Capability Development

Build the team that keeps you tested.

We stand up your red, purple or detection program and hand it over. Your team runs it on its own.

From vendor to in-house.

Five steps that end with the program in your hands.

  1. Set the method

    Methodology and rules-of-engagement templates become your playbooks.

  2. Choose the tooling

    Tooling is selected for your environment and your operators' skills.

  3. Coach the operators

    Your team runs engagements alongside ours and takes over step by step.

  4. Hand off detection

    Detection engineering moves to your analysts with a roadmap to grow it.

  5. Run it yourselves

    Training sessions and the roadmap leave the program yours to run.

What this engagement covers

When you need it

  • When hiring first operators
  • When replacing a vendor
  • After repeated gaps

What we do

  • Methodology and ROE templates
  • Tooling selection
  • Operator coaching
  • Detection engineering handoff

What you get

  • Documented playbooks
  • Training sessions
  • A roadmap

How it runs

  • Duration: Scoped and quoted in the scoping call.
  • What we need from you: The operators or analysts we coach and the decision owner for the roadmap.

Standards

  • PTES
  • MITRE ATT&CK

Frequently Asked Questions

Which programs can you build?
A red team, a purple team or a detection program, with the methodology, ROE templates, tooling and coaching to run it.
What does the handover include?
Documented playbooks, training sessions for your operators and a roadmap, plus a detection engineering handoff.
Do we stay dependent on you?
No. The goal is a team that runs the program on its own; the roadmap sets out how it gets there.

How We Work

Eight steps from the first call to the closure letter. Every engagement follows them.

  1. Scoping call
  2. Rules of engagement
  3. Threat model
  4. Execution
  5. Analysis
  6. Readout
  7. Remediation support
  8. Retest
Read the full lifecycle

Ready to scope an engagement?

Tell us the asset and the decision the test should inform.

Scope a call