Oil / Gas / Energy
The Importance of OT Assessments in Critical Infrastructure
Why testing operational technology (OT) and ICS/SCADA systems is an operational imperative for securing critical infrastructure beyond compliance.
Penetration Testing
Uncover Vulnerabilities.
Exploit the Surface.
Defend the Network.
Lares Pen Test
Automated scanners are not enough.
Casual hackers are one thing; motivated adversaries targeting your sensitive data are another. Relying solely on automated vulnerability scanning leaves your organization blind to complex attack vectors, logic flaws, and zero-day exploits. Lares goes beyond the checklist, utilizing extensive manual assessment methodologies to uncover gaps before attackers can leverage them.
- Unpatched Network Edge Devices
- Hardware & Firmware Exposures
- Wireless & RF Spectrum Vulnerabilities
- Third-Party Supply Chain Risks
- Custom Protocol Exploits
- Insider Threats
Our Services
End-to-end network penetration testing and advisory.
Penetration Testing
Goal-oriented manual exploitation—whether black-box or collaborative—to identify vulnerabilities and attack vectors typically missed by automated tools.
Continuous Testing
In-depth security assessments conducted continuously as new assets, configurations, and applications are added to your enterprise environment.
Insider Threat Assessment
Simulated attacks conducted from the point of view of a trusted employee or contractor attempting to access high-value targets and data.
OSINT Services
Advanced intelligence collection from the surface, deep, and dark web to identify all accessible information posing a threat to your organization.
Hardware Testing
Extensive, specialized assessments of newly purchased device hardware and firmware to identify any inherent attack surface exposures.
RF Spectrum Analysis
Going beyond standard 802.11 and Bluetooth to test communications systems such as GPS, cellular, process control networks, and custom protocols.
Vulnerability R&D
Dedicated research discovering zero-day vulnerabilities in COTS applications, smart vehicles, and custom networking protocols.
Supply Chain Testing
Replicating the connection and integration into your organization’s supply chain to identify vendor exposures and threats before a loss can occur.
Our Methodology
A proven, outcome-driven process.
Mapping the Attack Surface
We begin by analyzing your infrastructure from an attacker's perspective. Using Open-Source Intelligence (OSINT) and advanced threat modeling, we map your external footprint to identify exposures, misconfigurations, and potential attack vectors before actively engaging your systems.
Key Activities: OSINT collection, architecture review, and custom threat modeling.
Breaching the Perimeter
Moving far beyond automated vulnerability scanners, our adversarial engineers actively attempt to circumvent your security controls. We safely exploit identified weaknesses to gain unauthorized access to systems, applications, or networks, demonstrating the true, real-world business impact of a breach.
Key Activities: Manual vulnerability verification, active exploitation, and initial access generation.
Expanding Access and Control
Once initial access is achieved, we emulate advanced adversaries to see exactly how far they could go. We attempt privilege escalation, establish persistence, harvest credentials, and execute lateral movement across your network to identify the blast radius of a successful intrusion.
Key Activities: Privilege escalation, credential access, command and control (C2) establishment, and lateral movement.
Framework-Driven Testing
Lares utilizes a hybrid testing approach that combines the Penetration Testing Execution Standard (PTES) with the MITRE ATT&CK framework. We thoroughly analyze the Tactics, Techniques, and Procedures (TTPs) used during post-exploitation to ensure our testing is repeatable, reproducible, and mapped directly to industry standards.
Key Activities: TTP analysis, MITRE ATT&CK mapping, and control effectiveness evaluation.
Actionable Remediation
We conclude every engagement with a detailed debrief session for management and key stakeholders. You receive a comprehensive report containing observations, findings, and prioritized recommendations—often including cost/effort estimates—to drive immediate and effective corrective action.
Key Activities: Executive summaries, detailed technical findings, remediation guidance, and stakeholder debriefing.
Frequently Asked Questions
What does a physical security assessment test?
A physical security assessment evaluates how well your facility, controls, and procedures prevent, detect, and respond to real-world threats. Depending on scope, that can include perimeter security, access controls, alarms, cameras, visitor handling, and physical attack paths.
How is this different from a secure site review?
A secure site review examines the effectiveness of existing physical controls and protections across the facility. Physical penetration testing goes a step further by validating whether those controls can actually be bypassed in practice.
Can Lares test more than doors and locks?
Yes. Lares’ physical security testing includes techniques such as lock picking, access system bypass, magnetic door brute forcing, camera redirection, alarm avoidance, elevator compromise, ventilation entry, badge compromise, and safe or vault access.
Do you test alarm and surveillance systems too?
Yes. Lares assesses the alarm systems in use and performs real-world testing to identify bypasses, backdoors, weak configurations, and other conditions that reduce effectiveness. The secure-site review process also looks closely at cameras and related protective controls.
Can this include social engineering or converged attacks?
Yes. Lares explicitly includes social engineering, tailing, badge procurement, access card cloning, solicitation, and converged electronic and physical attacks as part of its physical security testing approach. That matters because real attackers often combine methods instead of relying on a single path.
How do you scope the engagement safely?
Lares starts by characterizing the facility, identifying critical assets and undesired events, and defining a design basis threat before testing begins. That keeps the work realistic, controlled, and tied to the risks that matter most to the client.
What do clients receive at the end of the engagement?
Clients receive clear findings and practical recommendations to improve protection, detection, and response across the physical environment. Lares’ broader positioning also emphasizes actionable reporting and guidance that supports real improvement, not just issue identification.
How is this different from red teaming?
A physical security engagement focuses on facilities, physical controls, and attack paths into the environment. Red teaming is broader and tests protection, detection, and response across physical, electronic, social, and converged attack surfaces through active adversary simulation.
Looking for something else?
Some of Our Delighted Customers
"The expertise and professionalism that Lares' Purple Team brings to the table are unmatched. We will definitely be bringing them back for future engagements."
SVP & CISO, Hyatt
"They wanted to see us succeed as much as we wanted to see us succeed. This is why, 10 years later, we are still having this conversation."
(Former) Chief Compliance & Security Officer, The Word & Brown Companies
"The biggest benefit of having a Lares vCISO is getting guidance on how to tackle security issues and determining a realistic approach on how to address them."
Corporate Director of Technical Services, Ulbrich Stainless Steel and Speciality Metals Inc.