Penetration Testing
Manual, objective-driven testing of web applications, APIs, and networks (internal, external, wireless, and physical), built on hands-on consulting experience since 2018, not a scanner with a report template.
Service 08
Assumed breach assessment
Phishing works. Credentials leak. Sooner or later someone gets a foothold. An assumed breach assessment skips the part you already know is possible and answers the question that actually matters: what happens next?
Overview
The problem we are solving
We start from an agreed foothold, typically a standard domain user account on a standard corporate workstation, the same access a successful phishing email would hand an attacker. From there, testing follows the paths a real intruder would take: discovery, credential access, privilege escalation, and lateral movement toward the objectives agreed during scoping.
Starting inside is deliberate. It spends your budget on the controls that limit damage once prevention fails (segmentation, privileged access, identity hygiene, and detection) rather than on proving a perimeter can eventually be breached.
Unlike the five-day Rapid Assessment, which works through a fixed checklist of common Active Directory weaknesses, an assumed breach assessment is objective-driven and open-ended within its scope. It follows whatever path your environment actually offers, including cloud identity, SaaS, and the systems that hold the data you care about most.
Coverage
What we test
Scope is agreed up front; these are the areas an engagement typically covers.
- Foothold & initial discovery
- What a standard user can see and reach: network segments, shares, directory data, internal applications, and credentials left where they should not be.
- Identity & Active Directory
- Kerberos and ACL abuse, delegation flaws, certificate services (AD CS) misconfiguration, and paths from a low-privilege user to domain or enterprise admin.
- Credential access
- Credential harvesting from endpoints, memory, scripts, and shares; password reuse; and how far a single set of stolen credentials actually travels.
- Lateral movement & segmentation
- Movement between workstations, servers, and network zones, and whether the segmentation on your diagrams holds up against someone already inside.
- Cloud & hybrid identity
- Pivoting from on-premises identity into Entra ID, Microsoft 365, and connected SaaS, and the trust relationships that tie them together.
- Detection & response
- Which actions your monitoring saw, which it missed, and how long it took to notice, documented step by step so your defenders can tune against real activity.
Methodology
How the engagement runs
-
01
Scoping & objectives
Agree the starting foothold, the objectives (domain admin, a specific database, an executive mailbox), stealth expectations, and who on your side knows the test is happening.
-
02
Foothold & discovery
Testing begins from the agreed account and device, mapping what is reachable and building a picture of the identity and network relationships in your environment.
-
03
Escalation & lateral movement
Controlled privilege escalation and lateral movement along the most realistic paths toward each objective, with every step logged and timestamped.
-
04
Objective verification
Access to each objective is demonstrated safely and documented, without exfiltrating real data or disrupting production systems.
-
05
Reporting
Attack paths written up as narratives, ranked findings with evidence, and a timeline your defenders can line up against their own logs.
-
06
Debrief & validation handoff
A live walkthrough with infrastructure, identity, and security operations teams, with validation steps for every finding so your team can confirm fixes on its own.
Deliverables
What you receive
- Attack path narratives from initial foothold to each objective
- Full technical report with ranked findings, evidence, and reproduction steps
- Timestamped activity log for comparison against your detection and response tooling
- Executive summary naming the controls that would have stopped or slowed the attack
- Validation steps for every finding, so your team can confirm and close out each fix on its own
- Live debrief with technical teams and leadership
Aligned to
- MITRE ATT&CK
- Penetration Testing Execution Standard (PTES)
- NIST SP 800-115
- Microsoft Securing Privileged Access
Questions
Frequently asked
How is this different from the Rapid Assessment?
The Rapid Assessment is a fixed five-day check against a known list of common Active Directory weaknesses. An assumed breach assessment is objective-driven: it follows whatever paths your environment actually offers toward the goals we agree on, including cloud and hybrid identity, and it measures detection along the way.
Why not just test from the outside?
External testing answers whether someone can get in. Assumed breach answers what they can do once they are in, which is where most of the damage in real incidents happens. Many clients run both, and external testing is available as part of a broader penetration test.
Should our security team know the test is happening?
Either works. A fully informed team gets a collaborative exercise; an uninformed team gets a realistic measure of detection and response. We usually recommend that at least one trusted contact knows, so a real incident is never confused with the test.
How do you get the initial foothold?
Usually you provide it: a standard user account and a corporate laptop or VDI session, configured like any other employee's. It is the fastest and most controlled way to start, and it keeps the engagement focused on what happens after compromise.
Related
Often scoped together
Rapid Assessment
A fixed-price, five-day internal network assessment focused on the quick wins and heavy hitters (the handful of issues that give real attackers their first foothold) at a fraction of what the larger firms charge for the same depth.
Get started
Ready to scope assumed breach?
Scoping conversations are free and usually take twenty minutes. You will speak directly with the consultant who would do the work.
Request an assessment
or reach out directly, (608) 520-0719 sales@infocus-security.com