OFFENSIVE SECURITY
Offensive security: three engagements that answer three different questions.
The testing half of this practice, with every engagement run to a written test plan.
The three engagements, side by side.
| The question | COST | Red Team | Purple Team |
|---|---|---|---|
| What it asks | Which weaknesses can be used inside the approved scope. | Whether an objective can be reached against the live environment. | Whether the defense would see it. |
| In scope | A target set named in the test plan, tested in recurring cycles on an agreed cadence, each in an agreed window. | The environment, people and process, bounded by an objective, run as an adversary. | Agreed techniques on agreed systems, one at a time. |
| Will defenders be told? | As the test plan decides. | Nothing: whether they notice is measured. | Everything. They watch their own tools, in the room. |
| You are handed | Findings with evidence and reproduction steps. | A narrative of the path taken. | Per technique: what was seen, and which signal would carry the rest. |
| Right when | A counterparty or rule asks for independent testing of a defined scope. | Controls are mature; can they hold against someone with an objective? | Detection was built and nobody has proved it. |
| Level | What is supplied | What it buys |
|---|---|---|
| Black box | Nothing | An outsider's start; the window goes on discovery |
| Gray box | Usually credentials at a stated privilege level | Depth for the same hours |
| White box | Documentation, configuration and access | What the others never reach |
| Assumed breach | A foothold you grant | How far it goes |
Four named deliverables.
- Executive SummaryFor those who did not commission the test: what was and was not tested, what was reached, what leadership decides.
- Findings RegisterEach finding with evidence, reproduction steps, assets, owner and rank; machine readable.
- Risk ContextPer finding: what it took to reach, what it reaches next, which obligation it touches.
- Ranked RoadmapThe order of work and its basis: a configuration change, a project or a decision.
Written rules of engagement before any testing begins.
- Authorization: a signatory who can authorize every target and technique signs the rules of engagement. Nothing is tested that is not on that document.
- Testing: Performed inside the window, to the plan, with the escalation path open throughout.
- Findings, ranked on a stated basis, each with an owner, then one verification round.
The test plan names:
- Targets by address, hostname or account, with exclusions.
- The knowledge level.
- The window and any excluded hours.
- The signatory, and third party and cloud provider permissions or exclusions.
- Prohibited techniques: social engineering, physical activity, denial of service, destructive actions and persistence, each prohibited unless separately and explicitly authorized.
- The escalation path and a named person on it, reachable inside the test window.
- The stop condition, and who can call it.
- Handling of credentials, keys and records encountered.
- Evidence retention and destruction.
In every case the signatory knows, and the stop condition is theirs to call.
Access, and getting it back
- We state in writing the access we need and why, at the lowest level that will answer the question.
- You grant it, decide what it is scoped to, and can revoke it at any moment without asking us.
- At closure we list in writing what to remove, item by item, and ask you to confirm it is removed.
The commitment in full is on Trust and Assurance.
Independence.
Our advice is not tied to product sales. If Red Stick Solutions ever holds a commercial relationship with a product or platform it discusses with you, that relationship is disclosed to you in writing before it can affect the advice.
Red Stick Solutions will not assess or test a security program it owns as virtual CISO for the same client in the same period. Where a client wants both, the assessment or the test goes to a third party and this firm helps select one.
The policy: Partners. Our vendor answers: Trust and Assurance.
Four instruments create the demand, and two of them carry an exemption that removes the testing.
Where the Safeguards Rule reaches you, 16 CFR 314.4(d)(2) requires annual penetration testing absent continuous monitoring; the full cadence is on Vulnerability Management. COST includes that annual penetration test.
| Instrument | Why it matters here | Who it reaches, and who it does not |
|---|---|---|
| Freddie Mac Single-Family Seller/Servicer Guide, Chapter 1302 | Your own staff cannot meet it. | Clock 48 hours to Freddie Mac from discovering a security incident, third party incidents included. Testing Annual penetration test by a qualified and independent third party, not an internal team; 314.6 does not remove it. Reaches Single-Family Sellers and Servicers, by contract, with no size exemption; Multifamily is separate. Not Anyone outside the relationship. |
| NYDFS Cybersecurity Regulation, 23 NYCRR Part 500 | Its exemption decides whether testing is yours. | Reaches Holders of a DFS license, registration, charter or similar authorization. Not A firm whose only link is a New York customer. Exempt Any one of three 500.19(a) tests, set out on Mortgage, removes penetration testing and vulnerability assessment (500.5); never the 72 hour or 24 hour notices in 500.17. |
| FTC Safeguards Rule, 16 CFR Part 314 | Its exception decides the cadence. | Reaches Nonbank financial institutions under FTC jurisdiction. Not Banks, savings associations, federally insured credit unions. Exempt Below 5,000 consumers whose information you maintain (not employees, loans or dollars), 314.6 lifts the written risk assessment (an unwritten one is still owed), testing cadence, written incident response plan and board report. The rest, 314.4(f) and FTC notice included, applies at any size. |
Below 5,000 consumers, Freddie Mac's annual test and 48 hour reporting clock still apply. There is no small company exemption.
A scheduled test does not start a federally insured credit union's clock: NCUA 12 CFR 748.1(c) excludes good faith activity at the owner's or operator's request, such as authorized testing. Elsewhere the test plan records the position before testing.
This firm builds the program and the evidence to the shape the instrument requires. Counsel confirms the legal reading for your state.
What a test does not claim.
The report shows its scope and method. It states what was observed and, separately, what is inferred. It holds only for the scope, window, access and days tested; changing any of those changes the test plan, which the signatory approves.
An AI feature in scope is tested with the estate; who approved it, what it may decide and who watches it are for AI Governance.
| Question | Answer |
|---|---|
| Proof of compliance | No. It gives an examiner or counterparty dated evidence to reach their own conclusion. No report from this firm is represented as proof that an environment is secure or compliant. |
| Something urgent | We stop and tell you the same working day, by the escalation path and to the named person agreed in writing before the work began. |
| Retest | One round of verification of remediated findings is included in the fee as standard. Further rounds are quoted, and the proposal states the window. |
| If it stops | You keep everything produced to that point, in the form it is in that day. |
Next, if needed: Cyber Defense, the vulnerability program or the Security Assessment.
Bring the requirement and the window.
Send the wording you were given, and your date.
- Unit
- The engagement that answers your requirement
- Fee
- In writing once a written scope is agreed, before you sign or grant access.
- Duration
- Elapsed time and your team's hours, in writing, with the fee.
- A changed scope
- Requoted, showing which change moved the number.
- A number that proves wrong
- You hear the day we know.
The commitment in full is on Trust and Assurance.