Reproducible. Defensible. Uncomfortable.
One repeatable spine: six phases, aligned to PTES and NIST SP 800-115 and mapped to MITRE ATT&CK. The sequence a real adversary follows, run in the open and evidenced at every step.
- Phases
- Pre-engagement + six
- Aligned to
- PTESNIST SP 800-115
- Mapped to
- MITRE ATT&CKMITRE ATLAS for AI
- Retest
- Included
Automation, AI and people. Together.
Each instrument does what it's best at. None ships a finding alone.
Automation
Machine-scale coverage no person could do by hand.
AI
Ranks, de-duplicates and kills false positives early.
People
Confirm, chain, prove. A human signs off every finding.
Six phases. Zero shortcuts.
Every phase produces evidence; nothing advances on a hunch.
- PREOSSTMM 3
Pre-engagement
Signed rules of engagement, scope boundaries, escalation contacts, blackout windows and an evidence-handling procedure. Nothing starts until it's in place.
- 01PTES · NIST 800-115
Reconnaissance
Passive OSINT and active surface mapping. Every subdomain, leaked credential and forgotten environment your asset inventory missed becomes part of the model.
- 02NIST 800-115 · OWASP WSTG
Enumeration
Service fingerprinting, stack detection and permission-boundary mapping. We build the target model a real adversary would work from.
- 03PTES · NIST 800-115
Vulnerability analysis
Scanning, configuration review and dependency analysis, then AI triage at machine scale and human confirmation of what's real.
- 04PTES · MITRE ATT&CK
Exploitation
Working chains, not scanner output. Adversary emulation aligned to MITRE ATT&CK, with every finding proven end to end.
- 05PTES · MITRE ATT&CK
Post-exploitation
Lateral movement, privilege escalation and blast radius: what could be reached, kept or taken once the perimeter falls.
- 06PTES · NIST 800-115
Report & retest
An executive narrative and technical proof, prioritised by exploitability and business impact rather than CVSS alone. One retest included.
Non-negotiables.
Evidence, always
Can't reproduce it? It isn't reported.
Name the instrument
Automation, AI or a person: every finding says which.
Two audiences, one report
Impact for leadership. Reproduction and fixes for engineers.
Defensible under audit
Mapped to NIST, OWASP, MITRE, ISO, PCI DSS or HIPAA.
Openly named.
You'll know exactly what touched your systems.
- Recon
- Web & API
- Network
- Cloud
- AI & LLM
Nothing here is invented.
Every finding traces to a published standard.
- Offensive
- AI
- Risk & governance
- Regulatory
See it run on your scope.
A 60-minute scoping call. A fixed scope and price within five business days. No obligation either way.