Special Services • SP-12
Clandestine Offensive Security
Adversary emulation run without warning the defenders.
Scope
What the engagement covers.
A test the defenders know about measures readiness for a test. Authorized covert red teaming measures what would actually happen, combining digital intrusion, physical entry and social engineering under a signed mandate with a named authorizing officer.
Included capabilities
- Full-scope adversary emulation across digital, physical and human vectors
- Covert physical entry testing under written authorization and a get-out-of-jail letter
- Social engineering against staff with agreed ethical and welfare limits
- Objective-based operations targeting defined crown-jewel assets
- Purple team transition converting findings into detection improvements
- Detection and response measurement: time to detect, contain and escalate
Outputs and deliverables
- Signed authorization and rules of engagement
- Operation log with full activity timeline
- Findings report with detection and response timings
- Purple team detection improvement backlog
Workflow
How it is delivered, step by step.
Each step has an owner, an entry condition and an artefact that has to exist before the next step begins.
01AuthorizeWritten mandate, named authorizing officer, scope, limits and safe-word protocol.
02PlanObjectives, rules of engagement, deconfliction contacts and legal review.
03ExecuteCovert operation with continuous logging and a live abort channel.
04MeasureTime to detect, contain and escalate at each stage of the operation.
05TransferFull disclosure debrief and purple team conversion into detections.
Use cases
Where this is typically applied.
Critical infrastructure validating physical and cyber convergence
Boards seeking an unfiltered measure of real readiness
Delivery model
The operating pattern for Special Services.
The same delivery discipline applies across every capability in this line, so combined engagements stay coherent.
Assess
Threat picture, exposure, routine analysis and protective gap review.
Harden
Identity, device, communication, physical and information-domain controls.
Monitor
Continuous intelligence, exposure detection and early warning.
Respond
Containment, recovery, investigation and coordinated escalation.
Review
Post-incident learning, control adjustment and periodic reassessment.
Integration
- Client corporate security, legal counsel and communications functions.
- Existing IT and identity teams for account and device remediation.
- Insurers, local providers and law enforcement liaison where authorized.
- Family office and household staff protocols for the personal perimeter.
Engagement approach
Every mandate is scoped in writing with a named sponsor, defined coverage hours and a stated legal basis. Discretion applies to method and reporting channel, never to whether the work is lawful, authorized and recorded.
Related
Other capabilities in Special Services.
SP-01
Executive Digital Protection
Protect the person, not only the corporate perimeter.
SP-02VVIP Close Protection
Physical protection planned from intelligence, not from habit.
SP-03TSCM
Confirm the room is not listening.
SP-04Counter-Surveillance
Detect the people watching before they act.
SP-05Threat Intelligence
Early warning built from sources the principal cannot monitor alone.
SP-06Dark Web Monitoring
Find the exposure before it is used.
SP-07Identity & Reputation Protection
Defend the name as carefully as the person.
SP-08Private Investigation
Lawful fact-finding that stands up when it is challenged.
SP-09Strategic Communications
Control the narrative before it controls the outcome.
SP-10Incident Response
When it has already happened, speed and evidence both matter.
SP-11Human Risk
The most reliable way in is still the person.