios rest on: your attack surface, the information exposed outside, and the relevant threat actors and attack methods.
Attack surface
- Services and admin screens open to the internet
- Remote access points and connections with suppliers
- Assets whose owner is not confirmed
Information exposed outside
- Leaked staff accounts
- Organisation structure and staff details visible from outside
- Domains and brands that could be used to impersonate you
Relevant threats
- Threat actors targeting your industry
- The attack methods they have used
- Published incidents in the same industry
- Where the evidence comes from, and its limits
If leaked staff accounts and a remote access point open to the internet are both found, and threat actors targeting your industry have used that kind of route, we combine them into one scenario and make it an objective to test in the TLPT.
How it runs
Scope and framework
We agree the organisation and objectives in scope, whether a framework applies, and which part of it SAFE SQUARE takes on.
Analyse threats and exposure
We analyse your attack surface and exposed information, and the threat actors and attack methods relevant to your organisation and industry, recording where the evidence comes from and its limits.
Draw up scenarios
We combine the threats and exposure analysed into candidate attack scenarios that fit your environment, and set aside assumptions with weak evidence.
Agree and carry forward
We confirm the scenarios and objectives with you and carry them into the TLPT itself.
This analysis is carried out for each TLPT. Where your attack surface or signs of leaks and impersonation have already been examined, it starts from those findings.
What you receive
TLPT attack scenarios
Scenarios and objectives that fit your environment, with the attack path each one assumes.
The relevant threats
The threat actors and attack methods relevant to your organisation and industry, with the evidence used in the scenarios.
Sources and limits of the evidence
The source and timing of each piece of evidence, with confirmed facts kept apart from assumptions.
The exposure behind the scenarios
The attack surface and exposed information the scenarios start from, set out so you can act on them ahead of the TLPT.
Where a framework assigns threat intelligence and testing to different providers, we follow its division of roles.
How TLPT is run and what the service covers are set out in full under Threat-Led Penetration Testing (TLPT).