Adversary simulation
Objective-based adversary simulation: we agree the objectives, try to reach them over several weeks and measure what your detection and response do along the way. Purple mode runs the same scenarios with your defenders in the room, tuning detection as each technique is replayed.
A 45-minute scoping call, signed rules of engagement, a written note after each testing day and a report with an executive summary and one entry per finding.
45 minutes
We walk your architecture, agree what matters most and identify what must stay off-limits. There is no discovery invoice and no open-ended estimate.
Fixed quoteProposed datesWritten scope by email
1 to 2 days
Signed authorisation, escalation contacts, testing windows and traffic identifiers. If a critical issue appears mid-test we page you immediately rather than saving it for the report.
Signed RoEEscalation pathTest account provisioning
The testing days in your quote
Testing runs inside the agreed windows and carries the agreed traffic identifiers. At the end of each testing day you get a short written note of what was covered and anything found.
Daily written updatesImmediate critical escalation
2 to 3 days
An executive summary for the board, then one entry per finding with its evidence, how to reproduce it, its severity and the fix.
Full reportExecutive summaryPrioritised fix backlog
Included
A working session with your engineers to walk the findings, plus a shared channel for questions while the fixes are being built. Most disputes about severity get settled here, in front of the evidence.
Walkthrough sessionShared support channel
Red team and social engineering exercises that measure whether your staff and your detection stop an intruder before an agreed objective is reached.
Phishing, vishing and physical pretexting run against your staff, help desk and finance team, only under written authorisation that names the targets, pretexts and limits. Results are reported by channel and pretext, never by name: how far a convincing approach got, how many people reported it and how long the first report took to reach someone who acted.
Duration: 2 to 4 weeks including campaign preparation
Whether your detection and response would spot and contain a real intrusion. A penetration test covers as much of a defined scope as it can; a red team exercise pursues agreed objectives over several weeks and shows which of its steps your team detected, with the full timeline correlated against your SIEM.
No tester can promise that nothing will break, so we plan for it. Testing windows and limits on destructive tests are agreed in the rules of engagement before anything starts, and all our traffic carries an identifier your team can filter on. Where a test could write or delete data or send email, we run it against staging and confirm the finding in production only with your sign-off.
Only under written authorisation from someone entitled to give it, naming the pretexts, the people in scope and the limits. We use payload-free techniques, stop at proof of access and report by channel and pretext, never by name, with the time from the first click to the first report and from the first report to action.
We can usually hold the scoping call within two working days and start work within two weeks of a signed scope. If a deal deadline cannot wait that long, say so when you get in touch and we will give you the earliest date we can start. For an active incident, skip the scoping call and phone +972 52 613 9179.
A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.