Assumed breach testing is a targeted security assessment that begins from the premise that an attacker has already gained initial access to the organisation's environment. Instead of spending time on initial compromise (which is covered by traditional pen testing), assumed breach testing focuses on what an attacker can achieve once inside the network.
Testers are given a starting point such as a compromised user workstation, VPN credentials, or access to a specific network segment, and then attempt to escalate privileges, move laterally through the network, access sensitive data, and reach high-value targets or crown jewel assets. This approach directly tests the effectiveness of internal security controls including network segmentation, endpoint detection and response (EDR), privilege access management, monitoring and alerting, and incident response procedures.
Assumed breach testing is highly efficient because it focuses testing time on the most impactful scenarios - the activities an attacker would perform after gaining initial access. It is particularly valuable for organisations that want to test their internal defences and detection capabilities without spending engagement time on perimeter testing. This approach is recommended by NIST and aligns with zero-trust security principles that assume breach as a starting point for security architecture.
UK offensive security consultancy delivering CREST-accredited penetration testing, adversary simulation and CBEST, TIBER-EU and TBEST threat-led testing, mainly for financial services and other large organisations.
Penetration testing firm trusted by nine of the top ten US banks, with the Resolve platform for continuous attack surface management.
Global Big Four professional services firm delivering CREST, CHECK, and CBEST-accredited penetration testing and red teaming services from London, serving the UK's largest enterprises and regulated organisations.
CREST and CHECK-accredited UK penetration testing and managed security provider formed in 2026 from Pentest People, Bulletproof, and Target Defense, with CREST STAR/TLPT-FS capability and the GuardNest vulnerability management platform.
Elite UK offensive security consultancy specialising in CBEST/STAR/TIBER red teaming, advanced adversary simulation, and CREST-accredited penetration testing for FTSE 100 clients.
US penetration testing firm founded in 2011, running 600+ engagements a year with a fully remote, US-based team. Manual, expert-led testing across web, network, cloud, mobile, wireless, OT/ICS, and AI/LLM. Gartner Sample Vendor for PTaaS.
Full-service London-based cybersecurity consultancy with CREST, CHECK, and NCSC accreditations delivering offensive testing, managed detection, and strategic advisory services.
World-renowned cybersecurity firm now part of Google Cloud, delivering threat intelligence-led penetration testing and red teaming informed by front-line incident response experience.
Cybersecurity division of the Thales Group, with ANSSI, CREST, FedRAMP 3PAO, and NATO-cleared personnel. Defence, government, and critical infrastructure penetration testing worldwide.
US-headquartered cybersecurity consultancy with 800+ employees, serving ~40% of the Fortune 500. FedRAMP 3PAO, PCI QSA, and HITRUST accreditations.
Global risk advisory firm with a 400+ person cyber practice. IR-led penetration testing that feeds active breach intelligence straight into test scoping.
Denver-based offensive security boutique with a community-first red team culture. Home of PTES co-authors and the Continuous Red Team retainer.
Internal pen testing starts with network access and tries to find vulnerabilities from scratch. Assumed breach starts with a simulated compromised endpoint or credentials, focusing specifically on post-compromise activities and detection testing.
Common starting points include a compromised user workstation, stolen VPN credentials, a phished employee account, or access from a specific network segment. The starting point is chosen to simulate realistic breach scenarios.
Organisations with mature security programmes, EDR solutions, SIEM/SOC capabilities, and network segmentation who want to validate that their internal defences work as expected against a determined attacker.