Assumed Breach Testing
Are your pen test results the tip of the iceberg? Let’s help you dig a little deeper.
A fresh approach to security testing
Is testing your web apps or network enough anymore?
We’ve observed a growing demand for more realistic penetration tests, based on an assumed breach model and using real-world attack scenarios.
Our clients want to know more than simply whether their network perimeter is secured.
- How about if it isn’t?
- What would happen if a hacker could bypass security and enter your internal network?
This is where assumed breach and scenario testing steps in. Intrigued? Let’s give you the rundown.
Are you concerned that you’re not getting the big picture when it comes to your pen test results? Fear not. We’re here to remove the blinkers.
Ready to achieve your security goals? We’re at your service.
Whether you are a CISO, an IT Director or a business owner, Equilibrium has the expertise to help you shape and deliver your security strategy.
Gain deeper insights
Assumed breach testing begins from a ‘compromised system’
From there, we determine whether the attack could spread laterally throughout your IT ecosystem.
It can help answer your burning security questions:
- Could a hacker gain access to other privileged systems and sensitive data?
- If so, how far could they go?
- What impact could this have on our business operations?
The test will reveal how effective your security is beyond your perimeter, and how easily an attacker could move around once they’re in.
Service Features
Assumed Breach Approach
Using the tactics, techniques, and procedures of real adversaries, we simulate an attacker who has already gained access to your systems.
Real-world Attack Scenarios
Using attack paths hackers are likely to use, we can verify the effectiveness of your detection and response once a breach has occured.
Threat Modelling
A threat modelling approach helps us understand the key threats you face. We can then tailor the scope of testing around these key areas.
Threat mapping
Understand how threats could travel through your infrastructure. Get insight into how and where hackers could move to once access is gained.
Prioritising security risks
We address high-risk threats and attack vectors which threaten the security of your most sensitive information.
Security needs layers
Gain deeper insight into the risks you face and how you handle an attack. We can then develop a defence in depth strategy to defend against them.
Why choose us as your penetration testing partner?
- CREST Accredited Penetration Testing Company
- OSCP Certified Penetration Testers
- Providing surface level insights isn’t enough for us. It’s our job to get to the nitty-gritty.
Our penetration testing process
Before developing your scope, it’s helpful to consider where your most critical data is stored (not just an application or your internal network). A narrow scope will lead to limited insights. Think about your overarching security goals and the realistic threats you face. You can then create firm parameters that will lead to valuable insights.
We run scoping workshops before each of our pen testing engagements. We encourage all relevant members of your team to attend. These sessions allow us to gain insight into your business, understand high priority areas, key timeframes and gather the information required to create a well defined scope.
Using a range of multi-coordinated methods used by real-life hackers, our qualified testers will manually assess your internal systems from an assumed breach position. This will identify security weaknesses which could allow cyber-criminals to access privileged data.
In this phase we will interpret the results, and (if permitted and approved) exploit any vulnerabilities discovered. This will determine whether a hacker could use the vulnerability as leverage to gain wider access to your systems. However, many customers prefer to patch and remediate, rather than risking the potential service disruption that exploitation could cause.
After remediation, we can retest your systems to check that all patches have been applied and security holes have been mitigated.
Our experts will analyse the results and present the findings in a comprehensive penetration testing report. This includes a non-technical executive summary which can be presented to the board. It will detail and categorise the vulnerabilities discovered ranked as either ‘Critical, High, Medium, or Low’, as well as outline instructions of how to remediate, patch and strengthen your defences.
What's the benefits?
Get more Valuable Insights
We won’t focus testing on one element of your IT ecosystem. To get a clearer picture of your security, we embody the same objectives as real attackers.
Threat focussed approach
Understand threats in context. We assess the impact of high risk threats and the compromise of your most critical assets on business continuity.
Enhance Your Strategy
The findings will help develop a smart approach to respond to security risks, so you can allocate the necessary resources to protect assets.
Let's Get the big picture
By knowing the big picture,
you have the insight needed
to build a security strategy
you have confidence in, and
will stand the test of time.
How can we help?
No one wants a tunnel vision view into cyber resilience. When it comes to security insights, we believe every brand deserves to know the big picture.
We like to think we run our testing services like a well-oiled machine. We’re always looking for ways to hone our processes, sharpen our skills and dig deeper on scoping calls.
Our services go beyond the scope of traditional pen tests. We help understand threats in context, and how your security would handle a realistic attack.
- Risk and threat focussed penetration testing
- An assumed breach approach
- Multi co-ordinated methods
- Scenario based testing
- Defence in depth strategy
Frequently Asked Questions
Often, the scope of traditional penetration tests is too narrow, as they may only test just one aspect of your IT ecosystem. An attacker’s motivation is always to accomplish something, whether that’s stealing credit card details, encrypting data, or leaking sensitive emails.
For an attacker, getting access to your network is just one step in that process. To gain more insights into your overall security, ethical hackers should embody the same objective as real attackers would.
The test will reveal how easily an attacker could move around once they’re in.
There is still real value in standard penetration testing. They can help you identify vulnerabilities in your systems and learn how to fix them. However, by focussing solely on testing your network perimeter, will lead to blind spots in the findings of the assessment.
A test with such a narrow scope ignores the other security weaknesses which could allow an attacker to achieve what they set out to. All without your network perimeter even being breached.
Whether you are a large enterprise or an SME, security weaknesses can develop for any number of reasons across your IT ecosystem.
This could be down to out-of-date-software, security misconfigurations, new applications, or an unprotected BYOD. But if you can discover and remediate these issues before the bad guys do, you will be in a much stronger position to safeguard your brand.
Though some companies conduct pen tests on an ad-hoc basis, we don’t recommend undertaking CREST penetration testing as a one-off activity. To remain cyber-resilient, it’s important to have a proactive approach to tackling emerging threats.
Every day businesses face internal changes to their systems and network. Whether this is opening a new office, deploying a new security solution, installing new hardware or moving to the cloud. Each of these changes has the potential to introduce a security risk which could be exploited by cyber-criminals.
So how can you mitigate this? This is where penetration testing steps in!
Vulnerability scans identify a list of known vulnerabilities in your IT systems, whereas penetration tests involve exploiting security weaknesses to determine whether a hacker would be able to gain access.
Penetration tests are labour intensive and require interaction and analysis from a dedicated security professional. On the other hand, vulnerability scans are typically automated and test for a list of pre-discovered security holes.
Our team of penetration testers are with you every step of the way of your testing journey.
We don’t disappear for days and suddenly emerge with a report, leaving you to pick up the pieces. You can rely on us to be there before, during and after testing. Communication is key to building our strong customer partnerships.
Which is why we never leave you in the dark, provide timely updates on vulnerabilities and actionable guidance to help you remediate against tight timeframes.