        Methodology
      

No mystery. Here's exactly how it runs.

How we scope the work, the standards we follow, every phase — whether we're attacking your systems as the red team or building your defences as the blue team — and precisely what lands on your desk at the end. Read it before you ever sign anything.

        root@sploitless:~$

// Part 1 — Red team We attack. Pentests, phishing simulations and vulnerability assessments — how we find the holes before someone else does. Read the red team method → // Part 2 — Blue team We defend. SIEM, EDR, detection engineering, threat hunting and hardening — how we build defences that catch real attacks. Read the blue team method →

// Part 1 — Red team methodology

We attack. Offensive testing.

How we run penetration tests, phishing simulations and vulnerability assessments. The seven parts below cover every offensive engagement, from the first call to the final retest.

// 01 — Scoping

How we find the scope.

Scope is the whole ballgame. Too narrow and we miss the path an attacker would take; too broad and you pay for noise. It starts with a free scoping call — 30–45 minutes — where we work through eight questions together and turn the answers into a fixed, written statement of work.

You get a fixed price and timeline before anything is signed. No hourly surprises, no "it depends" invoices.

The scoping call is free and comes with zero obligation.

01 Targets & assets Exactly which apps, IP ranges, domains or people are in scope — and which are hard off-limits.

02 Test perspective Black, grey or white box — how much we know going in, and why it matters for coverage.

03 Environment Production or a staging mirror. We agree data-handling and blast-radius for each.

04 Credentials & roles The user roles we test across, so we can prove access control between accounts.

05 Rules of engagement Allowed techniques, destructive actions, and the explicit red lines we never cross.

06 Timing & windows When testing runs — business hours, out-of-hours, or around your change freezes.

07 Exclusions Fragile systems, third-party assets and anything needing provider authorisation.

08 Success criteria What a good outcome looks like for you — compliance evidence, assurance, or both.

// 02 — Test perspective

Black, grey or white box — your call.

How much we know going in changes what we find and how fast. We'll recommend a perspective in the scoping call; most clients land on grey box for the best coverage-per-euro.

Black box We start with nothing but a name — the purest simulation of an external attacker with no inside knowledge.

Grey box We're given low-privilege access and basic docs. The sweet spot: attacker realism plus the depth to test what's behind the login.

White box Full access — source code, architecture, admin credentials. Maximum coverage per day, nothing hidden by time.

// 03 — Standards we test against

We don't freestyle.

Every engagement maps to recognised, published methodologies so coverage is repeatable and defensible to an auditor — then we go beyond the checklist with manual, adversarial testing.

PTES Penetration Testing Execution Standard — the overall engagement backbone, pre-engagement to reporting.

OWASP WSTG Web Security Testing Guide — the test-by-test checklist for web applications and APIs.

MITRE ATT&CK The adversary technique matrix we map internal and red-team activity to.

NIST SP 800-115 The US standard for technical security testing and assessment.

// 04 — The phases of an engagement

From first packet to closed finding.

Reconnaissance Passive and active information gathering — OSINT, DNS, exposed assets, tech-stack fingerprinting and people. We build the map before we touch anything.

Enumeration & mapping Port scanning, service identification and application mapping. We enumerate every entry point and document the full attack surface in scope.

Vulnerability discovery Automated scanning for breadth, then manual analysis for depth. Every potential issue is verified by hand — no unconfirmed scanner output ever reaches your report.

Exploitation We safely exploit confirmed weaknesses to prove real impact. Critical findings are reported to you within 48 hours, not held back for the final report.

Post-exploitation & lateral movement For internal and red-team work: privilege escalation, lateral movement and chaining findings to show how a single foothold becomes full compromise.

Reporting Each finding written up with severity, business impact, step-by-step reproduction and a concrete remediation — plus an executive summary for leadership.

Retest & close-out You fix; we verify. Every remediated finding is retested and closed with evidence, and you receive an attestation letter.

// 05 — Rules of engagement

No surprises. Ever.

Before a single packet goes out, we sign a rules-of-engagement document together. It is the contract that keeps testing safe, legal and inside the lines you set.

✓Signed authorisation and NDA before any testing begins

✓Agreed testing windows and approved source IPs

✓Explicit list of destructive techniques — allowed or forbidden

✓An emergency stop contact reachable throughout the test

✓Third-party / cloud-provider authorisation handled up front

✓All findings data encrypted, and destroyed after the agreed retention period

// 06 — What you receive

The deliverables.

A report you can hand to the board and a report your engineers can act on the same afternoon — plus the proof a fix actually worked.

Executive summary Plain-language risk picture for leadership and the board — no jargon.

Technical report Every finding with severity, impact, reproduction steps and a concrete fix.

Remediation guidance Prioritised, actionable fixes your engineers can start on the same day.

Retest & verification We re-test fixed issues and close them with evidence — included, not extra.

Attestation letter A signed letter you can share with clients, partners and auditors.

// 07 — Severity & how we rate findings

Every finding gets a rating you can prioritise by.

Critical Immediate, serious impact — full compromise, mass data exposure. SLA: flagged within 48h

High Significant risk that a motivated attacker would readily exploit. SLA: in report + alert

Medium Real risk, usually needing a precondition or chain to exploit. SLA: in report

Low / Info Hardening opportunities and defence-in-depth improvements. SLA: in report

// Rated with CVSS v3.1 plus real-world exploitability in your specific context — not a raw scanner score.

// Part 2 — Blue team methodology

We defend. Defensive engineering.

How we build and run SIEM, EDR, detection engineering, threat hunting and hardening. The seven parts below cover every defensive engagement, from the first call to a team that owns its defences.

// 01 — Scoping

How we scope a defence.

Good defence starts with knowing what matters. In the same free scoping call, we work through eight questions about your environment, your tooling and your people — and turn the answers into a written plan with a fixed price.

You know exactly what gets deployed, what it costs and who owns it before anything is signed. No open-ended retainers you didn't ask for.

The scoping call is free and comes with zero obligation.

01 Assets & log sources Which systems, endpoints, cloud services and applications we need visibility into — and the logs they produce.

02 Current tooling Your existing SIEM, EDR, antivirus and ticketing, so we build on what works instead of replacing it.

03 Environment Cloud, on-prem or hybrid — where the platform runs and where your data is allowed to live.

04 Threat priorities The attacks that matter most to your business, mapped to MITRE ATT&CK so coverage is measurable.

05 Alert ownership Who receives alerts, who responds out of hours, and how incidents get escalated.

06 Retention & compliance How long logs must be kept and which obligations apply — GDPR, NIS2, ISO 27001 or sector rules.

07 Change windows When we can deploy agents, change policies or touch production without disrupting the business.

08 Success criteria What good looks like for you — detection coverage, response times, audit evidence, or all three.

// 02 — Engagement model

Build, co-manage or tune — your call.

How involved we stay after go-live changes the cost and the outcome. We'll recommend a model in the scoping call; most clients start with a build and keep us on for tuning.

Build & hand over We design, deploy and tune the platform, then hand it to your team with documentation and training. You own it from day one.

Co-managed We run it alongside your team — tuning detections, triaging alerts and hunting — while your people learn the platform.

Assess & tune Already have a SIEM or EDR? We review its coverage, cut the noise and close the gaps against real attack techniques.

// 03 — Frameworks we build against

Frameworks, not guesswork.

Every defence we build maps to recognised frameworks, so coverage is measurable and defensible to an auditor — then we prove it works by attacking it ourselves.

MITRE ATT&CK Detection coverage mapped technique by technique, so you can see exactly what we catch — and what we don't yet.

MITRE D3FEND The catalogue of defensive countermeasures we use to choose the right control for each attack technique.

NIST CSF 2.0 Govern, identify, protect, detect, respond, recover — the structure behind our recommendations.

CIS Controls v8 Prioritised, practical safeguards we use to harden systems and benchmark configuration.

Sigma The open detection-rule format we write in, so your detections stay portable across platforms.

NIS2 The EU directive many Cypriot organisations now fall under — we align logging, detection and response with it.

// 04 — The phases of an engagement

From first log to tuned detection.

Assessment We review your current tooling, logging and response process, and map existing detection coverage against MITRE ATT&CK. You see the gaps before we build anything.

Architecture & design We design the platform around your environment — data sources, pipelines, retention, access and alert routing — documented and agreed before deployment.

Deployment SIEM, agents and integrations rolled out in phases inside agreed change windows, starting with a pilot group so nothing breaks at scale.

Detection engineering We write and enable detections for the techniques that matter to you, each one documented with its purpose, data source and response steps.

Validation We attack our own work. Using red team techniques, we prove each detection fires on real attacker behaviour — and fix the ones that don't.

Tuning We cut false positives with exclusions and thresholds until every alert is worth a human's time — without blinding the detections that matter.

Hand-over & operate Runbooks, training and documentation so your team can run it — or we stay on to operate, tune and hunt alongside you.

// 05 — Ground rules

Your environment, your rules.

Defensive work touches production every day. Before we deploy anything, we agree together how changes are made, approved and rolled back.

✓Signed agreement and NDA before we touch any system

✓Every production change approved through your change process

✓Least-privilege access — only the accounts and permissions the work needs

✓A tested rollback plan for every agent and policy we deploy

✓Your log data stays in your environment and your chosen region

✓All our access removed and credentials rotated at hand-over

// 06 — What you receive

The deliverables.

A working defence your team can run on Monday morning — plus the evidence that it actually catches attacks.

Coverage map Your detection coverage mapped to MITRE ATT&CK, before and after — gaps made visible.

Working platform SIEM, EDR and integrations deployed, configured and documented in your environment.

Detection rule library Every detection documented: what it catches, the data it needs and how to respond.

Response playbooks Step-by-step runbooks, so whoever is on call knows exactly what to do with each alert.

Validation report Evidence that detections fire on real attack techniques — ready for auditors and the board.

Training & hand-over Hands-on sessions so your team owns the platform — not just a login.

// 07 — Alert priority & response

Every alert gets a priority your team can act on.

Critical Active compromise in progress — ransomware, data theft, an attacker on a host. Route: page on-call, contain now

High Strong signs of attack that need a human investigating today. Route: investigate same day

Medium Suspicious activity worth a look — often context, sometimes the start of an attack. Route: triage in hours

Low / Info Hygiene and visibility signals that feed threat hunting and hardening. Route: weekly review

// Priorities and routes are agreed with you and written into your runbooks — not left to a tool's defaults.

Now you know how it works. Let's scope yours.

Free call, fixed quote, zero obligation — red team, blue team or both. We'll tell you the approach, timeline and price before you commit to anything.

Book a scoping call