Adversary Emulation |

Adversary Emulation

Rather than using theoretical scenarios or fictitious attackers, emulating specific adversaries or groups that are known to target your kind of organisation can help test that your controls are working.

Verify your defences with an adversary emulation to learn where you have opportunities for improvement.

Real-World Adversary Behaviours

We emulate adversary behaviours through specific tactics, techniques and procedures (TTPs) of groups that would target your organisation’s industry and profile, so that you can verify organisational processes, ensure tooling is performing as expected and to provide opportunities for your people to practice their response.

Time Consuming for Attackers

Our emulation activities focus on how adversaries behave and what they do, as opposed to just bypassing controls by tweaking payloads or infrastructure so detections are not triggered. We enable defenders to hone in on those indicators that are nearer the top of the pyramid of pain which are tougher and more time consuming for attackers to change, and also provide a solid signal of something malicious potentialy occurring in the environment.

Pyramid of Pain by David Bianco

Repeatable Controls Validation

We map out all of the known adversary TTPs and agree as part of the rules of engagement which activities can or cannot be executed, including what systems are out of scope. Our attack plan is created in a way that is repeatable should you want to retest and validate your controls are working as expected after they have been reconfigured and tuned.

Engagements include:

Alignment with business goals to meet organisation objectives
Clear rules of engagement with activites defined as in or out of scope
Periods identified when adversary emulation activities should not occur (e.g. beginning of the month, critical business processes etc)
Appropriate adversaries chosen based on your type or organisation and industry
Real-world TTPs conducted rather than theoretical activities
Repeatable process for your blue team to re-run after fixing defences

Key Features

Based on real world adversaries

Realistic attacks carried out just how the bad guys would execute them
Mapped to the MITRE ATT&CK Framework

Verify what coverage you have for different adversary Tactics, Techniques and Procedures (TTPs)
Purple team benefits

Collaboration between red and blue makes purple teams more effective at validating your controls
Improve your cybersecurity maturity

Gradually increase your abilities to detect, prevent and respond to different attacks
Exercises your playbooks

Allows your teams to test your playbooks as if a real incident is occuring
Foritify your defences

Confirm where you have gaps in identification, protection, detection, responding and recovering