Assumed Breach Assessment

No, an assumed breach assessment is not a discounted red team engagement. It answers a narrower question and answers it better. Skipping initial access is a decision to spend the entire budget on lateral movement, privilege escalation and reaching the objective, which is where most estates actually fail.

The premise is that at sufficient scale and over sufficient time, somebody gets in. Treating initial access as solved for the purposes of the test answers the question that determines the size of an incident, which is how far the intruder gets afterwards.

It is shorter and it costs less because the first phase is removed, not because the work is lighter. Every step from the granted foothold is recorded as an attack path you can read afterwards.

If you are unsure, grant a standard user account on a managed laptop for the assumed breach assessment. It models the scenario that occurs most often, a phished employee, and it is the position from which the answer is most likely to surprise you. The decision is yours and it should reflect the threat you actually worry about.

Standard user on a managed laptop

The blast radius of one ordinary person clicking once, with your endpoint controls in the way. Shows whether your EDR changes the outcome or only the timeline.

Contractor or supplier access

A compromised third party with a live connection. Measures supply chain reach, and is the right test where a supplier connection is material under the ISR.

Privileged service account

A leaked automation credential. Shows how far non-human identity reaches, which is rarely mapped.

Network access only

A planted device or a compromised IoT endpoint. Shows what is reachable before any credential exists at all.

Either choice is valid for an assumed breach assessment, and it changes what the engagement measures. Because there is no covert initial access phase, the test can run with your Blue Team aware or unaware, and we ask you to decide before the starting position is agreed.

Blue Team told

The engagement becomes a coverage exercise. You get maximum visibility, a collaborative session, and each technique can be run again after your analysts tune. It is the purple shape, and it builds detection content fastest.

Blue Team not told

You get a genuine measurement of whether lateral movement is detected, which is the phase most detection programmes have never tested. Only a small white team knows, and it holds the authority to halt the test.

Most detection tuning is aimed at the perimeter. If your open question is what happens after the perimeter has already failed, the unaware version answers it.

An assumed breach assessment typically takes three to six weeks including reporting, against six to ten weeks for a full red team engagement. The difference is the removed initial access phase, not lighter work inside.

The six steps above set the order: agree the starting position, name the objective, establish and enumerate, escalate and move, reach the objective, then report and close. Enumeration from the granted position is usually the first surprise of the engagement and often comes in the first days.

The engagement is time-boxed against the objective, not against a list of hosts. If we reach the objective early, the remaining time goes on alternative paths rather than on stopping, because one route tells you less than knowing there are four.

No, an assumed breach assessment is run on production without damage, because nothing is encrypted, deleted or genuinely exfiltrated, and no production change is made without written agreement. Access to the objective is proved and evidenced, never exercised destructively.

Every artefact we create is logged in an artefact register: accounts, tooling, files and any configuration touched. At closure the register is walked through with you and each item confirmed removed, so nothing we placed is left behind unrecorded.

If something unexpected happens we stop, and the people on your side who know the test is running hear within minutes on a channel that does not run through anything being tested. Anything affected is restored with our help and the incident goes in the report.

Reaching the objective in the first week of an assumed breach assessment is a finding, and an important one. It means the path from an ordinary account to your crown jewel is short, and the report says so with the full attack path graph.

The engagement does not stop there. The remaining time is spent testing alternative paths from the same starting position, because a single route we happened to find first tells you less than knowing there are four, and the order of the steps is the finding.

Where the Blue Team was not told, the early result also says something about detection of lateral movement, which is then walked through step by step in the detection observations.

Sometimes an assumed breach assessment satisfies a regulator asking for a red team exercise, and it depends on the wording. Where the requirement is about detection and response to a full-spectrum attack from outside, an assumed breach engagement covers part of it and a full-scope red team covers the rest.

Where a supplier connection is material, as under DESC supplier scope, starting from that supplier's level of access is exactly the right test and often the more useful one. The four UAE regimes, CBUAE, ISR, ADHICS and the UAE IAS, word the expectation differently, and the fit is decided by the clause, not by the label.

Bring us the clause and we will tell you plainly whether an assumed breach assessment fits, in writing, instead of assuming it does. If it does not, we say so before a proposal goes out.

An assumed breach assessment tests lateral movement and privilege escalation by taking the granted position and working toward the named objective the way an intruder would, using legitimate services and trust rather than exploits wherever possible. Every step is mapped to MITRE ATT&CK as we go.

Internal reconnaissance and credential access

What a normal account can enumerate: shares, group memberships, service accounts and trust relationships. Then cached credentials, service account secrets, certificate templates and the tokens in memory on shared hosts.

Lateral movement and privilege escalation

Movement between hosts using legitimate services, which is the traffic that looks least like an attack. Local escalation on a host, then domain escalation, including the AD CS paths most estates have never assessed.

Segmentation and objective access

Whether the boundaries between corporate, restricted and OT segments hold under a credentialed attempt to cross them, and then reaching the specific system or dataset you named without altering anything.

No, social engineering is not part of an assumed breach assessment. People are out of scope because the test starts from the position a successful phish or a stolen laptop would have produced, so there is nothing to gain by phishing again.

Physical access is also out of scope, unless the granted position is itself a physical one such as a planted device on the network. In that case the device is placed by agreement, not by an operator talking their way past reception.

Process is very much in scope. The engagement tests credential lifecycle, privileged access management and whether joiners and leavers are handled the way the documentation says they are.

The deliverables of an assumed breach assessment are the attack path graph, the detection observations, technical findings with owners, and the artefact register confirmed clean at closure. The graph is the centre of it, because the order of the steps is the finding.

The attack path is delivered as a graph rather than a list, drawn from the granted position to the objective so the choke points are visible. Each technique carries its MITRE ATT&CK identifier, so the result drops into the coverage view your risk function already reports against.

Where the Blue Team was not told, the detection observations record what your controls saw, what alerted and what was actioned at each step. The pack is walked through with you at closure, and a purple session can follow to turn each gap into detection content.

The starting position of an assumed breach assessment is agreed in writing and is not widened without your consent. If the grant is one standard user account on one laptop, that is where the engagement begins, and we do not quietly move to a better vantage point.

Any request to change the starting position is a conversation, not an assumption. It usually arises when the granted position turns out to reach less than expected, which is itself a result worth recording before anything changes.

The written grant names exactly what access is given, on which host, as which user. Everything reached beyond it is earned through the attack path and recorded there, which is what makes the graph an honest account of what the position was worth.