How a Nomad Security engagement runs.

Independent access vectors (external infrastructure, social engineering, physical and wireless) are pursued to a foothold, then through discovery, privilege escalation and lateral movement to the objective. Every scanner result is verified by hand before it reaches the report.

1. Network discovery and enumeration
2. Vulnerability scanning and analysis
3. Exploitation and privilege escalation
4. Post-exploitation analysis
5. Persistence and exfiltration
6. Documentation and reporting

Aligned with OWASP: we learn the architecture first, then test authentication, input handling, business logic, APIs and configuration, and finish with developer-focused fix guidance.

1. Information gathering and reconnaissance
2. Authentication and session management
3. Input validation and sanitization
4. Business logic testing
5. API security assessment
6. Security configuration review

One engagement in two stages. A covert stage measures what your defenders catch unprompted; the same operators then work alongside your SOC, announcing each technique so gaps are diagnosed, fixed and re-tested before we leave. Delivered with a detection scorecard mapped to MITRE ATT&CK.

1. Rules of engagement and trusted agent selection
2. Covert adversarial simulation
3. Transition to collaborative operations
4. Paired execution and detection testing
5. Post-exploitation and structural assessment
6. Tabletop exercise and post-mortem
7. Reporting and detection scorecard

Planned attack scenarios that mirror real adversary tactics, measured on detection and response: time to detect, what the SOC saw, and where controls failed.

1. Planning and preparation
2. Simulation and execution
3. Analysis and reporting
4. Post-incident response review
5. Continuous improvement roadmap

Phishing, vishing, pretexting and physical campaigns built from public research on your organization, run inside agreed safeguards and reported with statistics your awareness program can use.

1. Scope definition and planning
2. Target research and profiling
3. Attack vector development
4. Campaign execution
5. Analysis and documentation
6. Reporting and training recommendations

Whether an unauthorized person can enter, reach sensitive areas and turn that into a network compromise. Evidence is photographed, never removed.

1. Reconnaissance and site survey
2. Perimeter and access control assessment
3. Tailgating and pretext entry
4. Sensitive area access
5. Physical-to-digital pivot
6. Documentation and reporting

Whether the wireless estate gives an attacker network access, traffic interception or a way around segmentation, including from the parking lot.

1. Wireless reconnaissance and SSID enumeration
2. Authentication and encryption review
3. Rogue access point and impersonation testing
4. Client-side and man-in-the-middle attacks
5. Segmentation and lateral movement validation
6. Documentation and reporting

Configuration review against provider baselines, CIS benchmarks and real attacker tradecraft, with identity treated as the primary control plane. Exposure is confirmed, not assumed.

1. Tenant and subscription enumeration
2. Identity and access management review
3. Data storage and exposure assessment
4. Network and service configuration review
5. Logging, monitoring and detection coverage
6. Documentation and reporting

A supervised, bounded exercise: an agent under our control attempts what a hostile one would, while we measure whether your detections still fire at machine speed. Guardrails are enforced in tooling, and a consultant can stop it at any moment.

1. Scenario definition and guardrails
2. Agent tasking and supervision model
3. Automated reconnaissance and target selection
4. Supervised exploitation and privilege escalation
5. Detection and response measurement at machine speed
6. Containment, teardown and evidence handling
7. Documentation and reporting

Our open source intelligence framework characterizes your external footprint without sending a single packet to your infrastructure. Every finding traces to a public source, and attribution rests on two independent evidence chains.

1. Scoping and domain footprinting
2. Subdomain and attack surface enumeration
3. Infrastructure and certificate mapping
4. Email, identity and personnel intelligence
5. Exposure, secret and breach assessment
6. Correlation, attribution and reporting

Broad coverage with human verification: automated discovery and scanning, then manual confirmation and risk-based prioritization so the list you receive is real.

1. Planning and scope definition
2. Asset discovery and enumeration
3. Vulnerability scanning
4. Manual verification
5. Risk analysis and prioritization
6. Documentation and reporting

A gap assessment against the framework that fits your industry (NIST, ISO 27001 or a sector regulation) ending in a prioritized, funded remediation plan.

1. Define scope and objectives
2. Select a framework
3. Gather data
4. Identify the desired state
5. Compare current state to desired state
6. Risk analysis
7. Prioritize remediation actions
8. Implement and monitor