Scenario Based Pentesting
You have a specific attack scenario in mind. We find out if it actually works. Within a controlled scope, we follow the steps an attacker would take and uncover what makes the attack possible. So you know whether the risk is real, where your defenses fail and what needs to be fixed.
Do you recognize this?
What looks secure from the outside can look very different once someone tries to break in.
Your defences work in isolation. What about together?
You have security tools, controls and processes in place. But you don’t know what happens when an attacker combines several weaknesses. Each measure may work on its own, but that doesn’t not tell you whether your defences can withstand a realistic attack.
The highest score doesn’t mean the biggest risk
A vulnerability with the highest score does not always represent the greatest risk. A lower-scoring finding can also open the door to privilege escalation, lateral movement, or access to critical data.
Findings lack business context
Pentest reports show you which vulnerabilities exist and how severe they are. But they don't always show what those vulnerabilities mean for the systems and processes your business relies on. That can make it harder to understand the real business risk and decide what to fix first.
Would you detect an attack?
Your security systems generate alerts. But would you recognise the signals that matter during a real attack? And would your security team investigate and respond before the attacker reaches their goal?
How we approach it
We don't start with a checklist. We start with the attack you want to understand. Together, we turn it into a controlled scenario and test whether an attacker could actually make it work.
Define the research question
We start with what you want to prove or challenge: a critical process, system, data or specific risk. Together, we define the attack scenario and the objective, so we know exactly what an attacker needs to achieve and what the test needs to uncover.
Understand the threat
We look at who could realistically target your organisation, why and how they would operate. We use that insight to build a realistic attack scenario based on relevant tactics and techniques.
Build the attack scenario
We turn the threat into a specific attack scenario and identify what information an attacker could discover and use. We agree on the scope, boundaries and techniques upfront, keeping the attack realistic without putting your organisation at unnecessary risk.
Follow the attack path
Our testers work through the scenario step by step, combining weaknesses to move from the starting point towards the objective. This shows what an attacker could actually achieve and where weaknesses combine to create real business risk.
Test your defenses
An attack isn't just about getting in. We test what happens when the attack unfolds: can your organisation detect it, understand what's happening and respond before the attacker reaches their objective?
Break the attack path
We connect the technical findings to the business impact, so you know what to fix first. After remediation, a targeted retest shows whether the same attack path can still succeed.
What you get
After the Scenario Based Pentest, you receive one clear, comprehensive report that brings all the results together:
Scenario definition and test plan
Attack path reconstruction
Technical findings and evidence
Attack path risk analysis
Management summary
Your primary point of contact
“You can know exactly which vulnerabilities exist in your environment and still not know the actual risk to your organisation. What matters is what happens when those vulnerabilities come together in a realistic scenario.”
Nick Bruinsma
Director Innovation
FAQ
How long does a Scenario Based Pentest take?
What is the difference from a regular pentest?
| Regular Pentest | Scenario Based Pentest |
|---|---|
| Usually starts with a system or application | Starts with a threat and business risk |
| Asks: What vulnerabilities are present? | Asks: Can an attacker reach a critical objective? |
| Often has a technical scope | Has a scenario and objective based scope |
| Often tests components individually | Examines how people, processes and technology interact |
| Reports individual findings | Reconstructs the complete attack path |
| Assigns a risk score to each vulnerability | Assesses risk based on the attack path and its impact |
| May stop once a vulnerability has been proven | Investigates what an attacker could achieve next |
| Detection is often secondary | Detection and response can be explicit test objectives |
| Results are mainly aimed at IT and security | Results are relevant to security, risk, audit and management |
Is Scenario Based Pentesting the same as Red Teaming?
Can we test more than one scenario?
Can you retest the scenario afterwards?
Do you also test our detection and response?
Is Scenario-Based Pentesting the same as Assumed Breach?
No. Assumed Breach primarily describes the starting point of the test. It assumes that an attacker has already gained an initial level of access, for example to a user account or workstation.
Scenario-Based Pentesting describes the broader setup of the assessment. An Assumed Breach starting point can therefore be part of a Scenario-Based Pentest, but it does not have to be.
Combine with
Red Teaming
Threat Modelling
Pentesting
