Fortellar

Scoped adversarial testing. Findings the team can fix on Monday.

Penetration Testing & Red Team answers two questions: can an attacker reach the data that matters, and can your team catch them before they do? Time-boxed, signed off in advance, and delivered as a written report with the exploitation chain and remediation plan.

Talk to Us
Why This Matters

A scan finds what's open. A pen test proves what's reachable.

Most engagements sell pen testing as a commodity: run a scanner, export the output, reformat the report, send the invoice. It gives the audit committee a document that looks like proof of testing, when what it says is that the scanner ran.

Real adversarial testing is scoped, manual, and outcome-defined. An objective is agreed in writing, and the exploitation chain is reconstructed in the report with the evidence and remediation plan behind each step. That is the artifact the board, the regulator, and the insurer were asking for.

What a commodity test leaves unanswered
01

Objective

A scan has no goal. Real testing agrees a target in writing before it starts.

02

Manual depth

Tool output reformatted into a report tells you the scanner ran, nothing more.

03

Attack chain

Initial access, lateral movement, escalation, action on objective, reconstructed.

04

Detection

Whether your defenders saw any of it, and how long it took them.

Who this is for

Three situations where a scan won't answer the question being asked.

Situation 01

A customer, regulator, or insurer is asking for a pen test on file

A security questionnaire from a major customer has a line item for third-party penetration testing. A regulator has named the requirement. The cyber insurance renewal is contingent on it. A scanner report is not the document being asked for.

The outcomeA scoped engagement against a defined surface, with a Rules of Engagement document, an exploitation walkthrough, and a remediation plan written for the audience that asked for it.
Situation 02

The program is built and the next question is whether it holds

Vulnerability management is operating. Detection and response is running. There are Security Operations Center playbooks. The next question from the board is whether the controls work against a real adversary, not just a scanner, and whether the Security Operations Center catches it.

The outcomeA red team exercise mapped to MITRE ATT&CK. Objectives agreed in advance, detections measured against actions on objective, and a debrief that pairs offense findings with defense gaps.
Situation 03

A new application, environment, or M&A target needs an independent read

A new web application is going to production. A cloud landing zone has been built. A newly acquired company is being integrated. The internal team is too close, and the audit committee needs an independent voice on whether the surface is defensible.

The outcomeA scoped technical assessment with the testing standard cited, the methodology documented, and the findings written so the engineering team can act on them inside the release window.
What's included

Proof of what an attacker could reach, and the retest that closes it.

A written report, with the exploitation chain

Not a scanner export. A narrative of how the objective was reached: initial access, lateral movement, privilege escalation, action on objective. Each step paired with the evidence, the screenshot, and the technique ID that supports it.

Severity-rated findings with remediation guidance

Findings rated against CVSS plus business context. Remediation written for the engineer who has to fix it, not for the form. Cross-mapped to OWASP, CIS, NIST, or the framework the audit calls for.

An executive summary for the board and the customer

The artifact the audit committee, the customer, and the cyber insurer were asking for. Written in business language, with the objective, the outcome, and the residual risk framed at the right altitude.

MITRE ATT&CK mapping (red team engagements)

Every TTP cited by technique ID. Detection coverage measured against the SOC's actual telemetry. Gaps named, with the rule, the log source, or the playbook that would close them.

A technical debrief with the engineering team

A working session, not a slide deck, with the operators who ran the engagement. Reproduction steps walked, remediation prioritized, follow-up testing scoped if needed.

A retest, included

After remediation, a focused retest of the named findings is included in scope. The closing artifact is a re-validated report, not a second invoice.

How it works

Four phases. Scoped. Authorized. Reported. Retested.

Phase 01

Scoping & Rules of Engagement

A pre-engagement workshop confirms the objective, the in-scope surface, the testing window, the escalation contacts, the blackout periods, and the success criteria. A signed Rules of Engagement document closes the scope. Legal authorization is on file before the first packet leaves the operator's workstation.

You walk away with
  • A scoping memo with objective, surface, and success criteria.
  • A signed Rules of Engagement document with escalation contacts.
  • A testing schedule with blackout windows and operator roster.
Phase 02

Intelligence & threat modeling

OSINT, passive reconnaissance, and footprinting from the position a real adversary would start from. Threat modeling prioritizes attack paths against the agreed objective. Likely TTPs are selected and mapped to MITRE ATT&CK technique IDs for the operational plan.

You walk away with
  • An intelligence package on the target surface.
  • A prioritized attack path map.
  • An operational plan with technique IDs and operator assignments.
Phase 03

Exploitation & action on objective

Validated exploitation against the in-scope surface. Lateral movement and privilege escalation as scope permits. Every action logged with timestamp, technique, and operator. For red team engagements, detection coverage is measured at each stage and the SOC's response is observed without being interfered with.

You walk away with
  • A documented exploitation chain with evidence per step.
  • An attribution log with timestamps and techniques.
  • For red teams: a detection map against ATT&CK tactics.
Phase 04

Reporting, debrief & retest

The written report is drafted, peer-reviewed by a senior operator, and walked through with the engineering team and the executive sponsor. After remediation, a focused retest of the named findings is included in scope, and the report is re-validated against the closed findings.

You walk away with
  • A written report with executive summary and technical detail.
  • A working debrief with the engineering and SOC teams.
  • A retest pass and a re-validated closing report.
Expertise this work draws on

The components behind a Penetration Testing & Red Team engagement.

Cybersecurity & Compliance

Offensive Security

Senior operators with sustained hands-on experience across external, internal, application, and cloud surfaces. Reports are peer-reviewed, exploitation is validated, and the methodology is documented against PTES and NIST SP 800-115, not improvised on the engagement.

See expertise
Cybersecurity & Compliance

Threat Engineering & Detection

Red team engagements run alongside the detection engineering practice, so every TTP mapped to ATT&CK is paired against the telemetry and the rules the SOC actually has. The output is offense findings and defense gaps in the same report.

See expertise
Cloud & Technology Infrastructure

Cloud Security & Governance

Cloud pen testing reads against the same hardened-landing-zone reference architecture the practice ships. AWS, Azure, and GCP control-plane attack paths are part of the published methodology, not a one-off engagement skill.

See expertise
Cybersecurity & Compliance

Incident Response Readiness

Red team debriefs feed directly into IR plan refinement, tabletop scenarios, and the playbook library, so the lessons from the exercise land where they need to land, not in a folder no one re-opens.

See expertise

A scoped engagement, a written report, and the retest that closes the findings, on a defined window.

Get a fully scoped engagement, a clear report, and the retest required to close findings within a defined timeline. Share your scope, primary trigger, and target audience, and we'll size the engagement.

Talk to Us