We break in first.

Weeks before anything touches your perimeter, we build the picture from open sources: org structure and staff from public profiles, forgotten dev and staging subdomains, supplier relationships, and how your service desk verifies a caller. All of it is public; none of it is intrusive.

op:~$ subfinder -d corp.example -silent | httpx -sc
gitlab-dev.corp.example        200
jenkins-legacy.corp.example    200  # stale, still resolving
vpn-uat.corp.example           401
op:~$ # staff enumerated, photo badges visible in public posts

Passive by design — your logs stay quiet through the whole of recon.

Access usually comes through people, not software. Depending on what recon surfaces, that's a tailored pretext to the help desk, a targeted phish, or an MFA-reset call. The routine never changes: borrow a process that genuinely exists so the request feels ordinary.

Knowledge-based verification is not verification.

Inside, we set up quiet command and control: aged, categorised infrastructure, egress over channels you already permit, long sleep and jitter so a beacon reads as background noise. Then we watch what your telemetry captures — and what it lets through.

[+] beacon check-in  host=WKS-04  user=CORP\j.doe
[+] integrity=medium  edr=running  score=benign
[+] egress=doh:443  jitter=37%  sleep=180s

Telemetry you don't read is telemetry you don't have.

From one host we map the paths that matter: delegation misconfigurations, stale service-account passwords, credential reuse. Domain admin is rarely an exploit — it's usually a short chain of small, individually fixable oversights.

op:~$ findDelegation.py -target-domain corp.example.local
PRT-SRV-04$   Unconstrained   ServerTrustAccount
op:~$ # svc_backup — password unchanged for years — cracked in seconds
[+] domain admin via a chain of small misconfigurations

The fix is almost always cheaper than the finding.

We build lures from processes that already exist in your business — a customs hold, a payroll correction, a missed voicemail — sent from domains aged and warmed so they clear your gateway. Generic lures test filters; specific lures test people.

A warmed, aligned domain beats a clever subject line.

We send in controlled waves and measure what your controls actually do — what reaches the inbox, what the external-sender banner changes, what gets quarantined. Delivery is rarely where a campaign is stopped.

The external-sender banner alone rarely changes behaviour.

We watch a site the way an intruder would: shift changes, patrol cycles, propped fire doors, badge artwork readable from the car park. Most of what defeats a building is learned from outside it, with patience rather than tools.

Most entries are planned in a car park, not a lab.

The way in is rarely the front door. A wedged fire exit, a smoking-shelter door, a group drifting back from break — we tailgate on a routine that already exists and carry ourselves like we belong.

A perfect turnstile is not the only way in.

Legacy proximity badges clone in seconds, often straight through a jacket. A cloned low-frequency badge tends to open every internal reader in the building — the technology, not the person, is the weakness.

A 2006 badge is a copied badge.

We reach the agreed objective — usually a comms room or server cabinet — with a lock bypass or an under-door tool, then place a rogue device on an unfiltered port to prove persistence. Network access control ends where the cable begins.

Access control ends where the cable begins.