Whether compliance-driven or as part of standard security resiliency testing, security testing is vital to an organization’s defenses, especially in today’s era of high-profile breaches. Over the past few years, unrelenting reports have highlighted successful security breaches that resulted in compromised personal information, IP theft, financial loss, ransomware attacks, and even attacks on energy and medical organizations, which put human safety at risk. With the growing sophistication and frequency of attacks, organizations need to evaluate the effectiveness of their defenses to identify and quickly close gaps that attackers could exploit. A penetration test (pentest), Red Team evaluation, or Purple Team exercise can play an instrumental role in identifying weaknesses with both security infrastructure and processes.

Often, organizations fail their security evaluations, putting them at compliance risk and, more concerning, at risk of a breach. Repeatedly, the root of these failures often lies in the inability to detect in-network attack activity, such as lateral movement, credential theft, privilege escalation, discovery, Active Directory exploitation, and target acquisition. Read this paper providing a case study view on how to add value to penetration testing, red teaming, blue teaming and purple teaming using deception and concealment technology.