Cyberattack simulation

Entry runs through a person (T1566.002, Spearphishing Link) or through a service on the perimeter that nobody remembers anymore. After that it’s about time: privilege escalation, logging in under valid accounts (T1078), movement through the network over remote services (T1021), collecting credentials, and a quiet advance toward the objective. We record every action with a timestamp, so you can compare it afterward with what your SIEM caught.

The command and control (C2) infrastructure is the set of servers we use to communicate with the foothold inside your network. We build it again for every operation, with its own domains and certificates, because shared infrastructure can be spotted from indicators left by other campaigns. The way that communication looks is exactly what your detection is supposed to catch.

We prepare the human entry vector as a targeted message to a handful of people, not as a mass send. When you want to measure employee behavior at volume and follow up with training, that is what a phishing campaign as the entry vector is for; it is planned separately and has different metrics.

The third way in leads through the building, and this operation doesn’t cover it. The break-in and what can be done from inside covers it, and it can be ordered as the second layer of the same operation. The physical layer hands over at the access gained on site and the cyber layer continues from there, so the whole path gets measured, not just the half of it that happens remotely.

Assume breach is the variant that skips the entry from outside: the operation starts with access to one ordinary workstation, as if the phishing had already worked. That saves the preparation of the entry, and the whole scope goes to what follows: escalation, movement through the network, and above all the response of your defense. A separate glossary entry holds the full definition of assume breach and how it differs from similar terms.

It pays off in two situations. Either you already know an attacker will get to you through a person and you don’t want to pay to have that proved again. Or you have been through the full scenario once and now want to measure the shift in detection, the part where improvement comes fastest.

The attack timeline is a table where each row has a time, a technique per MITRE ATT&CK (say T1558.003 Kerberoasting or T1550.002 pass-the-hash), the tool used, and the system affected. Next to that, three columns that matter most: whether an alert was raised, whether anyone noticed it, and how long that took.

That table is also the only honest way to measure your defense after an operation. A row without an alert means a missing log or detection switched off. A row with an alert nobody noticed means a problem in the process, not in the technology. Those are two completely different fixes, and without the timeline they can’t be told apart. It is also the best evidence that you have checked detection and response in practice, not just in a policy. If you need that evidence for regulatory reasons, first check the obligations under NIS2 and the Czech Cybersecurity Act, because they differ depending on which regime you fall into.

We have also written up the techniques we go after in the Active Directory domain, including how each of them is closed. The difference from an internal test is that here the point is to stay unseen, so we choose slower and quieter variants.

Because speed is the opposite of stealth. A tool that scans the network in an hour will reliably produce an alert, and then you are no longer measuring detection but noise. We go step by step, with pauses and with techniques that hide in ordinary traffic, which is exactly what a real attacker with a long-term interest does.

The length then follows the size of the company. More people, more sites, and more systems mean a longer open-source intelligence (OSINT) phase, more possible ways in, and a longer path to the agreed objective, so the range runs from one month to four. The phases are the same every time: OSINT and scenario preparation, building the C2 infrastructure, the covert operation, and finally the report. An overview of what can be found out about a company in advance shows how much work goes into that first step.

When you don’t have central log collection and someone who reads the alerts. The operation measures detection and response, so without them you pay to find out that nobody caught you, which you know already. Start with an internal test that makes sense to do first: it finds specific holes and they get fixed more cheaply.

The second case is companies that don’t have an agreed objective yet. Without a definition of what your crown jewels are, the operation dissolves into a general hunt for vulnerabilities. That is settled as the first step, and the red teaming page describes the rules of engagement and the agreement on the objective.

TLPT, that is, threat-led penetration testing, is advanced testing introduced for the financial sector by the Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554), and what DORA requires of the financial sector is covered in a separate article. The Czech National Bank (CNB) joined the European TIBER-EU framework in September 2024 and runs the TIBER-CZ program under it for entities critical to the Czech financial system. Who may carry out such a test is set by the Regulation itself: Article 27 requires the vendor to hold accreditation in a Member State or to follow a formal code of ethics, to provide independent assurance on the management of test risks, and to carry professional indemnity insurance. The process is prescribed, the CNB takes part through its test manager, and the CNB may invalidate a test for recognition purposes.

Our operation is methodologically similar, but it is not a test under TLPT or under TIBER-CZ, and we don’t offer it as one. If you need one for regulatory reasons, check the conditions directly with the Czech National Bank (in Czech). Far from every financial entity falls under TLPT: the obligation applies only to those the supervisory authority selects under Article 26 of the Regulation, in the Czech Republic mainly other systemically important institutions. For everyone else, inside the financial sector and outside it, an ordinary red team operation is a cheaper and faster route to the same information: how long it takes you to notice an attack.