About Us
At CyberStrike, we provide penetration tests and red team assessments that help organizations understand their security posture and address weaknesses before they can be exploited. Our approach combines thorough testing methodologies with clear communication, ensuring that you receive actionable insights tailored to your specific needs and allowing you to enhance your cybersecurity measures effectively!
Core Services
We offer two core services, Red Teaming and Penetration Testing. While both are designed to identify vulnerabilities, they differ in approach and scope. A pentest is typically limited to a narrow scope where the objective is to find technical vulnerabilities within that limited scope. Conversely, a red team assessment focuses on a broad scope where the objective is to simulate a real world attack. As such, red teaming focuses not only on the exploitation of technical vulnerabilities but also on avoiding detection and exploiting employees’ behaviors. Ideally, organizations should perform both types of tests.
Red Teaming
Red teaming involves simulating realistic attack scenarios to assess the effectiveness of an organization’s blue team and defensive capabilities. The blue team is typically not informed that a red team exercise is being performed to ensure that their performance is representative and accurate.
The two most common red team scenarios are full-scope and assumed breach. In a full-scope scenario, the red team typically assumes the position of an external adversary where no access has been provided. The goal is then to break into the organization through the external perimeter and compromise a certain objective, typically a domain administrator. In the assumed breach scenario, the red team is provided with some type of initial access, such as a compromised employee’s user account/workstation.
By exposing your organization to red team exercises, you can evaluate how well your defenses would withstand real-world attacks. In addition, red team exercises are also commonly required for compliance with regulatory frameworks such as DORA.
Penetration Testing
In a pentest, there is typically a narrow scope, such as a set of servers in an infrastructure test. The objective is to minimize the probability and impact of technical security issues within this scope. Determining the appropriate scope is essential for ensuring regulatory compliance and optimizing the security enhancements derived from the assessment.
Pentests are often required for compliance with regulatory frameworks such as NIS2 or PCI-DSS for companies handling card data and payments. They are also commonly conducted to obtain or maintain an ISO 27001 certification and/or to comply with Article 32 of the GDPR.
Below are examples of popular scopes for pentests that we perform. Note that it is relatively common to combine two of the below examples into one assessment. For example, it is possible to order a test of the office infrastructure together with a WiFi test. It is not uncommon to combine tests as this can ensure that the tester can continue to provide value when blockers arise. Feel free to reach out to us if you need help with scoping.
Process
Our tests are performed as follows:
• Initial contact or intro meeting – A client requests a service.
• Scope meeting – A discussion is held with the client to determine the exact scope.
• Startup Meeting – A meeting is held during the first day of the testing period.
• Testing Activities – The consultant performs the pentest or red team exercise.
• Debriefing – Identified vulnerabilities are presented.
• Report Delivery – The report is encrypted and sent over email.
Deliverable
Our report is our final product for you. Besides a description of what has been tested, it also contains a list of all identified vulnerabilities. For each vulnerability, we provide a technical background, a description and recommended mitigation steps.
Certifications
To ensure the highest quality in our work, we are committed to continuously learning new technologies and attack methods as they evolve. This dedication is reflected in the certifications held by our consultants.
Contact Us
If you are interested in our services or need guidance, feel free to email, call or submit a message using the form below. We will get back to you as soon as possible.
Contact Form
CyberStrike
Test What Matters