Know Your Blind Spots
Your security defences can only act on what it sees, which makes detection the foundation of every other security capability. And many organisations fall at this first hurdle.
Even if you see the attack how you respond is equally critical with attackers moving from break-in to spread across the network in an average of 29 minutes, and as little as 27 seconds (CrowdStrike 2026 Global Threat Report). Response effectiveness decides whether an alert becomes a contained event or a full breach.
The Detection Capability Test is a simulation-based, purple-team style exercise designed to show, with evidence, how effectively your organisation can detect, alert, and respond to realistic cyberattacks.
Scenarios Across the Attack Lifecycle
A typical one-day workshop covers around 40 attack scenarios across the relevant ATT&CK tactics, including:
A Repeatable, Collaborative Loop
Each scenario follows the same transparent pattern, run side by side with your team:
- Scenario launch - an attack is executed from an agreed internal workstation, or another approved starting point inside your environment.
- Notification - your Blue Team is told a scenario window has begun with enough context (approximate time, host, and vector) to investigate so the exercise can focus on validating visibility, triage, and response rather than covert compromise.
- Investigation - your team checks whether the scenario raised an alert in your monitoring tools, and whether it is visible in logs and telemetry, even if no alert was raised.
- Review & feedback - together we review what was detected, what was missed, what evidence was available, and what improvements can be made to address the shortfalls.
- Next scenario - the loop repeats until the planned set is complete.
The workshop runs on-site or remotely. Remote delivery simply requires access to the workstation and monitoring tools to be arranged and tested in advance.
Outcomes Designed for Action
The engagement answers the central question, can your team see and stop a real attack, and gives you a practical route to closing the gaps, delivered in three parts.
Technical Report: detailed findings for your SOC and security team. A description of each scenario executed and whether it was prevented, detected with sufficient context, partially detected, or missed, together with the alerts, events, or log evidence observed in each case. Includes concrete, practical recommendations for improving detection rules, logging and telemetry, and SOC processes.
Business Impact Report: an executive report for leadership that sets out your overall detection capability, where your biggest blind spots are, and what they would mean for the business if a real attacker exploited them. It gives clear, prioritised conclusions, an overview of the recommended improvements, and any executive decisions or investment needed to strengthen detection and response.
Assessment Debrief: a live walkthrough of the findings with our consultants. We talk your team through what was detected, what was missed, and why, answer questions, and set out the specific steps that will strengthen the areas we identified. You leave with a shared understanding of your detection gaps and a prioritised, practical action plan.
Detection is Our Day Job
A detection test is only as good as the people building the scenarios and reading the results. We manage the detection capabilities for our customers and respond to live incidents daily, so we know what real attacks look like, and we know how to spot them.
The test is built on more than 20 years of managed detection and response, incident response, and threat intelligence. The attacks we simulate are drawn from techniques used against organisations today and mapped to MITRE ATT&CK, not a generic script. The gaps we surface are the ones that matter against a real adversary.
