Penetration testing and red teaming
We take the paths an adversary would take, prove they work, and hand you the full chain with the business impact attached. Testing is manual, performed by OSCP- and GPEN-certified operators, and documented so that your engineers can reproduce every finding.
Bought under NAICS 541512, 541519 and 561990.
What this service does
A penetration test answers one question honestly: what can someone actually do to you? Not what a scanner flagged, and not what a policy says should be true. We work from the same position an attacker occupies, chain the weaknesses we find, and stop at an objective agreed in advance.
Red team engagements go further. They are objective-driven, stealth-aware, and run against your live detection stack, so the deliverable includes a timeline of what your tooling caught, what it missed, and how long it took anyone to notice.
Our operators hold the Offensive Security Certified Professional and GIAC Penetration Tester certifications, and our security lead has directed offensive security work for the Defense Intelligence Agency, the FBI, and the U.S. Marine Corps.
What we assess and protect
- External network perimeter, exposed services, and forgotten subdomains
- Internal networks, including segmentation between enclaves
- Web and API applications, authentication, and authorization logic
- Cloud control planes in Azure, AWS, and Microsoft 365
- Active Directory and Entra ID: delegation, permission chains, and privilege paths
- Wireless networks, assessed by a GAWN-certified operator
- People, where phishing and pretexting are in scope
- Physical access: perimeter, badges, tailgating, and what a visitor reaches unescorted
How the work runs
Select any stage in the diagram to see what happens there. The same model drives the engagement plan you receive.
Select any stage to see what happens there. Aligned to NIST SP 800-115, the Penetration Testing Execution Standard, and the OWASP testing guides.
Scoping and rules of engagement
We agree the targets, the objective, the prohibited techniques, the testing window, and the escalation contact. Nothing starts until this is signed. The scoping call itself is free and carries no obligation.
Reconnaissance
External footprint, exposed services, credential exposure in public breach corpora, and the people an adversary would target. This stage touches nothing you own.
Exploitation and execution
Manual exploitation of what reconnaissance surfaced. We verify exploitability rather than reporting conditions, because a severity rating without a proven path does not tell you what to fix first.
Escalation and lateral movement
Local and domain privilege escalation, delegation abuse, and movement toward the agreed objective. We document the complete chain, including the steps that failed and why.
Reporting
Executive summary written for a non-technical reader, a full attack-path narrative, reproduction steps for every finding, business impact, and prioritized remediation.
Retest
Once you have remediated, we retest the findings and reissue the attestation. This is included in the engagement, not billed separately.
What you receive
- Executive summary suitable for a board or a contracting officer
- Technical findings with CVSS ratings, evidence, and reproduction steps
- Attack-path narrative showing how individual findings chain together
- Prioritized remediation plan with effort estimates
- Attestation letter stating scope, dates, and methodology
- Detection and response timeline (red team engagements)
- Free retest of remediated findings
How engagements usually start
Most clients come to us because a prime contractor, an auditor, or a cyber insurer asked for evidence of testing, or because something happened and they want to know what else is reachable.
The first step is a scoping call with the engineer who would run the work, not a salesperson. We will tell you what we would test, in what order, and what drives the price. If a smaller assessment would answer your question more cheaply, we will say that.
A penetration test is the wrong engagement during an active intrusion. Go to incident response instead, and flag it on the contact form so it is triaged ahead of the queue.
Physical security assessment
Network controls assume the attacker is remote. This tests the other assumption: what someone can do once they are inside the building. Scoped as part of a red team engagement, or run on its own.
Physical access defeats a great many technical controls. An unattended conference room with a live network port, a badge reader that fails open, or a reception process that lets a confident stranger past is worth more to an attacker than most remote vulnerabilities.
All physical testing is conducted under written authorization, with a named point of contact reachable throughout and an authorization letter carried by every operator. Safety and staff wellbeing take priority over the objective at all times.
The deliverable includes findings with photographic evidence where appropriate, an entry narrative describing exactly how access was achieved, and the analysis that matters most: where physical access converts into network access.
What we test
- Perimeter, entry points, and after-hours access
- Badge and credential systems, including cloning exposure
- Reception and visitor management process
- Tailgating and piggybacking resistance
- Unattended workstations, live network ports, and conference rooms
- Server room and wiring closet access control
- Document handling, clean desk, and disposal
Findings are written about process and control failures, never about named individuals. The purpose is to fix a system that allowed something, not to discipline the person who was standing there. We say this to clients before the engagement and we hold to it in the report.
Standards we test against
Naming the methodology is how you tell a real engagement from a scanner report with a cover page.
NIST SP 800-115
The federal technical guide to information security testing and assessment. Structures our planning, execution, and post-execution phases.
MITRE ATT&CK
Every technique we use is recorded against its ATT&CK identifier, so your defensive team can map coverage directly from our report.
OWASP testing guides
Web and API application testing follows the OWASP Web Security Testing Guide and the OWASP API Security project.
Who performs the work
Swif7Edge is small on purpose. The people who scope your engagement are the people who run it.
Our practice was founded by U.S. Army veterans. The security side is led by a combat veteran and former NSA contractor with 26 years in security engineering, who has built and led teams of more than 130 engineers, stood up global security operations centers, and directed offensive security work for the Defense Intelligence Agency, the FBI, and the U.S. Marine Corps.
That background is company-stated. Specific engagements are covered by non-disclosure terms and in most cases by the sensitivity of the work itself, so we do not detail them publicly. We will substantiate it directly during a procurement, with references and whatever contract detail can be released.
The strategy side brings more than 20 years across the Intelligence Community, the Department of Defense, and Fortune 500 operations, managing portfolios above $150 million and cross-functional teams of up to 2,500 personnel.
Credentials held on the team
- Offensive Security Certified Professional (OSCP)
- Certified Information Systems Security Professional (CISSP)
- GIAC Penetration Tester (GPEN)
- GIAC Certified Incident Handler (GCIH)
- GIAC Assessing and Auditing Wireless Networks (GAWN)
We do not publish client names, logos, or case studies. The work is mostly covered by non-disclosure terms, and a small firm that lists logos it cannot substantiate is making a claim it cannot stand behind. The certifications and registrations above are independently checkable, and the methodologies on each service page are named rather than described. Everything we say about our own history is company-stated and we label it that way.
Scope it before you budget it
Tell us the environment and the obligation. We will come back with the approach, the duration, and what drives the price — before anyone asks you for a number.
Common questions
If what you need is not here, ask us directly rather than filling in a form.
A penetration test enumerates and proves as many exploitable weaknesses as possible across an agreed scope within a fixed window. A red team engagement is objective-driven and stealth-aware: we pick a goal, such as reaching a CUI share, and pursue it against your live detection stack while measuring what your defenders saw. Most organizations should run penetration tests until findings stop surprising them, then move to red teaming.
Rules of engagement are agreed in writing before any activity, including which systems are in scope, which techniques are prohibited, testing windows, and an escalation contact reachable throughout. Denial-of-service techniques are excluded by default. Where a finding carries disruption risk we report it rather than exploit it.
A vulnerability scan is an input, not the deliverable. Scanners report conditions; they do not establish whether a condition is reachable, chainable, or exploitable in your configuration. Our reports distinguish proven exploitation from theoretical exposure, and the attack-path narrative is the part clients tell us they actually use.
Scope size, test type, and whether the work is stealth-aware. The variables are the number of live hosts and applications, whether internal and external perspectives are both required, whether social engineering is in scope, and the length of the window. We scope before we quote, and the scoping call is free.
Yes. Engagements include an attestation letter stating the scope, dates, and methodology, suitable for submission to an auditor, a prime contractor, or a cyber insurer. Retesting of remediated findings is included.