[APT29] INITIAL_ACCESS_VECTOR_MAPPED :: SPEARPHISHING_LINK
[FIN7] C2_INFRASTRUCTURE_DETECTED :: 185.220.101.45
[LAZARUS] LATERAL_MOVEMENT_PATH :: IDENTIFIED
[APT41] CREDENTIAL_DUMP :: NTLM_HASH_EXTRACTED
[CARBANAK] PERSISTENCE_MECHANISM :: REGISTRY_RUNKEY
[SANDWORM] DESTRUCTIVE_PAYLOAD :: WIPER_DETECTED
[UNC2452] SUPPLY_CHAIN_COMPROMISE :: PKG_INTEGRITY_FAIL
[TA505] EMAIL_GATEWAY_BYPASS :: ANTI_SPAM_EVADED
[MUDDYWATER] LIVING_OFF_LAND :: POWERSHELL_EXEC
[APT28] EXFILTRATION_CHANNEL :: DNS_TUNNELING
[COZY_BEAR] PERSISTENCE_ESTABLISHED :: SCHEDULED_TASK_SET
[WIZARD_SPIDER] RANSOMWARE_PRECURSOR :: BEACON_ACTIVE
[TA453] SPEAR_PHISH_KIT :: CREDENTIAL_HARVEST
[APT35] MOBILE_IMPLANT_DEPLOYED :: C2_ESTABLISHED
[APT29] INITIAL_ACCESS_VECTOR_MAPPED :: SPEARPHISHING_LINK
[FIN7] C2_INFRASTRUCTURE_DETECTED :: 185.220.101.45
[LAZARUS] LATERAL_MOVEMENT_PATH :: IDENTIFIED
[APT41] CREDENTIAL_DUMP :: NTLM_HASH_EXTRACTED
[CARBANAK] PERSISTENCE_MECHANISM :: REGISTRY_RUNKEY
[SANDWORM] DESTRUCTIVE_PAYLOAD :: WIPER_DETECTED
[UNC2452] SUPPLY_CHAIN_COMPROMISE :: PKG_INTEGRITY_FAIL
[TA505] EMAIL_GATEWAY_BYPASS :: ANTI_SPAM_EVADED
[MUDDYWATER] LIVING_OFF_LAND :: POWERSHELL_EXEC
[APT28] EXFILTRATION_CHANNEL :: DNS_TUNNELING
[COZY_BEAR] PERSISTENCE_ESTABLISHED :: SCHEDULED_TASK_SET
[WIZARD_SPIDER] RANSOMWARE_PRECURSOR :: BEACON_ACTIVE
[TA453] SPEAR_PHISH_KIT :: CREDENTIAL_HARVEST
[APT35] MOBILE_IMPLANT_DEPLOYED :: C2_ESTABLISHED
Offensive Security · Pillar 05 · Tier 2
Threat-Led Penetration Testing (TLPT)
Intelligence-driven adversary simulation mapped to TIBER-EU, CBEST, and iCAST frameworks for critical infrastructure and financial sectors.
The Case for TLPT
Nation-State Actors Are Already Inside Your Network.
Average attacker dwell time before detection
[Mandiant M-Trends 2023]
Of malware is delivered via email — the primary TLPT initial access vector
[Verizon DBIR 2023]
Average total cost of a data breach — quantifiable through FAIR within TLPT
[IBM Security 2023]
Conventional penetration testing was not built for today's adversary.
Standard assessments identify known weaknesses in isolated systems. TLPT replicates the full operational playbook of a targeted nation-state or advanced criminal group — from intelligence gathering through persistent access and lateral movement to Tier-1 asset compromise.
The difference is not in the tools. It is in the intelligence: who is actively targeting your organisation, what they specifically want, and exactly how they would go about getting it today.
TLPT
Standard
Scope Definition
Sector-specific threat actor TTP mapping
Generic CVE scanning against known vulnerabilities
Intelligence Basis
Premium threat feeds + proprietary HUMINT analysis
Automated vulnerability database lookups
Regulatory Output
Accepted by TIBER-EU, CBEST, iCAST regulators
Not accepted as regulatory evidence
Business Output
Board-ready FAIR financial risk quantification
Technical findings report requiring translation
Operational Workflow
How a TLPT Engagement Executes.
[PHASE_01]
Threat Intelligence Gathering
Mapping TTPs of threat actors relevant to your specific sector using premium intelligence feeds and MITRE ATT&CK correlation.
[PHASE_02]
Crown Jewel Targeting
Assumed-breach scenario testing against Tier-1 infrastructure, validated against your actual crown jewel asset register.
[PHASE_03]
Adversary Simulation
Multi-stage intrusion execution mapped to MITRE ATT&CK — initial access through persistence, lateral movement, and exfiltration.
[PHASE_04]
Blue Team Replay & Validation
Collaborative replay sessions to measurably uplift SOC detection capabilities and close validated defensive coverage gaps.
[PHASE_01]
Threat Intelligence Gathering
Mapping TTPs of threat actors relevant to your specific sector using premium intelligence feeds and MITRE ATT&CK correlation.
[PHASE_02]
Crown Jewel Targeting
Assumed-breach scenario testing against Tier-1 infrastructure, validated against your actual crown jewel asset register.
[PHASE_03]
Adversary Simulation
Multi-stage intrusion execution mapped to MITRE ATT&CK — initial access through persistence, lateral movement, and exfiltration.
[PHASE_04]
Blue Team Replay & Validation
Collaborative replay sessions to measurably uplift SOC detection capabilities and close validated defensive coverage gaps.
Engagement Evidence
Representative Findings From Live Engagements.
[DISCLAIMER: All findings are representative composites. No client-identifying information disclosed. Published under standard TLPT confidentiality protocols.]
Representative Findings
Initial Access
Credential theft via precision-targeted spearphish mimicking internal finance workflows — undetected through email gateway.
Persistence
Scheduled task implant surviving full workstation reimaging, mapped to Tier-1 domain admin — 11 days undetected.
Lateral Movement
Kerberoasting attack chain exposing 14 service accounts with no detection alert triggered in the client SOC.
Exfiltration
DNS-tunnelled exfiltration of a crown jewel dataset — active 72 hours before detection via BRR anomaly scoring.
Intelligence Sourcing
Every engagement begins with a tailored threat actor profile.
Before a single test action is executed, our intelligence team spends 2–4 weeks building an adversary profile specific to your sector, geography, and organisational footprint — determining which threat actors are actively targeting organisations like yours today.
Active threat actor identification and sector-specific ranking
Crown jewel asset mapping against published attack surface
TTP selection from premium threat intelligence feeds
Blue team detection capability baseline assessment prior to testing
Capability Matrix
Technical Specification & Deliverables.
Regulatory Alignment
All engagements are scoped and documented to satisfy the full evidential requirements of applicable financial sector regulatory frameworks.
Deliverables
Structured outputs designed for direct regulatory submission and board-level risk committee reporting without requiring translation.
BRR Engine Integration
All findings feed directly into the Vyomerc BRR Engine, normalising TLPT outputs into quantified financial risk ratings across the portfolio.
Contextual Briefing
Initiate TLPT Scoping & Threat Profiling.
Our intelligence team models relevant threat actors against your specific sector profile before a single test is scoped. All preliminary engagement is conducted under mutual NDA.
[STRICT_CONFIDENTIALITY // ISO_27001_ALIGNED]