Red Team and Adversary Simulation
Assumed Breach Assessment
We assume the attacker is already inside and start from an employee account you provide. We show how far that account can reach into your critical systems.
What it is
An assumed breach assessment accepts that initial access will eventually occur. For the test, you provide the access a real attacker could gain through phishing or a leaked password. The focus is on privilege escalation and lateral movement inside. The result shows what compromising a single account means for your business.
Scope
- A standard employee account and a laptop or virtual desktop with your corporate image
- Permissions and trust relationships in Active Directory and Entra ID
- Passwords and keys exposed in file shares and scripts
- Paths to critical servers, backup systems, and management systems
- A timestamped comparison with the steps detected by your defense
The need
When organizations need it
- When external tests come back clean but the impact of a compromised internal account is unknown.
- After an account takeover via phishing, when you want to see if a similar path still exists.
- When you want to measure how a new EDR or identity protection product performs against an attacker already inside.
Method
How we work
-
Starting point
We determine with you which role and device to start from.
-
Discovery
We map the systems, permissions, and trust relationships visible to the account.
-
Movement
We attempt privilege escalation and lateral movement toward critical systems within approved boundaries.
-
Path review
We review with you the path to each critical system reached and the steps detected by your defense.
Outcome
What you have at the end
You see the paths from a single employee account to your critical systems. You receive prioritized permission and configuration changes to block these paths as early as possible.
Frequently asked questions
Why don't you start from the outside?
Searching for initial access from outside can consume most of the time. Accepting that an account will eventually be compromised allows the focus to be on the paths to critical systems.
Which account do we need to provide?
Usually, an account and device with the permissions of a newly hired standard employee are sufficient. A different role, such as call center or supplier, can also be selected.
How is it different from an internal network penetration test?
An internal network penetration test aims to find as many vulnerabilities in the network as possible. An assumed breach assessment measures the paths from a specific account to critical targets and whether your defense detects them.
Red Team and Adversary Simulation
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting