Assumed breach test
How far can an attacker get if they already have access?
In an assumed breach test, we assume that an attacker already has access to a user account or workstation. From that starting point, we investigate how far they can get within the environment and which systems and data they can reach.
From question to insight
What we clarify
- How far can an attacker get from the agreed starting point?
- Which security measures limit or stop the scenario?
- If detection and response are in scope: which activities are detected and followed up?
When is this relevant?
Start with what you want to know.
You want to know what happens if an attacker already has access to an account, workstation or other entry point. For example, whether they can reach critical systems or sensitive data and whether suspicious activities are detected.
We first determine which scenario is relevant to your organisation. We then align the starting point, scope and depth of testing with that scenario. This ensures that the assessment addresses what you actually want to know or demonstrate.
The approach
From scenario to insight.
01
Scenario and starting point
We determine the attacker’s objective in the scenario and the starting point for the assessment. Optionally, we substantiate the scenario with threat intelligence: information about threats and methods relevant to your organisation.
02
Investigating the attack path
Our ethical hackers examine which further steps are possible. The scenario guides the test. We look at the connections between access, permissions, segmentation and the chosen objective.
03
Evidence and feedback
You receive the demonstrated attack paths, the conditions under which they worked and the measures that make a difference. If detection and response are in scope, we also discuss what was observed and followed up.
What you receive
Insight you can act on.
You receive a clear report with the demonstrated attack paths, risks and concrete priorities for follow-up. We discuss the results so that it is clear what needs attention first.
Where relevant, we also show which security measures limited or stopped the scenario. If detection and response are in scope, we include which activities were detected and how they were responded to.
Our approach
From assessment to clear next steps.
Read how we define the scope, carry out the assessment and discuss the results with you.
Discuss your assessment.
Tell us what you want assessed. We will help you find an approach that moves you forward.