Actor-specific scenarios
Tests are scoped around the TTPs of ransomware crews, APT groups or financially motivated intrusion sets relevant to you.
Adversary
Penetrationtestingdrivenbyrealthreatactorbehaviour
Intelligence-led penetration testing that emulates the TTPs of specific threat actors relevant to your sector and technology stack.
Traditional penetration testing finds vulnerabilities. Threat-led penetration testing goes further by emulating the specific tactics, techniques and procedures of actors that genuinely threaten your organisation. The result is a more realistic assessment of how you would fare against a determined, capable attacker.
We select threat actor profiles based on your sector, geography and threat intelligence, then scope a penetration test around their known TTPs. Every technique is mapped to MITRE ATT&CK and the output includes both technical findings and strategic recommendations on defensive posture.
Capabilities
What's included in Threat Led Penetration Testing
Everything below is delivered and tracked through the Mirage Portal.
Intelligence integration
Scenarios are informed by current threat intelligence, including recent campaigns, exploits and infrastructure.
ATT&CK mapping
Every technique executed is mapped to MITRE ATT&CK for clear defensive coverage analysis.
Realistic attack paths
Consultants chain techniques the way real actors do, from initial access through to objective completion.
Defensive recommendations
Output includes both vulnerability remediation and detection, logging and control improvements.
Sector relevance
Finance, healthcare, technology, critical infrastructure and other sectors each get scenarios grounded in their actual threat landscape.
Coverage
Scope and depth
Test components
- Threat actor profile selection
- TTP-based attack path design
- Initial access and persistence techniques
- Privilege escalation and lateral movement
- Objective-based targeting of crown jewels
- ATT&CK-mapped technique execution
Deliverables
- Intelligence-led test plan
- Technical findings with evidence
- ATT&CK technique coverage map
- Defensive control recommendations
- Executive summary linking findings to real threats
- Remediation and retest support
How it works
Our delivery process
A consistent, transparent methodology from first conversation to verified remediation.
- 01
Intelligence
We select and document the threat actors and TTPs most relevant to your organisation.
- 02
Design
A test plan is built around realistic attack paths, crown jewels and rules of engagement.
- 03
Execute
Consultants emulate the chosen TTPs across the kill chain, documenting every technique.
- 04
Analyse
Findings are mapped to vulnerabilities, controls and detection gaps with clear prioritisation.
- 05
Remediate
We support remediation and retest to validate that attack paths have been closed.
What you receive
- Threat-led test plan and actor profile
- Technical report with evidence and reproduction steps
- MITRE ATT&CK coverage map
- Defensive recommendations and detection gaps
- Executive summary for leadership
- Retest report after remediation
Business outcomes
- Realistic view of resilience against sector-specific actors
- Clear link between threat intelligence and security testing
- Actionable defensive improvements beyond patch lists
- Board-level narrative grounded in actual threats
FAQs
Common questions
How is this different from red teaming?
TL-PT uses threat actor TTPs to guide a scoped penetration test. Red teaming is a broader, objective-based covert operation.
Do you need existing threat intelligence?
It helps but is not required. We bring sector-relevant intelligence and can integrate your own feeds.
Which sectors benefit most?
Any sector with targeted threat actors, especially finance, healthcare, critical infrastructure, technology and professional services.
More services
Explore the rest of our portfolio
Save time and book a call with us
Enterprise-grade penetration testing, built around your business
CREST-registered testing delivered through a flexible PTaaS model — designed to fit your environment, risk profile and internal teams.