Adversary emulation
Everything I've written on adversary emulation, with the research pieces first. Each one ends with something you can do on Monday.
Dealing with one of these problems yourself? I work with organizations that need answers, not another slide deck. Let's talk.
What's in a five-angle short
Most subjects here are one page with five short sections, always in this order. Each has its own colour inside the article so you can jump to the one you need.
- 1Where I'd start: the first move I'd make, and the question I'd ask before spending anything.
- 2Where plans fail: where plans on this subject usually break, and the assumption I'd test first.
- 3Beyond the jargon: what the subject actually means once the vendor language is stripped out.
- 4What good looks like: the result that would tell you it worked, and the number I'd watch.
- 5The call leaders can't dodge: the decision leadership has to own, and what it needs on the table to make it.
-
Adversary emulation isn't a pen test. Here's the difference
Both involve attacking your own environment. They answer different questions, and buying one when you need the other is a common waste.
-
Attack-path validation
I would not begin attack-path validation by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one...
-
Cloud attack emulation
I would not begin cloud attack emulation by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one...
-
Control validation
I would not begin control validation by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sce...
-
Credential abuse simulation
I would not begin credential abuse simulation by buying another platform or launching a large programme. I would find the boundary, the accountable owner, an...
-
Cyber range scenarios
I would not begin cyber range scenarios by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one ...
-
Lateral movement detection
I would not begin lateral movement detection by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and...
-
MITRE ATT&CK mapping
I would not begin MITRE ATT&CK mapping by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one s...
-
Phishing exercises
I would not begin phishing exercises by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sce...
-
Purple team workshops
I would not begin purple team workshops by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one ...
-
Red team scoping
I would not begin red team scoping by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scena...
Nothing matches. Try another word, or ask me directly.