// Offensive Security Practice
We attack your organisation the way a real adversary would — under written authorisation, mapped to MITRE ATT&CK, and with every step documented — so you find out what actually breaks before someone else does.
ISO 27001 · ISO 9001:2015 certified
Every engagement runs under written authorisation and an agreed Rules of Engagement document.
// 01 — Why run one
Cyberattacks and data breaches are not prevented by a once-a-year checklist. They are prevented by regular testing, continuous reinforcement, and monitoring that reflects how attackers actually operate.
Red teaming simulates real-world attacks to test technology, people, and process defences together — because a real adversary does not respect the boundary between them.
A Red Team Assessment is a goal-based activity designed to test the effectiveness of an organisation's security controls — and to understand how resilient the organisation is to real-world attack.
Measure how effective your defences really are across email, perimeter, internal network, and wireless surfaces.
Find out whether your team detects the activity, how quickly they escalate, and what they do once they know.
Analyse technology, configuration, and human behaviour before a real adversary gets the chance to.
Receive a prioritised, risk-based plan that improves overall security posture — not a raw tool export.
Every active scenario is executed under written authorisation and an agreed Rules of Engagement document, with clear scope, deconfliction contacts, and emergency stop procedures.
// 02 — The practice
PT. Alnair Inovasi Solusindo (ALINDO), founded in 2017, is an Indonesian technology company delivering advanced IT and cybersecurity solutions. Our offensive security practice brings together penetration testers, red team operators, and security analysts who combine deep technical expertise with a disciplined, ethics-first approach.
To be a leading cybersecurity partner that empowers organisations to operate with confidence — anticipating adversaries, hardening defences, and turning security into a business enabler rather than an afterthought.
Delivering realistic, threat-informed security assessments.
Strengthening our clients' ability to prevent, detect, and respond to attacks.
Translating technical findings into prioritised, actionable remediation.
Building long-term security partnerships, not one-off transactions.
Upholding the highest ethical and legal standards in every engagement.
The same four values have governed how ALINDO works since 2017.
// 03 — Engagement modes
Which one you need depends on the question you are trying to answer. Most mature programmes eventually run all three.
Tactics, Techniques & Procedures (TTPs) — every mode is executed against the same threat-informed methodology.
// 04 — Attack lifecycle
Red team engagements follow a structured attack lifecycle to simulate real adversary behaviour, identify security gaps, and deliver actionable insight. Stages 3 to 5 are the post-compromise phase — the part that tells you how far an attacker could actually get.
Initiate and align on engagement objectives, scope, and the Rules of Engagement.
Gain a controlled foothold through social engineering or exploitation of an exposed service.
Recon · Phishing · Exploit
Move across the environment and elevate privileges toward the engagement objective.
Post-compromise
Establish a foothold and maintain presence across reboots and credential changes.
Post-compromise
Demonstrate extraction of targeted data or files — evidence is minimised and masked.
Post-compromise
Evaluate results, map findings to ATT&CK, and deliver reporting and debrief.
// 05 — Framework
ATT&CK is the common standard for globally observed cyberattack patterns. Every finding we report is mapped back to a tactic and technique, so your team can act on it with the same vocabulary your detection tooling already uses.
MITRE ATT&CK® is a registered trademark of The MITRE Corporation. Reference: attack.mitre.org. The Cyber Kill Chain® is a registered trademark of Lockheed Martin.
// 06 — Scope of work
We test the human layer, the technology, and the processes that connect them — so you can strengthen what actually matters. Every scenario below states what is being tested and which control it exercises.
Showing all 40 scenarios
Tests the human factor and your email and communication controls across multiple remote social-engineering channels.
Spoofed IT or HR notification carrying a link to a fake login page, to harvest employee credentials.
Tests: Employee awareness · Email gateway
Highly personalised email targeting executives or finance managers, impersonating vendors or partners.
Tests: Executive awareness
Office macro, PDF, or HTM attachment simulating a payroll or compliance document.
Tests: Anti-malware · EDR / sandbox
Calling employees while posing as IT helpdesk or a vendor, to request credentials or an MFA bypass.
Tests: Helpdesk procedure · Awareness
SMS carrying malicious links — bank, SaaS, or OTP themed — sent to employee smartphones.
Tests: Mobile awareness
QR codes embedded in emails or printed posters that lead to a malicious page.
Tests: Awareness · Mobile security
Push-prompt bombing, or an AiTM proxy used to capture MFA tokens and live sessions.
Tests: MFA configuration · Conditional access
Impersonating a locked-out employee to convince the helpdesk to trigger a password reset.
Tests: Helpdesk identity verification
Tests the resilience of your perimeter and internet-accessible assets, approached as an external attacker with no initial access.
Gathering public information — domains, IPs, emails, technologies, leaked data — with no direct interaction with your systems.
Tests: Digital footprint management
Mapping internet-facing assets and the services exposed on them.
Tests: Attack surface management
Scanning servers, gateways, and public services for known vulnerabilities.
Tests: Patch management
Testing public applications for SQL injection, XSS, IDOR, authentication bypass, and related classes.
Tests: Secure coding · WAF
Discovering subdomains, misconfigurations, and subdomain-takeover conditions.
Tests: DNS management
Trying common passwords across many accounts on OWA, VoIP, and VPN endpoints, while deliberately avoiding lockouts.
Tests: Password policy · MFA
Reviewing weak ciphers, deprecated protocols, and expired or misissued certificates.
Tests: Cryptography & certificate management
Finding open backups, exposed configuration files, and directory listings.
Tests: Web server hardening
An assumed-breach simulation. The attacker starts with an initial foothold — typically one employee account — and works to escalate access up to full domain control.
Mapping hosts, services, and topology after gaining an internal foothold — shares, firewalls, VPN, servers, and workstations.
Tests: Segmentation · Monitoring
Mapping users, groups, GPOs, trusts, and attack paths through the directory.
Tests: AD hardening
Capturing credentials and hashes from broadcast name-resolution traffic on the local network.
Tests: Network hardening
Extracting and cracking Kerberos service tickets offline to obtain usable credentials.
Tests: Service account password strength
Recovering credentials and hashes from process memory or the registry.
Tests: EDR · Credential Guard
Authenticating with captured hashes or tickets, without ever knowing the password.
Tests: AD hardening · Admin tiering
Exploiting misconfigurations or vulnerabilities to gain higher privileges on a host or across the domain.
Tests: Hardening · Patching
Moving between hosts using discovered credentials and native tooling such as PsExec, WMI, and SMB.
Tests: Segmentation · Detection
Locating sensitive files — contracts, HR, finance — sitting on openly readable SMB and DFS shares.
Tests: Access control · DLP
Achieving full domain control as the final objective of the simulation.
Tests: Tiered admin model
Tests the security of your wireless infrastructure — corporate and guest WiFi, encryption strength, and segmentation between them.
Mapping wireless networks, hidden SSIDs, and signal coverage beyond your premises.
Tests: WLAN management
Capturing handshakes, then testing passphrase strength offline without touching the network.
Tests: Passphrase strength
Standing up a fake AP to capture credentials or redirect clients to a malicious page.
Tests: Wireless IPS (WIPS)
Bypassing the WiFi login page, and assessing whether it exposes user credentials.
Tests: Awareness · Portal security
Forcing clients to disconnect and reconnect, in order to trigger handshake capture.
Tests: 802.11w (PMF)
Testing WPS PIN weaknesses that allow an attacker to join the network outright.
Tests: AP configuration
Verifying that the guest WLAN is genuinely isolated from the corporate network.
Tests: WLAN segmentation
Awareness track — not executed against facilities
Category 5 is delivered as an awareness and education session. Physical intrusion techniques are explained and demonstrated conceptually — they are not performed against your buildings, staff, or access controls unless separately scoped and authorised in the Rules of Engagement.
Each topic is taught through real examples: the technique, the red flags to recognise, and the correct response — building lasting behavioural change rather than testing people without their knowledge.
How attackers follow staff through controlled doors, and the polite refusal scripts that stop it.
Reinforces: Access control · Staff confidence
How proximity badges are copied and vendor or contractor identities are faked.
Reinforces: Badge policy · Visitor verification
Why a found drive is bait, what it does when plugged in, and what to do with one instead.
Reinforces: Endpoint policy · USB controls
The in-person and telephone pretexts used to extract information, and how to verify identity safely.
Reinforces: Identity verification procedure
What screens, whiteboards, and left-out documents give away in shared and public spaces.
Reinforces: Clean-desk policy · Privacy screens
How much an organisation reveals through discarded paper, and what secure disposal requires.
Reinforces: Secure disposal · Shredding policy
The three-step behavioural model, plus the escalation routes staff should actually use.
Reinforces: Security culture · Reporting channel
// 07 — Advanced scenarios
Beyond the core categories, these scenarios are added according to your organisation's needs and security maturity.
An integrated multi-vector campaign — phishing, physical, and internal combined into one continuous operation.
Red and blue team collaboration to improve detection in real time, tuning rules as the attack runs.
A campaign built directly from a chosen threat-actor profile, with full TTP mapping and coverage reporting.
Azure, AWS, and GCP configuration and identity testing — including Entra ID and IAM privilege paths.
Employee endpoint and mobile application assessment, plus ransomware readiness and impact simulation — without any real encryption.
Modelling a malicious employee who already holds legitimate access, and what they could reach undetected.
// 08 — Methodology
Our red teaming methodology follows industry best practice to simulate real-world adversaries and deliver insight your team can act on.
Define objectives, scope, and assumptions — and sign the authorisation.
Build target profiles and map the potential attack surface.
Execute phishing or exploitation to gain a controlled foothold.
Perform internal recon and escalate privileges toward the objective.
Assess wireless and any secondary access scenarios in scope.
Demonstrate impact on the crown-jewel objectives agreed at scoping.
Consolidate findings, map them to MITRE ATT&CK, and brief both audiences.
Provide guidance, then re-test the priority findings to confirm they are closed.
Our methodology is aligned with industry-recognised frameworks to ensure comprehensive coverage and measurable results.
We emulate real attackers to uncover what matters most — so you can strengthen your defences with confidence.
// 09 — The team
Our red team brings a combination of adversarial mindset, technical depth, and disciplined execution — which is what turns an exercise into a security outcome.
Certified operators with hands-on experience across phishing, external, internal / Active Directory, and wireless attack paths.
Engagements mapped to MITRE ATT&CK and aligned with PTES, OSSTMM, and NIST, so results reflect real adversary behaviour.
Every active scenario runs under a written Rules of Engagement with clear scope, deconfliction, and emergency stop procedures.
Findings delivered with proof-of-concept evidence, business-risk context, and prioritised remediation — not raw tool output.
Remediation guidance, retesting, and optional purple-team collaboration to measure and improve detection.
A Red Team structure focused on real-world attack simulation, identification of critical vulnerabilities, and actionable insight that strengthens your security posture.
Runs offensive attack simulations to identify vulnerabilities and security gaps in systems and applications.
Conducts threat research, analyses emerging attack techniques, and supplies the intelligence behind each operation.
Develops and automates tooling and technique to improve the efficiency and consistency of security testing.
// 10 — Governance
These rules exist to reduce risk and protect your organisation throughout the engagement. They are agreed before any active testing begins.
Written authorisation is required before testing. Scope and exclusions are documented, including compliance with applicable law and the treatment of third-party assets.
Approved testing windows, prohibited actions, and deconfliction are defined up front — including off-limits systems, emergency procedures, and explicit approval for any destructive action.
A kick-off meeting aligns stakeholders on objectives and governance. Regular status updates run throughout, with immediate escalation for critical findings.
All data is confidential and stored securely. Evidence collection is minimised, sensitive data is masked, and everything is destroyed per the agreed policy on completion.
Target ranges, domains, and physical exclusions are finalised during scoping and documented in the Rules of Engagement.
Testing windows and any hands-off systems — production-critical or safety systems, for example — are agreed in advance.
The physical social-engineering track is delivered as an awareness session and is not executed against facilities unless separately scoped and authorised.
Defined scope. Managed risk. Measurable value.
// 11 — Tooling
Engagements are delivered using industry-standard offensive security tooling, operated from a controlled testing platform. Tools are selected per scenario and used only within the agreed scope.
Testing is iterative and flexible by design, and all work performed adheres strictly to the agreed Rules of Engagement.
// 12 — Deliverables
Comprehensive reporting designed for both executive and technical audiences, with clear remediation paths — because a finding nobody can act on is not a finding.
A concise, business-focused overview of the engagement, key risks, and overall posture.
Each finding documented with description, affected assets, proof-of-concept evidence, and reproduction steps.
Impact and likelihood ratings for every finding, prioritised for remediation.
The end-to-end attack story, mapped to MITRE ATT&CK techniques.
Actionable, prioritised guidance to close each finding and strengthen detection.
Example figures shown to illustrate report structure only.
COVERAGE: 8 of 14 tactics · 22 techniques observed
Each topic is explained through examples — the red flags to recognise and the correct response — building lasting behavioural change rather than testing facilities directly.
// 13 — Questions
A penetration test aims for breadth — it enumerates as many vulnerabilities as possible in a defined system within a defined window. A red team exercise aims for depth against a goal: reach a specific objective, such as domain control or access to a crown-jewel dataset, using whatever authorised path works. A pen test tells you what is vulnerable; a red team tells you what an adversary could actually achieve, and whether you would notice.
Yes, always. No active scenario runs without signed written authorisation and an agreed Rules of Engagement document covering scope, exclusions, testing windows, prohibited actions, deconfliction contacts, and emergency stop procedures. This is not a formality — it is what separates an authorised exercise from a criminal offence, and it protects both sides.
Duration depends on the categories in scope and the size of your estate. Scoping is where this gets settled — the eight-phase methodology runs from Rules of Engagement through to reporting and debrief, with an optional retest afterwards. Get in touch for a scoping call and we will give you a realistic window rather than a generic number.
Avoiding disruption is a design goal, not an afterthought. Testing windows and hands-off systems — production-critical and safety systems in particular — are agreed in advance and written into the Rules of Engagement. Destructive actions require explicit separate approval, and an emergency stop procedure is in place for the whole engagement. Ransomware readiness scenarios simulate impact without any real encryption.
A full engagement report with an executive summary and detailed technical findings, each carrying proof-of-concept evidence and reproduction steps; a risk assessment with impact and likelihood ratings; the end-to-end attack narrative mapped to MITRE ATT&CK; and a prioritised remediation roadmap. Executive and technical debrief sessions are included.
Both. Purple teaming runs our operators alongside your defenders so detection rules can be tuned while the attack is live — it typically produces more durable improvement than a blind exercise. Retesting is an optional eighth phase: once you have remediated the priority findings, we re-test them and issue a report confirming they are closed.
// Start here
Every engagement starts with a scoping call: your objectives, your constraints, and what is genuinely off-limits. No testing happens until that is written down and signed.