External Penetration Testing
Full-scope attack simulation against your internet-facing assets. We enumerate, probe, and exploit — then hand you the roadmap to shut it down.
Learn moreRed Team Operations
BREAK YOURDEFENSESBefore the enemy does
Offensive security assessments that expose real vulnerabilities. We think like attackers so you can build like defenders. A red team division of Pendergrass Consulting.
Scroll
Attack Surface
Offensive Security Services
Every engagement is tailored to your threat model. We execute manual, intelligence-driven operations that mirror real adversary behavior.
Internal Network Assessment
Post-breach simulation. We map lateral movement paths, privilege escalation chains, and domain compromise routes from inside your perimeter.
Learn moreSocial Engineering
Phishing, vishing, pretexting, physical intrusion. Your human layer is the most exploitable attack surface — we prove it and train it.
Learn moreWeb Application Testing
OWASP Top 10 and deep business logic testing. Injection, auth bypass, API abuse — manual tradecraft with automated coverage.
Learn moreAdversary Simulation
Full red team engagements mapped to MITRE ATT&CK. We simulate real APT campaigns to stress-test your detection and response.
Learn moreVulnerability Assessment
Systematic identification and risk-rated prioritization of security weaknesses. Actionable remediation paths with business context.
Learn moreSecurity Awareness Training
We attack your employees with real phishing and social engineering campaigns, measure who falls for it, then train them on exactly what they missed.
Learn moreOSINT & Reconnaissance
External attack surface mapping — exposed services, leaked credentials, employee data, and publicly available intelligence that adversaries are already collecting about you.
Learn moreDifferentiators
Why Offend & Defend
We're operators with real infrastructure experience who understand both sides of the fight.
Operator-Led Testing
Every assessment is executed by experienced practitioners with real-world sysadmin and DevOps experience — not junior analysts following a checklist.
Business-Focused Reporting
Executive summaries your leadership can act on, and technical findings your engineers can remediate immediately.
Small Business Specialists
Enterprise-grade offensive security scaled for organizations that don't have a Fortune 500 budget.
Full-Stack Perspective
We manage production infrastructure daily — Linux, Windows, firewalls, SIEM, web apps. We attack what we defend.
Remediation Support
Through Pendergrass Consulting, we help fix what we find.
Retesting Included
Every engagement includes a retest window at no additional cost.
Kill Chain
Engagement Lifecycle
Structured methodology adapted from PTES and MITRE ATT&CK. Controlled, documented, high-impact testing.
PHASE 01
Recon
Scoping, OSINT, rules of engagement. We define your attack surface before a single packet leaves our machines.
PHASE 02
Enumerate
Active scanning, fingerprinting, vulnerability mapping. Building the complete attack graph.
PHASE 03
Exploit
Controlled attacks, pivoting, escalation, objective capture. Every action logged, every risk managed.
PHASE 04
Report
Executive summary, technical PoCs, remediation roadmap. Live debrief and retest included.
Intel
Frequently Asked Questions
Red team testing is a full-scope adversary simulation where we attempt to achieve specific objectives using real attacker tactics. A pentest is scoped to a specific system. Red team tests your detection and response across people, processes, and technology simultaneously.
A vulnerability assessment identifies weaknesses through scanning. Penetration testing actively exploits those vulnerabilities to prove real-world impact — showing what an attacker could achieve, not just what theoretically exists.
External pen tests run 1-2 weeks, internal assessments 1-3 weeks, and full red team operations 2-6 weeks. All include scoping, testing, reporting, debrief, and a retest window.
We operate under strict rules of engagement. Destructive techniques are excluded unless authorized. We coordinate timing and maintain constant communication throughout.
Yes. We're based in Selma, NC but serve clients nationwide. Most offensive security work is conducted remotely across healthcare, finance, manufacturing, legal, and technology.
Executive summary, detailed technical findings with PoC evidence, CVSS risk ratings, prioritized remediation roadmap, live debrief walkthrough, and included retesting at no additional cost.
Initiate
Request an Assessment
Tell us about your environment and we'll scope an engagement that delivers real results.
Every engagement starts with a conversation. We'll respond within one business day with a tailored proposal.
Pendergrass ConsultingFull-service IT consulting — web dev, managed IT, cloud backup, cybersecurity. pendergrassconsulting.com →