Scenario-Based Pentest: A Realistic Attack Scenario
Senior red team specialists execute a predefined attack scenario and test whether realistic attack paths reach critical assets.
What is tested and why it matters
Understanding whether a defined attack path reaches its objective.
Standard penetration testing identifies technical vulnerabilities in defined systems. It does not answer the question of whether a realistic attacker, following a specific attack path, can reach critical business assets. A scenario-based pentest bridges that gap. The scenario and approach are defined in collaboration with the client. Execution is covert: only selected contacts are informed, keeping the assessment realistic. Detection and response are observed as part of the assessment, not excluded from it.
Who needs this assessment
Organisations that benefit most.
This assessment is designed for organisations that want to validate specific threat scenarios relevant to their industry, risk profile, or regulatory obligations.
Organisations that want to validate specific threat scenarios relevant to their industry or risk profile
Companies with a Security Operations Centre or incident response team that need realistic validation of detection capabilities
Organisations that require a more targeted approach than full red teaming, with a defined scope and clear objectives
Security-mature organisations in regulated sectors (finance, critical infrastructure, government)
Companies that have completed standard penetration testing and want to test whether defences hold under realistic attack conditions
Critical infrastructure operators required to validate incident response under sector-specific threat scenarios
Where advanced testing is applicable
- Financial services: adversary simulation testing detection and response across trading and banking platforms.
- Critical infrastructure: scenario-based assessments validating incident response for essential entities.
- Corporate environments: physical access testing and phishing simulations measuring employee awareness.
- Organisations with a SOC or incident response team seeking realistic validation of detection capabilities.
What the assessment produces
The insight and evidence delivered at the conclusion of the assessment.
Every assessment concludes with a structured report covering scenario execution evidence, detection observations, technical findings, and remediation guidance. Reports are delivered through the Pentrox Portal and are available for download at any time.
- Validated evidence of whether a specific attack scenario can reach its objective
- Detection and response observations from the Security Operations Centre during the scenario execution
- Documented attack chain with evidence at each stage, from initial access through objective completion
- Prioritised recommendations for closing gaps in both technical controls and detection processes
- Portal access with findings, report downloads, and project tracking for the lifetime of the client account
How an assessment runs
- Scope and Intake
- Planning
- Assessment
- Reporting
- Findings & Retest
Retesting of remediated findings is included as standard with every assessment.
Assessment methodology
Five phases from scenario definition through strategic debrief.
Each phase builds on the previous one. Scenario definition guides reconnaissance, intelligence informs execution, and detection observations shape the strategic recommendations.
Scenario definition and scoping
The attack scenario is defined with the client. Threat actor profile, objectives, entry points, and boundaries are agreed. Only selected contacts are informed.
PTES (Pre-Engagement Interactions), NIST SP 800-115 (Planning)Reconnaissance and intelligence gathering
OSINT and targeted reconnaissance identify realistic entry points. Exposed services, employee data, and technology indicators are mapped to the scenario.
MITRE ATT&CK (Reconnaissance TA0043), PTES (Intelligence Gathering)Scenario execution
The predefined scenario is executed using techniques matching the threat actor profile. Activities remain within agreed boundaries and are non-destructive.
MITRE ATT&CK (Execution, Lateral Movement, Collection), PTES (Exploitation)Detection and response evaluation
The scenario timeline is compared against SOC detection events. Gaps between what occurred and what was detected are documented per attack stage.
MITRE ATT&CK (Detection mapping), NIST SP 800-115 (Assessment)Reporting and strategic debrief
Findings are validated by a second reviewer. The report documents scenario execution with evidence, detection observations, and prioritised recommendations.
PTES (Reporting), NIST SP 800-115 (Reporting)Scope and deliverables
What is included, what is excluded, and what is delivered.
The statement of work defines the exact scenario, target systems, and permitted techniques before the assessment begins. The lists below reflect the standard scope.
In scope
- Predefined attack scenario agreed with the client during scoping
- Network and application attack vectors aligned with the scenario
- Physical entry attempts (when agreed as part of the scenario)
- Social engineering components (when agreed as part of the scenario)
- Detection and response evaluation against the executed scenario timeline
- Privilege escalation and lateral movement within scenario boundaries
- Open-source intelligence gathering and targeted reconnaissance
- Evasion technique testing appropriate to the agreed threat actor profile
Out of scope
- Denial-of-service testing (unless explicitly agreed during scoping)
- Attack vectors, systems, or locations not included in the agreed scenario definition
- Comprehensive vulnerability assessment of all systems (covered under standard penetration testing services)
- Continuous monitoring or repeated testing cycles (covered under Pentest as a Service)
What you receive
- Executive summary Scenario objective, outcome, and detection effectiveness written for leadership.
- Attack chain documentation Evidence at each stage: initial access, lateral movement, and objective completion.
- Detection and response timeline What was detected, what was missed, and how response times compared to expectations.
- Technical findings Each finding documented with evidence, reproduction steps, OWASP risk rating, and remediation guidance.
- Portal access Real-time findings, report downloads, and project tracking through a dedicated platform.
- Findings meeting A scheduled session to align on risks, priorities, and the remediation approach.
- Management report Condensed report for board-level stakeholders covering scenario outcome and strategic recommendations.
Read more
How to choose your ethical hackers
Seven questions that reveal who will really test your systems.
AI versus human in penetration testing
Where AI helps, where senior judgement is irreplaceable, and how Pentrox combines both.
Red teaming versus penetration testing
Where a scenario-based pentest sits between a penetration test and a full red team assessment.
When independent assessment is the right step
An independent assessment is required ahead of an audit, a product launch, or a funding round, and the organisation needs documented evidence from a third party.
Digital platforms handle revenue, customer data, or service delivery, and the security of those platforms has not been validated by an external party.
Existing security controls have been implemented but have not been tested from an attacker perspective to confirm they work as intended.
Timeline
Illustrative durations to support planning. Confirmed in the statement of work.
The duration of a scenario-based pentest depends on the complexity of the agreed scenario, the number of attack vectors, and whether physical or social engineering components are included. The calibration bands below are indicative. Exact duration is confirmed in the statement of work.
What determines duration
- Complexity of the agreed attack scenario and number of objectives
- Number of attack vectors included (network, application, physical, social engineering)
- Whether physical entry or social engineering components are included
- Size and complexity of the target environment
- Whether detection and response evaluation is included in the scope
Actual duration is confirmed during scoping and depends on scenario complexity and permitted vectors. A statement of work confirms the exact scope and timeline before the assessment begins. The final report is delivered within five business days after completion of testing.
Why Pentrox
The operational standards behind every scenario-based assessment.
These operational standards apply to every scenario-based pentest Pentrox delivers, regardless of scope or scenario complexity.
Collaboratively defined scenarios
The scenario is designed together with the client, not imposed.
The attack scenario, threat actor profile, objectives, and boundaries are defined in collaboration with the client. Testing targets what matters most to the organisation.
Covert execution with detection evaluation
The SOC is not informed. Detection and response are part of the assessment.
Only selected contacts are informed. The SOC is not notified unless agreed otherwise. Detection capabilities and incident response procedures are evaluated under realistic conditions.
Direct access to the tester
No account managers between the client and the security expert.
Clients communicate directly with the ethical hacker performing the assessment. Critical findings are escalated immediately through the channel agreed at kickoff.
Portal-delivered results
Findings visible as they are identified, not weeks later in a PDF.
The Pentrox Portal provides findings tracking, report downloads, and project status visibility. Published findings appear as the assessment progresses. Reports are available for download immediately.
Senior-led testing
Every assessment is performed or supervised by experienced ethical hackers.
Pentrox does not delegate assessments to junior testers. Team members hold industry-standard certifications (OSCP, OSCE, OSWE, eWPTX, eMAPT, CPTS, CWES, BSCP) and every report passes internal quality review.
Frequently asked questions
Practical answers for security teams and procurement officers.
How does a scenario-based pentest differ from a standard penetration test?
A standard penetration test identifies technical vulnerabilities within a defined scope. A scenario-based pentest executes a predefined attack path to determine whether it can reach a specific objective. Detection and response are evaluated as part of the assessment, not excluded from it.
Is the methodology aligned with recognised standards?
The assessment follows PTES for structured testing methodology and MITRE ATT&CK for technique classification. NIST SP 800-115 is used as an additional reference for planning and execution. Standards references are documented in the report.
How is follow-up testing handled after remediation?
A follow-up assessment to verify remediation effectiveness can be arranged after the initial assessment. The scope and timeline of the follow-up are agreed separately. Technical findings from the initial assessment are tracked through the Pentrox Portal.
What clearances do the testers hold?
All Pentrox employees undergo PES (Personnel Screening) background checks upon commencement of employment. Team members hold one or more industry-standard certifications such as OSCP, OSCE, OSWE, eWPTX, eMAPT, CPTS, CWES and BSCP. Every assessment is performed or supervised by senior penetration testers.
Will the Security Operations Centre be informed before the assessment?
By default, the Security Operations Centre is not informed. This allows detection and response to be evaluated under realistic conditions. If the client prefers to inform the SOC, this is agreed during scoping.
Can the report be used as evidence for compliance audits?
The report documents the scope, methodology, scenario execution, findings, and remediation status in a format suitable for submission to auditors and certification bodies. It is worth noting that the report documents the technical assessment; it does not replace the audit itself.
How is assessment data handled and who has access to findings?
Findings, reports, and project data are stored in the Pentrox Portal, hosted on a dedicated VPS in a datacenter in the European Union. Access is controlled through mandatory two-factor authentication and role-based permissions. The client manages team membership. Data remains accessible for the lifetime of the client account and is removed only on explicit request.
What happens when a critical vulnerability is found during the scenario?
Critical or blocking vulnerabilities are communicated immediately through the channel agreed at kickoff. Findings are published in the Pentrox Portal as they are confirmed, so remediation can begin before the final report is delivered. The escalation path is documented in the statement of work.
Related assessment categories
Red Teaming
Full-scope adversary simulation across network, application, social engineering, and physical vectors.
Mystery Guest
Controlled physical access testing through social engineering and physical security exploitation.
Phishing Simulation
Controlled phishing campaigns that measure employee awareness and response behaviour.