Skip to content

Threat Simulation

Realistic attack scenarios, tailored to your industry

In a Threat Simulation, we replicate the tactics, techniques, and procedures (TTPs) of real threat actors in a controlled environment. The goal: test your defenses against the most relevant threats for your industry – before a real attacker does.

What is a Threat Simulation?

A Threat Simulation is a controlled security exercise where we replicate the behavior of known threat actor groups (APTs). Unlike a penetration test that identifies vulnerabilities, a Threat Simulation measures your organization's detection and response capabilities under realistic conditions.

Who Is This For?

Sector-Specific Scenarios

Finance

Simulation of APT groups targeting banking systems, SWIFT networks, and payment processing. Test your defenses against industry-specific threats.

Healthcare

Ransomware scenarios targeting patient data and medical devices. We test whether your critical systems withstand a targeted attack.

Manufacturing & OT

Attacks on industrial control systems (ICS/OT), supply chain compromises, and production disruptions – realistic scenarios for your manufacturing environment.

Available Modules

Assumed Breach Simulation

We start with an already compromised endpoint and test how far an attacker can advance in the network. Ideal for testing internal segmentation and detection.

Spear Phishing Campaign

Targeted phishing attacks on selected employees to test the effectiveness of awareness training and technical email filters.

Physical Social Engineering

Attempts to gain physical access to your buildings – through tailgating, forged badges, or social engineering at the reception.

Malware Infection Simulation

Simulation of a malware infection to test whether your endpoint security and SOC processes can detect and contain a compromise.

External Attack Chain

Complete external attack chain: reconnaissance, initial access, privilege escalation, and data exfiltration – an end-to-end simulation of an external attacker.

Our Methodology

01

Threat Intelligence

Analysis of current threats and attack patterns for your industry and infrastructure.

02

Scenario Development

Tailored attack scenarios based on real threats and your specific environment.

03

Simulation

Controlled execution of scenarios focusing on detection, response, and containment.

04

Analysis & Reporting

Detailed evaluation of detection rates, response times, and improvement opportunities.

From Our Engagements

Anonymized engagement example

A Swiss insurance company. 15 ATT&CK techniques. Only 4 detected.

Eleven missing detection rules implemented, thresholds corrected, three blind log sources connected. Detection rate improved from 27% to over 75%.

Detection rate: 27% Eleven missing detection rules Three blind log sources
Industry: Insurance
Scenario: APT Simulation
Duration: 5 days

A Swiss insurance company wants to test whether their security monitoring detects targeted attacks. 15 techniques from the MITRE ATT&CK framework particularly relevant to the industry are simulated — from initial access through credential dumping to data exfiltration.

Key Findings
  • Critical Only 4 of 15 simulated techniques are detected by the SIEM. Credential dumping (Mimikatz) and lateral movement (pass-the-hash) go completely undetected.
  • High Alerting rules for PowerShell-based attacks exist but are ineffective due to thresholds set too high
  • Medium Log sources from 3 critical servers are not connected to the SIEM — blind spots in monitoring

How It Differs from Pentesting

Criteria Penetration Test Threat Simulation
Scope Defined systems Scenario-based, industry-specific
Duration Days to weeks Weeks to months
Objective Identify vulnerabilities Measure detection & response
Stealth Not required Realistic attacker behavior

Your Deliverables

Threat Assessment Report

Comprehensive analysis of simulated threats with assessment of detection and response capabilities.

Attack Path Analysis

Documentation of simulated attack chains with timeline and detection gaps.

Detection Gap Analysis

Identification of gaps in your detection mechanisms with concrete improvement recommendations.

Prioritized Recommendations

Actionable recommendations to improve your detection and response capabilities, ordered by priority.

from CHF 8,000

Typical duration: 1–2 weeks

Inquire Now

Frequently Asked Questions

A threat simulation replicates the tactics, techniques, and procedures (TTPs) of real threat groups (APTs). Unlike a pentest that looks for vulnerabilities, a threat simulation specifically tests whether your security measures are effective against known attack patterns. The scenarios are based on frameworks like MITRE ATT&CK.

Yes. We analyze the threat groups relevant to your industry and their documented attack methods. The scenarios are based on current threat intelligence data and the MITRE ATT&CK framework. This way, we specifically test the attack vectors that pose the greatest risk to your organization.

You receive a detailed report with an overview of the tested scenarios, the detection rate of your security measures, and concrete recommendations. In the final debriefing, we discuss the results with your team and identify gaps in the detection chain – from initial access to data exfiltration.

Absolutely. We tailor every threat simulation to your industry – whether finance, healthcare, manufacturing, or public administration. The scenarios take into account industry-specific threat actors, regulatory requirements, and typical attack patterns in your sector.
Request a Quote