Platform-first. Operator-backed.
Autonomy gives you coverage. Operators give you certainty. The people who review your critical findings are the same people who run full engagements, inside the platform, with the same evidence standard.
- Operations
- OP-204
NightfallRed team
OP-204 · Now 02:58 UTCObjectives
2 of 4 reached- Open the VPN administration console as a standard userReached
- Read tenant data through the legacy API with an expired tokenIn progress
- Operations
- Active
NightfallRed team
OP-204 · Now 02:58 UTCObjectives
2 of 4 reached- Open the VPN administration console as a standard userReached
- Read tenant data through the legacy API with an expired tokenIn progress
- Scope3 domains, 2 ranges
- Window22:00 to 06:00 UTC
- PaceLow
- Non-destructiveOn · no data changed
The same operators who review your findings run the engagements.
Nothing gets lost between a platform and a provider.
- Operations
- On call
- Reviewing
- PR-0917
- Evidence
- Reproduced 3 of 3
- Operation
- OP-204 · Nightfall
- Critical findings reviewed
- 3 this week
01
Red Team Operations
Test the whole organisation: people, process and technology.
Objective-based operations that test your people, process and technology the way a real adversary would.
What we do
- Objective-based operations against agreed crown jewels
- Assumed-breach and insider scenarios
- Social engineering and, where in scope, physical intrusion
02
Threat Intelligence
Know what is coming before it arrives.
Know who is likely to target you, how they operate, and what that means for your defences, before it matters.
What we do
- Actor and campaign profiling for your sector
- Attack-surface and exposure monitoring
- Leak and credential exposure monitoring
03
Adversary Emulation
The attacks that matter, replayed with precision.
Intelligence-led campaigns that replay the threat actors most relevant to you, mapped to MITRE ATT&CK.
What we do
- Threat-actor profiling and scenario design
- ATT&CK-mapped emulation plans
- Detection engineering validation
04
Strategic Advisory
Clarity at the top. Change on the ground.
Board-level clarity on cyber risk, and programmes that turn findings into lasting change.
What we do
- Security strategy and roadmaps
- Board and executive advisory
- Programme design and measurement
How operators work with the platform
Review
Every critical finding is checked by an operator before it is raised.
Live- Findings
- PR-0917
CriticalVerifiedPR-0917Admin panel reachable from the internet
91vpn-02.brackwell.exampleAKReviewed by AKReproduced 3 of 3Engage
Red team operations, emulation campaigns, intelligence briefings and advisory are scoped, run and reported in the platform.
Live- Operations
- Active
- NightfallRed teamRunningAKOP-20422:00 to 06:00 UTC62%
- Harbour driftEmulation campaignScheduledAKOP-205Starts 28 Oct0%
- Clear skiesRetest batchCompleteRSOP-198Completed 24 Oct100%
Rules of engagementScope, window, pace, non-destructive4 of 4Stay
Operators remain through remediation and retest.
Use ours. Use yours. Or both.
Live- Findings
- PR-0917
- PLT-412
PLT-412Jira · Platform teamSynced#sec-platformSlack · thread with evidence- 25 Oct · 23:40
Fix deployed. Retest queued for the next Pursuit window.
- NextRetest scheduled
A passing retest closes PLT-412 in Jira and PR-0917 in Saluki.
Mean time to fix3.2 dDown 0.4 dAKOn the ticket