Testing that starts with who would attack you.
A checklist test asks what's broken. A threat-led test asks whether the people likely to come for you could reach what matters most. We scope every test on real adversary tactics, aligned to your systems and your business, then prove which routes in actually work.
Test first: the two routes still marked likely. Fix first: phishing-resistant MFA closes 2 of 3 routes on its own.
Scoped on your business, not a checklist.
Every engagement follows the same five steps, so the test you buy is aimed at the attackers you face and the systems you'd least like to lose.
- 1
Profile the business
Your crown jewels, key suppliers, sector and the systems the business can't run without.
You and our consultant - 2
Model the adversary
The groups most likely to target you, and the ATT&CK techniques they use.
Umbra drafts, a tester reviews - 3
Scope on attack paths
Routes ranked by evidence. The test targets the ones not yet proven, and you sign an authorisation for every host.
Agreed with you - 4
Test like the adversary
Our testers emulate those tactics, from external testing to a full red or purple team.
Ahlume Cyber testers - 5
Prove, fix and retest
Findings land in the testing centre, routes are marked proven or closed, and fixes are retested.
Tracked in the platform
Nothing touches your systems without your signature.
Every active test needs a signed, in-date authorisation that covers each host. Our platform refuses to send a single packet without one, and records who approved it and when. Agents plan and prioritise; only our testers test.
The testing centre: findings you can track, not a PDF you file.
Request a test, follow it as it runs and work through its findings in one place. Each finding is mapped to ATT&CK and to the attack path it proves, so you can see which fixes close the most routes.
| ID | Finding | Severity | Tactic | Status |
|---|---|---|---|---|
| RTO-001 | Default credentials on the VPN admin portalProves a route | Critical | Initial access | Verified fixed |
| RTO-002 | SQL injection in the customer portal search | High | Initial access | Retest requested |
| RTO-003 | Service account reuses a domain admin passwordProves a route | High | Privilege escalation | Still open |
| RTO-004 | Mail gateway accepts outdated TLS | Medium | Collection | Open |
| RTO-005 | Error pages reveal software versions | Low | Discovery | Verified fixed |
Request a test in the platform
Pick the type, tell us what matters, and we'll scope it with you from your threat model.
Follow it as it runs
See each engagement from scoping to report, with the tester and dates.
Ask for a retest when it's fixed
Our tester confirms each fix and marks it verified fixed or still open.
Bring tests from other firms
Upload another firm's findings tracker and they join the same list.
Every test, aimed by the same threat model.
Scope a threat-led test.
We'll come to the first call with a draft threat model of your business and the routes we'd test first.