Think your business is secure? Why assumed breach testing is the real test

23/05/25 Chris Watt
Think your business is secure? Why assumed breach testing is the real test placeholder thumbnail

It’s widely recognised that organisations worldwide face relentless external cyber threats from a variety of threat actors, but far less consideration is given to threats that may be coming from inside an organisation itself.

Insider threats can originate from a variety of sources, including malicious or disgruntled employees, or even external attackers who have compromised internal users through phishing or exploiting internal vulnerabilities. Furthermore, and more significantly, depending on the specific nature of the attack or breach, some threat actors can maintain prolonged access to any compromised internal systems, giving them endless opportunities to explore the internal networks and any valuable assets.

Why an assumed breach or rogue user exercise is essential

This is where advanced internal security testing such as an assumed breach, or rogue user exercise would come into play, unlike other forms of internal penetration test, including:

  • where the assessment could either be performed from a fully unauthenticated perspective, simulating an attacker who had managed to simply connect into the network and “see what they could see”, investigating and attacking as much as possible in the time available.
  • scanning the organisation’s networks and assets for patching and misconfigurations from an administrative perspective.

An assumed breach or rogue user assessment focuses on what an internal rogue user with standard domain user privileges could do within the network, rather than patching levels or other similar misconfigurations on various devices.

Such an assessment should consider multiple possible scenarios, as described above, particularly in terms of initial access, but the overall final objective is generally the same: Can such a rogue internal user, such as a disgruntled employee, or other threat actor who has managed to compromise the network through other means and can maintain their access, elevate their privileges, access sensitive data, or otherwise compromise the network further in some meaningful way?

 

How is an assumed breach assessment different from an unauthenticated internal penetration test?

While an assumed breach assessment can sometimes be considered an extension of a completely unauthenticated Internal penetration test (where an attacker simply plugs in an unknown laptop, or other remote device and begins exploring with no credentials), the boundary between these usually lies in whether an attacker can gain any form of authenticated foothold into the network, from an initial unauthenticated perspective. Since this is often a time-consuming practice, an assumed breach exercise can be regarded as a cost-effective middle ground, especially when budgets are tighter but organisations want to evaluate real internal risks.

What’s the difference between Red Team vs. assumed breach?

Some may ask how and where this differs from a Red Team engagement. The answer to this lies in the scope (breadth) and noise generated from such a test:

  • Red Teams generally assess a broader area of potential entry points, combining multiple forms or otherwise different tests into one engagement (OSINT, Social-Engineering, External Infrastructure, Web App, VPN etc), but also generally aim to be “quieter”, flying under the radar to avoid detection for as long as possible. However, this attempted detection avoidance normally means that things can take longer, hence Red Team engagements generally being spread over a longer period.
  • Assumed breach/ rogue user assessments on the other hand are still conducted within a much smaller commercial time window and need to be “louder” to still ensure good coverage.

What’s tested on an assumed breach assessment?

The type of testing you can do with a standard domain or low-privileged user account depends on how you want to simulate the attack, and ultimately whether there are any particular objectives to be attained. If the test is run from an organisation-owned device, such as a corporate laptop connected to the VPN, security policies might limit what the attacker can do. But if the test is done from an attacker-owned device with full admin rights, connected via VPN, this provides a broader and more accurate assessment - especially if this approach can be consistently repeated.

Assessments typically examine:

  • Number of users present on the domain
  • Domain’s password policy
  • The presence of any accounts whose sensitive password data may be retrievable by other domain users, via the design of Active Directory
  • Whether any such accounts are highly privileged, and/or whose plaintext passwords are retrievable (crackable) within a reasonable time
  • Quantity and identities of domain admin accounts
  • Examination of any networks shares available, and whether any sensitive data is contained within

Real-world lessons from insider-related attacks

Many organisations have experienced domain compromises due to misconfigurations or not following best practice - allowing even standard domain users to escalate privileges and take control of entire networks. These vulnerabilities are prevalent both on-premises and via virtual machines and networks in the cloud, emphasising that internal security is as vital as external defences.

Ready to strengthen your internal security?

An assumed breach or rogue user assessment provides invaluable insight into how well your defences hold up against internal threats. By simulating real-world scenarios, we identify weaknesses before malicious insiders or compromised accounts do.

If you would like to learn more about how we identify vulnerabilities with our range of services, including penetration testing, get in touch.

Chris Watt Picture

About the author

Chris Watt has been in the penetration testing arena for over 12 years, specialising in web application and API security. For the last few years he has been steadily branching out into other types of security, including advanced infrastructure and mobile app testing.

Cyber Security, Red Team, Assumed Breach

Latest blogs

See all posts
Placeholder thumbnail
Boardroom vs breach: 20 questions every IT leader should be asking about cyber security

Cyber threats are evolving faster than most organisations can keep up. Between new attack techniques, expanding digital estates, and the cyber skills shortage, even well-equipped IT teams are struggling to stay ahead. It’s no longer enough to tick compliance boxes or to simply deploy the latest tools. Real security starts with asking the right questions and acting on the answers. That’s why we’ve created Boardroom vs Breach, a 20-question self-assessment designed to help IT leaders and those responsible for cyber-security take a clear-eyed look at your current security posture, highlight blind spots, and spark critical conversations at board level. Why this matters The cost of a cyber breach isn’t just downtime – it’s trust, reputation, compliance fines, and lost revenue. Yet many companies don’t know if their defences are actually up to the task – do you? These 20 questions aren’t about theory; they reflect real-world weak points that we see every day. If you can’t answer them confidently, we can help. The 20 Questions You Need to Answer Visibility & Monitoring Do you have complete visibility of your IT assets? What visibility do you have into incidents and events across your infrastructure? How do you manage your security tooling? How many different tools are you running — and are they working together? Are your systems and endpoints patched regularly? Our advice: Gaining complete visibility starts with consolidating event data, automating alerts, and ensuring continuous oversight across your entire estate. Take a look at: Security Information and Event Management Vulnerability Management Managed Detection and Response Threat Detection & Response What happens if an incident occurs after hours? How do you find out? Who responds? When was your last penetration test? How regularly do you conduct them? What protections are in place for endpoints, email, and networks? What level of visibility do you have into potential breaches? Do you work with a partner that offers 24/7/365 response and real-world support? Our advice: Improve threat visibility and reduce response times by combining real-time monitoring with expert-led incident analysis and containment. Take a look at: 24/7/365 Managed Detection and Response Incident Response Retainers Penetration Testing and Red Teaming Cloud & Modern IT Risk Do you use public cloud services? Are you confident in how they’re secured? How do you manage and secure user devices remotely? What vendors are you currently relying on — and are they right for your risk profile? How do you secure your network beyond the firewall? Our advice: Extend visibility beyond the traditional perimeter by applying cloud-native monitoring, endpoint telemetry, and policy-based access control. Take a look at: Cloud Security Assessments Secure Access Service Edge (SASE) Endpoint Detection and Response (EDR) People, Process & Planning How are your users trained to detect attacks such as phishing? Do you have access to expert help in a crisis? What cyber expertise exists in-house — is there a dedicated security leader? How do you create a positive security culture, not just rules? What threats are most relevant to your industry? Are you meeting required regulations and compliance standards? Our advice: Build better situational awareness by aligning people and processes with continuous monitoring and clearly defined escalation paths. Take a look at: Security Awareness Training Virtual CISO Services Compliance and Risk Consulting And a bonus question, with potentially the most worrying answer of all… What would a breach cost your business — financially and operationally? Putting It All Together While individual solutions can address specific security challenges, working with a trusted managed services and security partner ensures cohesive, round-the-clock support across every aspect of your cyber security posture — delivering greater efficiency, resilience, and long-term value. We work with IT and security leaders across all sectors to assess risk, build resilient cyber strategies, and deliver comprehensive protection that scales with your business. From real-world penetration testing to 24/7/365 threat detection, cloud security, and expert consultancy, we’re your trusted partner in securing the ‘now’ — and preparing for what’s next.

Read more

Stay service-savvy

Get all the latest news and insights straight to your inbox.