For defence manufacturers and subcontractors, government IT and services suppliers, and dual-use technology companies
Suppliers to defence and government are targeted for what they hold and for who they can reach: drawings, specifications and source code, and trusted connections into their customers. We test the edge devices state-backed groups exploit, the identity systems they abuse once inside, and how controlled information is kept apart from the rest of the business.
State-backed groups want long-term access: to design data, export-controlled technical information and the email of people working on sensitive programmes, and to the remote access a supplier holds into a prime contractor or a ministry. Losing that information can cost a contract or a security approval, and an intrusion your customer discovers before you do is harder still to explain.
A joint FBI, NSA and CISA advisory (AA22-047A (opens in a new tab)) describes Russian state-sponsored actors targeting large and small US cleared defence contractors from 2020 to 2022, in part by exploiting a known Fortinet VPN flaw (CVE-2018-13379) to harvest credentials. Edge devices like these usually sit outside endpoint monitoring, so the intrusion stays invisible until the attacker moves inward.
Targeted messages built from conference attendee lists, professional networking profiles and procurement notices, often posing as a recruiter, a journal or a partner company. The aim is a foothold on a workstation that can reach design data.
Once inside Microsoft 365 or Google Workspace, attackers add mailbox rules, register their own authentication methods or consent malicious applications, and keep reading mail long after a password reset.
Smaller subcontractors and the managed service providers that run their IT are used as stepping stones into larger targets. One shared admin account or an unrestricted remote management tool can expose every customer at once.
Controlled data copied to personal storage, unmanaged laptops or collaboration tools outside the authorised environment. Carelessness has the same consequences for the contract as malice.
Contractors handling Controlled Unclassified Information for the US Department of Defense work under CMMC 2.0. Level 2 is the 110 security requirements of NIST SP 800-171 Rev. 2, assessed by an authorised C3PAO where certification is required, and Level 3 adds 24 requirements from NIST SP 800-172, assessed by the government's own assessors. NIST CSF 2.0 binds no one until a contract, regulator or government policy adopts it; where one does, a test is evidence for ID.RA-01 (vulnerabilities identified, validated and recorded) and ID.IM-02 (improvements drawn from security tests and exercises). In the EU, public administration is among NIS2's sectors of high criticality.
The scoping call settles which of these apply to your systems.
Internal and external network testing, including Active Directory. Where scope allows we go from an unauthenticated foothold to domain-wide impact and document the whole chain: the exposed service or sprayed credential that got us in, each privilege escalation on the way, and the accounts and hosts it reached.
Duration: 5 to 12 working days
Objective-based adversary simulation: we agree the objectives, try to reach them over several weeks and measure what your detection and response do along the way. Purple mode runs the same scenarios with your defenders in the room, tuning detection as each technique is replayed.
Duration: 3 to 6 weeks
An IAM-first review of AWS, Azure or GCP. We map what an attacker reaches after compromising one workload or one developer laptop, then rank those paths by the data at the end of each and write the Terraform or policy change that cuts it.
Duration: 4 to 8 working days
Phishing, vishing and physical pretexting run against your staff, help desk and finance team, only under written authorisation that names the targets, pretexts and limits. Results are reported by channel and pretext, never by name: how far a convincing approach got, how many people reported it and how long the first report took to reach someone who acted.
Duration: 2 to 4 weeks including campaign preparation
Hands-on help when an attacker is already inside: triage on the first call, containment that does not destroy evidence, forensic scoping of what was touched, and recovery that we verify before calling it complete. Outside a crisis we run retainers, tabletop exercises and compromise assessments, so your team has practised the first hour before it happens.
Duration: Live incidents until recovery is verified; readiness work in days
It supports certification but does not replace the assessment. Level 2 certification assessments are performed by an authorised C3PAO against the 110 requirements of NIST SP 800-171 Rev. 2. A test beforehand shows whether the controls you will claim (access control, boundary protection, audit logging, incident response) hold up against someone trying to defeat them, while there is still time to fix what fails.
Yes. The rules of engagement name the systems in scope, the accounts we use and where evidence may be stored, and evidence is handled to your requirements: encrypted at rest and destroyed on a schedule you set.
With the external perimeter and your cloud email tenant, because that is where the joint FBI, NSA and CISA advisory on cleared defence contractors (AA22-047A) shows state-sponsored actors getting in, then the separation between controlled information and everything else. A focused network and Microsoft 365 test against those questions gives you findings to fix before an assessment, in far less time than a full red team exercise.
We pick the checks that apply to your systems and the frameworks you answer to. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.