Founder-led adversary validation
We recreate the attack paths that matter and show you, control by control, what holds, what fails, and what to fix next.
Direct senior review. No sales handoff.
What we measure, end to end
The guardian threshold unlocks and the Offensive Guardian mark is revealed.
The evidence standard
Knowing a vulnerability exists is the easy part. What decides an incident is what your defense does while someone is using it: whether a control slows them down, whether the activity even reaches your telemetry, whether anyone notices and acts in time. That is what we put under test.
Did the expected preventive or limiting control change the path?
Was the activity visible with enough context?
Did logic and triage work when it mattered?
Was the right action taken in time?
Engagements
Each engagement is built around one material attack path, the defensive outcome it tests, and the evidence you need to act. No generic menu. You leave with a decision, not a backlog.
Entry sprint
Built forSOC and detection engineering leaders
We run the behaviors your detections are supposed to catch and follow each one from raw telemetry to the analyst who should act on it.
Outcome: A straight answer on which detections hold up, and a ranked list of the ones that don't.
2–4 weeks · Evidence matrix · Reproducible test cases · Focused retest
Collaborative
Built forPurple-team, SOC, and CTI leaders
We take a threat that actually matters to your business, emulate it with your team in the room, and replay it until the detections work.
Outcome: Your threat intel becomes detections you have watched fire, not a claim on a slide.
4–8 weeks · Scenario pack · Execution record · Replay package
Objective-led
Built forCISOs and cyber-defense leadership
An unannounced, objective-led operation against the whole organization, people and process included, under rules we agree up front.
Outcome: A defensible, evidence-backed picture of how you really perform when nobody is tipped off.
6–12 weeks · Executive narrative · Evidence timeline · Remediation/replay plan
A test is only true on the day you run it. Then you ship code, tune detections, and the answer quietly goes stale. We re-run the paths that matter on a set schedule, confirm last cycle's fixes actually held, and keep your evidence current instead of expiring with the report.
New attack surface
Agents and copilots are getting wired into production with credentials, tools, and data. Most were never tested the way an attacker would use them. We probe the privilege boundaries, the injection-to-action paths, and the detection story for AI-driven behavior, then hand you the evidence and the fix plan.
Grounded in current research: our founder has published on autonomous pentest agent risk and AI-driven command and control.
Illustrative evidence object
One object, shown in isolation. The full version, in context and across a whole engagement, is the sample report.
Hypothesis
Credential access activity should produce correlated endpoint and identity evidence before privilege expansion.
Observed break
Endpoint evidence present · identity correlation absent · analyst context incomplete
Defensive consequence
The path remains visible locally but not actionable as a coordinated incident.
Owner / retest
Detection engineering · correlation change · focused replay in 30 days
Methodology
Define the decision, threat relevance, critical path, safe operating constraints, and falsifiable hypothesis.
Execute realistic behavior under controlled rules, from atomic tests to chained objectives.
Capture the full defensive chain: control effect, telemetry, analytic behavior, analyst decision, and response.
Classify the break, assign ownership, preserve repeatable test cases, and prove the change through retesting.
Who does the work
Offensive Guardian is led by Jean-François Maes. He is the lead author of SANS SEC565: Red Team Operations and Adversary Emulation, co-author of SEC699: Advanced Purple Teaming, and a SANS Certified Instructor. He has worked for reputable security firms including NVISO, TrustedSec, and Fortra, where he was a Cobalt Strike researcher, with over a decade of hands-on offensive operations behind him. His open-source tooling, including LazySign, SharpZipRunner, and TrustJack, is used by red teams worldwide.
Most testing ends with a list. The useful work starts one step later: proving how the defense behaved while it mattered, and making the fix stick. That is the only work I do.
Five-minute diagnostic
Answer 12 non-sensitive questions across control assurance, telemetry quality, detection validation, and response cadence. See a useful four-dimension profile before we ask for email.
Sample profile · Directional, not a certification
Questions worth answering
In a short call we work out whether there is a real question worth testing, then point you to the smallest engagement that answers it. If there is not a good fit, we will tell you that too, and you still leave with a written next step.