Are your security controls actually stopping attacks—or just generating alerts? 
Put Your Security Controls To The Test

Bishop Fox’s Adversarial Controls Testing (ACT) engagement determines the effectiveness of your email/phishing, endpoint, and network security controls using an adversarial, attack-based approach mapped to the MITRE ATT&CK framework. These collaborative engagements include testing plans tailored to your unique environment, executed by Bishop Fox Red Team experts leveraging purpose-built automated playbooks.

Standard engagements take three weeks or less to complete, upon which time you receive detailed, straight-forward results and recommendations to strengthen your defenses.

This detailed methodology guide covers:

• The complete ACT engagement process from kickoff to final reporting
• Pre-assessment planning and rules of engagement
• Active testing approach using MITRE ATT&CK-mapped TTPs
• How Bishop Fox and your Blue Team collaborate in real-time
• Example test cases for email, endpoint, and network controls
• Scoring methodology and assessment criteria
• Delineation of responsibilities between Bishop Fox and client teams
• Reporting structure and recommendations for control improvement

WHY ADVERSARIAL CONTROLS TESTING?

Traditional security assessments often focus on finding vulnerabilities in applications or infrastructure. ACT takes a different approach—testing whether your defensive security controls can actually stop real attacks.

Key benefits:

• Validate control effectiveness against real-world adversary behavior
• Identify gaps in prevention and detection capabilities
• Receive actionable recommendations to strengthen defenses
• Collaborate with Bishop Fox experts in real-time during testing
• Gain visibility into which attacks your controls block, partially block, or miss entirely

WHO SHOULD READ THIS METHODOLOGY:

• CISOs and security leaders evaluating offensive security testing approaches
• SOC managers and Blue Team leads responsible for detection and response
• Security architects designing defensive controls
• Compliance and risk teams validating control effectiveness
• Organizations preparing for adversarial controls testing engagements
  

Get detailed insights into how Bishop Fox conducts Adversarial Controls Testing engagements. This comprehensive methodology document outlines the step-by-step process, collaboration model, example test cases, and delineation of responsibilities critical to validating your security controls.