Adversarial testing that thinks like the people we keep awake at night.
A senior-led, manual penetration test. We model your actual adversary — ransomware affiliate, nation-state collector, insider — and exercise your environment against that scenario until something breaks.
Manual, scoped, reproducible — and almost never quiet.
Most penetration tests are scanner runs in disguise. We do the opposite: a small senior team works hands-on inside an explicit scope, chains findings into impact, and surfaces only the few things that actually matter.
An Onidef engagement is built around your adversary model, not a catalog. We start from a candid conversation about what you are afraid of — payment fraud, IP theft, regulator disclosure — and we work backward through the kill chain to the realistic entry points.
During execution, the same person who scoped the work is the person doing the work. There is no junior-staffing handoff. Daily updates land in a shared, encrypted channel; severe findings escalate within the hour.
The output is two reports and a debrief. The executive report is short and quotable — fit for the board and external regulators. The technical dossier is long, dense and engineer-ready, with reproducible proof for every finding and a written remediation pathway for each one.
Six stages — borrowed from PTES, OSSTMM and the ones that actually work.
Our process is documented end to end so your auditors, regulators and internal stakeholders can verify exactly what was done — and what was not.
-
01 · SCOPEScoping & rules of engagementDefined targets, attack windows, blackout times, in-scope and out-of-scope behaviours, escalation contacts, evidence handling and legal authorisation — captured in a signed engagement letter.
-
02 · RECONReconnaissance & surface mappingPassive OSINT, DNS & certificate transparency review, active enumeration of services, technology fingerprinting, dependency mapping and exposed-secret search.
-
03 · ATTACKManual exploitation & chainingHands-on identification and exploitation of vulnerabilities — authentication flaws, authorisation gaps, injection, deserialisation, SSRF, business-logic abuse. Findings are chained where credible to demonstrate true impact.
-
04 · ESCALATEPrivilege escalation & pivotWhere in scope, we escalate from the initial foothold — through tokens, secrets, misconfigured services or trust relationships — to demonstrate the realistic blast radius of a compromise.
-
05 · REPORTReporting & debriefExecutive summary, technical dossier, raw evidence, and a live debrief with engineering and leadership. Findings are scored against CVSS 4.0 and our internal business-impact scale.
-
06 · RETESTRetest & attestationOnce your team has remediated, we independently retest each finding and deliver a signed attestation letter — suitable for customers, partners, insurers and regulators.
What lands in your inbox when we are done.
Every artefact is encrypted in transit, signed, and retained on your terms. We can deliver via secure portal, encrypted PDF or hand-off to your e-discovery vault.
Executive narrative
A 6–10 page board-ready document. Risk in business language, a single chart of severity, and three explicit recommendations.
Technical dossier
40–120 pages. Every finding with CVSS 4.0 score, request/response evidence, reproduction steps, root cause analysis and a written fix.
Replayable evidence
Signed pcap, HAR and screen capture archives. Your engineers can re-run every exploit in a lab before they ship the fix.
Remediation workshop
Half-day session with the engineers who will write the fix. We walk through findings on a whiteboard, not over a deck.
Retest & attestation
Independent retest of each finding plus a signed letter you can hand to customers, regulators and cyber-insurance carriers.
12-month follow-up
One scheduled review per quarter for a year. We come back and check the fixes still hold under real-world drift.
The questions every security buyer asks us.
If yours is not here, write to us at contact. We will answer it in writing within one business day.