The Offensive Kill Chain

The methodology follows the offensive kill chain end to end, so no phase of a real attack goes untested and every step is captured for the client report. Coverage maps to MITRE ATT&CK automatically.

The phases

• Reconnaissance: map the attack surface, external footprint, assets, identities and exposure, before a single packet in anger.
• Initial access: find and prove the way in, from exposed services and weak edges to phishing footholds.
• Execution: run payloads and tradecraft safely, with output captured straight into the engagement record.
• Persistence: establish and document footholds the way a real adversary would, so nothing is missed.
• Privilege escalation: escalate on the host and across the domain, credential paths and misconfigurations alike.
• Lateral movement: pivot across the network toward the crown jewels, tracked target by target.
• Exfiltration & impact: demonstrate impact on target data, controlled, evidenced, and never destructive.