Novel attacks. Preserved as
deployable detections.
Attack-based detection engineering.
Our elite Gen Z hackers discover novel “living off the land” attack routes. The resulting interactive Control Log preserves those chains and carries them into the Adversary Chain Engine (ACE), which turns them into detections for your existing security tools.
THE ATTACK
Our Gen Z hackers explore how legitimate tools and available access can be combined to reach an agreed objective.
CHAIN ANALYSIS
The bridge between the attack and the detections. It preserves what our hackers did, why they did it and what enabled each step, keeping the chain’s evidence, context and causation intact.
adverasrY
chain engine
The Adversary Chain Engine (ACE) uses those preserved chains to produce multiple synthetic variants of each step. The software then produces deployment-ready detections (Sigma, YARA) and guides their deployment, replay, testing and refinement.
You receive the attack as a usable defensive capability built in, with detections connected to the chain, reasoning and evidence that produced them.
TOO MANY FINDINGS FAIL TO BECOME FIXES
of respondents cited insufficient resources to act on findings.
Fortra / Core Security, 2024 Penetration Testing ReportIt took 104 days to resolve half of high or critical pentest findings.
Our Gen Z hackers explore how legitimate tools and available access can be combined to reaFinding a weakness creates more work for your security team: understand the attack, identify the signals, build the detections, deploy them and check whether they work.ch an agreed objective.
Black Teaming builds the detections into the deliverable.
LIVING OFF THE LAND BEATS DETECTIONS
Attackers use legitimate tools and processes already available in your organisation. Understanding the attack means understanding how those actions connect, what enables them and what they achieve.
82% of CrowdStrike’s detections in 2025 were malware-free.
CrowdStrike, 2026 Global Threat Report, reporting on 20253 OF 3 TESTED EDR PRODUCTS ALLOWED A PARTICULAR LOLBIN EXECUTION TECHNIQUE
‘LIVING OFF THE LAND’ TECHNIQUES ARE BEATING DETECTIONS
CISA, NSA, FBI, UK NCSC, Identifying and Mitigating Living Off the Land Techniques, February 2024.
The CrowdStrike figure measures malware-free detections. The Bishop Fox finding concerns a particular execution technique tested in a controlled lab.
THE HANDOVER GAP
TOO MANY GAPS, CHAIN CONTEXT
AND CAUSALITY LOST
REAL ATTACKS
/ATTACK
SIMULATIONS
REPORT AND
ANALYSIS
DISCUSS
DEPLOY
DETECTIONS
& TEST
.png)
.png)
Your detection engineers need that knowledge to build the defence.
Black Teaming preserves it in the Interactive Control Log, alongside the detections it informs.
THE solution
Living off the Land attacks > Chains > Deployed detections
An attack with the detections built into the deliverable.
NOVEL ATTACK
Unscoped, creative, carried out by our unconventional Gen Z talent
Our hackers follow the opportunities your environment presents, exploring feasible routes towards your agreed objective. Your objectives, permissions, exclusions and stopping points are agreed. Our hackers choose and adapt their routes within those boundaries.
OPERATOR LOG
Captured chains, mapped to D3FEND, ready to deploy
The Interactive Control Log connects what happened with what made it possible: the access, permissions and system relationships that enabled one step to lead to the next. Routes taken, routes rejected and the reasons for each decision remain part of the record.
DETECTION DEPLOYMENT
Controls deployment, replay, testing, learning
The detection logic, required telemetry and supporting attack evidence stay connected through engineering review, deployment and testing. Check whether the activity is detected, legitimate activity produces false positives and defensive changes interrupt the attack.
WHY THE CHAIN MATTERS
Preserve what makes the attack work.
Individual actions can look normal in isolation. Their sequence, dependencies and causal links help explain how the attack progresses.
ACE records order, dependency and causation as three separate, separately evidenced relationships. The Interactive Control Log carries that knowledge from the attack into the detections.
order
What happened, and in what sequence?
DEPENDENCY
What access, permission or earlier action did the next step require?
CAUSATION
What evidence shows that an action enabled or produced the next outcome?
Know what evidence each step needs.
For each attack step, ACE identifies the defensive evidence needed to observe it. That helps your team distinguish activity that was not detected from activity your current telemetry cannot observe.
The deliverable connects detection logic with the required log sources, supporting evidence and conditions that enabled the attack.
Human attack knowledge. Constrained AI. Expert judgement.
Human-generated attack chains provide the starting point. AI proposes variants and detection logic; a symbolic layer checks them against controlled cybersecurity actions, patterns and technical constraints.
Evidence provenance keeps the source of each claim traceable. Uncertain mappings are flagged for expert review. Proposed variants remain distinct from actions demonstrated during the engagement.
The resulting detections are reviewed, deployed and tested in your existing security tools.
The Interactive
Control Log.
Your Black Teaming deliverable is an interactive record of the attack with deployment-ready detections included.
Explore the route. Inspect the evidence. Understand the dependencies. Trace each detection back to the behaviour and conditions it addresses.
01 — ATTACK
Black Teaming Attack: uncover feasible routes, enabling conditions and weaknesses in the client’s estate.
02 — LOG
Preserve actions, dependencies, outcomes and operator reasoning as reusable evidence.
03 — ANALYSE
Connect behaviours, assess likely objectives and identify plausible next moves.
04 — ENGINEER
Turn validated findings into detection logic, telemetry requirements & targeted defensive changes.
05 — DEPLOY
Integrate reviewed detections and changes into the client’s existing security tools.
06 — TEST
Verify detection, false positives and whether interventions interrupt the attack.
07 — LEARN
Use results to refine future attacks, sharpen detections and revisit earlier evidence.
COMPOUNDING CHAIN INTELLIGENCE:
CONTEXT, RELATIONSHIPS, CAUSAL
The chain remains available after the engagement, together with its evidence, detections and test results.
Use that record to refine future attacks, sharpen detections and revisit earlier evidence as your organisation changes.
The learning stays connected to the attack that produced it.
[ HOW BLACK TEAMING COMPARES ]
Use the security tools
you already have.
ACE provides an intelligence and detection engineering layer for your existing monitoring and validation workflows. Check the evidence retained, deployment requirements, engineering effort and test results using the same finding.
Compare using your own findings.
Compare using your own findings.Bring your own findings: ACE ingests existing red team and pen test outputs, so prior work becomes deployable detections.
[ See the Interactive Control Log ]Frequently asked questions
Get the attack.
Get the detections.
Tell us what you need to protect. We’ll show you how Black Teaming preserves the attack chain as a usable defensive capability through the Interactive Control Log and ACE.
.png)
