Audit & offensive security

Identification and qualification of vulnerabilities on a defined scope. Each vulnerability is manually verified, ranked by business criticality and cross-referenced with your infrastructure context. No raw scanner output is delivered without analysis.

Simulation of an external or internal attacker depending on the agreed scope: passive and active reconnaissance, exploitation of exposures, privilege escalation, lateral movement, access to sensitive data. Black box, grey box or white box scenarios depending on your objectives.

Assessment of web applications and exposed programming interfaces. Coverage of logic flaws, access control vulnerabilities, injection and authentication weaknesses. Business flow taken into account, not just technical parameters.

Review of cloud environment configuration and segmentation. Identification of authorisation errors, exposed resources and escalation paths linked to identity and access management policies.

Advanced multi-vector attack simulation over a defined period. The red team operates without the internal security teams being informed of the specifics. The objective is to evaluate actual detection and response capabilities, not resistance to a known scenario.

Targeted phishing campaigns, phone impersonation, unauthorised physical access attempts. Tests are conducted within a contractually defined and pre-documented scope.

Manual review of operating system, network service, equipment and application configurations. Verification of hardening against established benchmarks. Identification of deviations and unjustified exceptions.

Analysis of segmentation, filtering and defence-in-depth choices. Identification of implicit security assumptions and excessive trust zones. Recommendations on reducing the attack surface.