Penetration Testing

And the winner is...

For another year in a row, ransomware dominates as the global leader of cybersecurity incidents.

With no signs of stopping or slowing down, ransomware continues to morph, mutate, and evolve as threat detection and prevention steadily improve (but still lag behind). "Double" and "Triple Extortion" Ransomware are now commonplace and assessing your organization's ability to detect external file transfers, rapid disk reads and writes, and unauthorized access are the keys to stopping it.

Since there's no silver bullet to buy (yet 🤞), we've developed a custom readiness assessment to help you understand your organization's capabilities when detecting, responding to, and recovering from ransomware.

Assessment

Simulation

Impact Map

Assessment

Readiness Assessment

Create a comprehensive view of your risk posture for ransomware attacks.

How It Works

We interview key IT personnel and review documentation, policies, and configurations. After information capture, SEVN-X identifies deficiencies within the organization’s IT governance, operating procedures, and technical controls that would hinder ransomware defenses or recovery.

Simulation

Evaluate whether controls can detect and prevent a zero-day ransomware variant.

How It Works

Using a custom ransomware simulator by SEVN-X and traditional penetration testing techniques, the tester deploys a binary that encrypts files in a specified directory without spreading beyond it. Encrypted files have extensions mimicking real-world ransomware, and the encryption key is sent to a SEVN-X-controlled server. This simulation targets on-premises file servers or cloud storage services like OneDrive and Google Drive using cloud connectors.

cyberpunk ransomware infecting to all computers in an open concept office space

Impact Map

Impact Mapping

Map out the potential impact or “blast-zone” of a ransomware infection.

How It Works

Network Shares are mapped to provide a potential scope of ransomware impact using different user bases (e.g., domain user, business analyst, server admin, etc.), to provide a list of data sources which could be compromised under different scenarios.