Penetration Testing and Red Team Services for Defence and Critical Infrastructure

The Problem: Automated Scanners Test for Yesterday's Vulnerabilities

Vulnerability scanners are essential — but they are not penetration testing. A scanner checks for known CVEs against a database of signatures. It will reliably find unpatched Apache servers, default credentials on network devices, and publicly known software vulnerabilities. What it will not find is the way a specific combination of low-severity misconfigurations, overly permissive firewall rules, and weak Active Directory delegation allows an attacker to move from an internet-facing web server to your domain controller in six steps.

That chained, contextual, human-reasoning exploitation is precisely what nation-state actors use against defence-technology targets. The APT groups currently targeting Ukrainian and EU defence contractors are not running automated scan-and-exploit toolkits against their victims — they are conducting manual, patient, purpose-built attacks that specifically avoid the signatures and behavioural patterns that automated tools detect. If your security assurance programme consists only of automated scanning and a quarterly vulnerability management meeting, you have a significant blind spot.

The compliance driver compounds the problem. NIS2, ISO 27001, and many procurement requirements mandate penetration testing, but they do not specify its quality. Many organisations commission box-ticking tests from vendors who run automated tools with a light manual review layer, produce a report full of CVE numbers, and deliver nothing that actually reflects what a skilled adversary could do. The organisation passes its audit, the board is reassured, and the critical attack path that runs through a legacy OT gateway and a misconfigured cloud storage bucket remains entirely unknown.

Effective penetration testing requires human expertise, time, and the specific knowledge of how real adversaries operate in your threat environment.

Our Approach: Think Like the Adversary Targeting Your Sector

AmonSul penetration testing is conducted by analysts who have operational knowledge of the specific APT groups and cybercriminal organisations that target defence tech and critical infrastructure. We do not just test against generic attack playbooks — we test against the specific techniques, tools, and procedures we see those actors using actively.

Every engagement begins with a structured scoping call to define objectives, targets, rules of engagement, and the specific business risks you want to validate. From that foundation we conduct genuine reconnaissance: passive OSINT on your exposed infrastructure, supply chain, employee profiles, and technology footprint; then active enumeration to identify the full attack surface visible to an external adversary.

The exploitation phase is conducted manually, with automation used only to accelerate repetitive tasks. We chain vulnerabilities together to demonstrate real-world impact, not just report each finding in isolation. Where we achieve initial access, we pursue lateral movement, privilege escalation, and persistence — the full kill chain — to establish exactly how far a real attacker could get and what they could do when they got there.

For red team engagements, we extend the scope to include phishing, vishing, physical access attempts, and supply-chain impersonation. We target your detection and response capability as well as your technical controls, which tells you not just whether you can prevent a breach but whether you would detect one if prevention failed.

What You Receive

The executive summary: a two-to-three-page non-technical brief for your board and leadership team, covering the overall risk posture, the most critical findings, and the business impact of each. This is written for decision-makers, not security engineers.

The technical report: a full narrative of the attack path from reconnaissance to impact, with step-by-step documentation of each technique used, screenshots and evidence artefacts, CVSS v3.1 base scores, and prioritised remediation guidance specific to your environment — not generic vendor documentation.

The remediation roadmap: findings are grouped into immediate actions (address within 48 hours), short-term fixes (30 days), and strategic improvements (90 days). Each recommendation includes an estimated implementation effort and a risk-reduction score so your team can prioritise investment.

The re-test: once your team has addressed the findings, we retest every remediated vulnerability and provide a written re-test attestation confirming closure. This document is formatted for regulatory submission and audit evidence packages.

MITRE ATT&CK mapping: every finding is mapped to the relevant ATT&CK technique ID, giving your blue team an immediate input to detection-rule gap analysis.

Why AmonSul

Red team exercises are only as valuable as the realism of the adversary simulated. A test conducted against generic attacker behaviour tells you how well you would fare against an opportunistic criminal — useful, but not relevant if your actual threat comes from Sandworm, Fancy Bear, or Turla.

Our analysts have worked directly against these actors. Several have served in roles within Ukrainian cyber defence operations, where they gained direct exposure to the specific infrastructure, tooling, and tradecraft used by Russian state-sponsored groups in active campaigns against defence and critical infrastructure targets. That knowledge informs every engagement we run — not as general background context, but as specific, current operational intelligence that we use to make our tests genuinely representative of your real threat.

We also carry this intelligence through VATRA, our proprietary threat platform, which gives us a continuously updated view of the techniques being used against organisations in your sector right now. When we design a red team scenario, it is based on what we are actually seeing in active campaigns against your peers.

---

Want to know what a nation-state actor could do inside your network today? Talk to our red team about scoping an engagement — the first call is a no-obligation technical discussion.