NSI’s Offensive Cyber Security Unit utilises a multi-layered approach based on industry best practice (ISO27001 to ISO27005, ASD Essential 8, ACSC), when conducting physical and cyber penetration testing.
NSI Global's Offensive Cyber Security Penetration Testing Methodology
Phase 1 – Intelligence and Planning
The first phase involves our Offensive Cyber Security Unit (OCSU) determining the logistics, scope, expectations, objectives, and goals of the services to be offered. This phase will also establish if we use a black, white, or gray box penetration testing method.
Phase 2 - Surveillance and Reconnaissance
This phase allows our team to gather detailed information about your organisation such as processes, information systems, applications, and technology utilised.
Phase 3 - Mobilisation
Once our team gains a complete understanding of the scope and components to be tested, the attack will be simulated in a controlled environment. This step is vital as the unit can determine where the limits of the test should end.
Phase 4 – Execution
The plan is now put into action. Our OSCU uses specialist methodologies and technologies to identify vulnerabilities across the agreed scope.
Phase 5 – Reporting
A comprehensive report including an executive summary will be complete. Our team will arrange a debrief with your executive and security teams.
Phase 6 - Mitigation
Recommended mitigation strategies and countermeasures will be thoroughly outlined for all exploits and vulnerabilities discovered.
Phase 7 - On-Going Review
A regular review schedule is implemented to review mitigations, countermeasures, and strategy. This ensures effectiveness of implementation, reveals arising vulnerabilities or concerns, and identifies opportunities for increased efficiency.
Frequently Asked Questions
What is the difference between black, white and grey box testing?
Black box means we begin with no internal knowledge, as an external attacker would. White box means full access to documentation, architecture and sometimes source code. Grey box sits between the two. Black box tests discovery as well as exploitation; white box finds more within the time available.
Do you retest after we remediate?
Yes. Phase seven is an ongoing review cycle, and retesting confirms whether a mitigation actually closed the issue rather than moved it.
What happens if you find a critical vulnerability mid-test?
We stop and tell you immediately rather than waiting for the report. Critical findings are escalated to the contact named in the rules of engagement, so remediation can begin while testing continues.
Speak with NSI Global
Testing is scoped and overseen by founder Navid Sobbi and delivered in-house by NSI Global’s own practitioners — never subcontracted. Every engagement is bounded by written rules of engagement agreed before testing begins.
Confidential consultations can be held at our radio-shielded office in Parramatta, or by client-approved video meeting.
NSI Global will not provide products or services to any individual or entity that is the subject of a law enforcement investigation.