Resilience
Red Team & Assumed-Breach Exercises
Test a business objective across the controls that should protect it.
Explore scopeResilience / 32 of 32
Logging & security monitoring review.
Make the right evidence available when it matters.
Logs have value when they cover the right systems, arrive reliably and lead to action. Review collection, retention and investigation workflows around your real security needs.
A clear scope makes the differenceWhat the work
What the work
can cover.
Explore the areas that can shape this engagement. Final coverage follows your systems, priorities and access.
01 / Inside the scope
Source coverage
Map critical systems, applications and identity events to collected logs.
02 / Inside the scope
Time and consistency
Review time synchronisation and the fields needed to correlate events.
03 / Inside the scope
Retention and integrity
Review access, storage location, retention and protection of log evidence.
04 / Inside the scope
Detection use cases
Assess whether agreed scenarios have useful monitoring logic and context.
05 / Inside the scope
Triage workflow
Trace alerts through ownership, investigation, escalation and closure.
06 / Inside the scope
Evidence retrieval
Validate that relevant records can be located and exported for an investigation.
01 / 06
What your team receivesFrom evidence
From evidence
to owned action.
A useful result explains coverage, impact and next steps. The agreed proposal makes the deliverables clear.
- 01
Logging coverage matrix
- 02
Monitoring and retention observations
- 03
Priority detection improvements
- 04
Investigation evidence checklist
Before the assessmentA useful
A useful
starting point.
These inputs establish the effort, coverage, intended use and timing.
- The systems, teams and business objective to include
- Relevant architecture, policy or configuration records
- An owner for access, questions and follow-up decisions
Common questions
What defines the scope?
The systems, business objective and evidence you need determine the scope. The assets, access, deliverables and timetable are agreed before work begins.
What will our team receive?
A clear account of coverage, evidence-backed observations and prioritised next actions. The proposal sets out the exact deliverables and any follow-up review.
Can this fit an upcoming release or audit?
Share the milestone and the systems involved. The assessment can be shaped around that decision once technical fit and availability are confirmed.
Connected priorities
You may also need.
Resilience
Purple Team & Detection Validation
Bring the test and the investigation together. Find the signals that deserve attention.
Explore scopeResilience
Security Awareness & Phishing Readiness
Make the next security decision easier for the people who use your systems.
Explore scope