EDR & XDRTesting.

Get started

Endpoint detection gap analysis and evasion testing

Your EDR is only as good as what it catches.

Most organisations deploy an EDR, check the dashboard, and assume they are covered. We test that assumption by running the same evasion techniques advanced threat actors use. If it misses something, we show you exactly what slipped through.

Vendor agnostic. Mapped to the MITRE ATT&CK matrix. Measurable before and after.

Five ways we test it.

From custom evasion to a visibility map of your blind spots.

  1. 01

    Evasion testing

    We build custom payloads designed to bypass your EDR. Not generic malware samples from a library. Real evasion techniques adapted to your specific vendor and configuration.

  2. 02

    Detection gap analysis

    We walk through the MITRE ATT&CK matrix technique by technique and map exactly what your EDR catches and what it misses. A full visibility map of blind spots your defenders don't know about.

  3. 03

    Response validation

    Does your EDR actually block and quarantine, or does it just log and hope someone reads the alert? We test whether automated responses fire, on the right things, and whether they can be bypassed.

  4. 04

    Telemetry verification

    We check whether your EDR is actually seeing everything on the endpoint: process creation, network connections, file writes, registry changes. If the sensor has blind spots, the SOC has blind spots.

  5. 05

    Purple team hardening

    Your blue team works with our operators in real time. We attack, they detect, we tune detection rules together. Every round closes more gaps and builds knowledge in your SOC.

Six categories. Real attack techniques.

What we test your EDR against.

  1. 01

    Process injection

    DLL injection, process hollowing, reflective loading. Testing whether your EDR catches code running inside legitimate processes.

  2. 02

    Living off the land

    PowerShell, WMI, certutil, mshta. Using built-in Windows tools the same way threat actors do. No binaries dropped, nothing to scan.

  3. 03

    Credential dumping

    LSASS access, SAM extraction, Kerberos attacks. Does your EDR flag someone pulling all the passwords off a machine?

  4. 04

    Lateral movement

    Pass-the-hash, PsExec, WMI remote execution, RDP hijacking. Testing whether EDR tracks movement between hosts.

  5. 05

    Defense evasion

    Tamper protection bypass, EDR component disabling, log clearing. Testing whether the EDR can protect itself from someone who wants it gone.

  6. 06

    Exfiltration channels

    DNS tunneling, HTTPS C2, encrypted beacons. If data is leaving your network through legitimate protocols, does your EDR notice?

From deployment to measurable improvement.

  1. Scope & deploy

    We review your EDR vendor, configuration, and detection rules. Then we deploy our test tooling on agreed endpoints, coordinated with your team to avoid operational disruption.

  2. Execute techniques

    We run through ATT&CK techniques methodically. Each technique is logged: triggered, missed, or partial.

  3. Detection report

    Which techniques your EDR caught, which it missed, and which triggered inaccurate or noisy alerts. Mapped to the ATT&CK matrix with remediation guidance.

  4. Tune & validate

    We work with your SOC to tune detection rules based on the gaps. Then we re-test to confirm the improvements actually work.

What you receive.

Detection report
Which techniques your EDR caught, which it missed, and which triggered inaccurate or noisy alerts. Mapped to the MITRE ATT&CK matrix with remediation guidance.
Visibility map
A full map of the blind spots your defenders do not know about.
Before-and-after results
After tuning, we re-test to confirm the improvements actually work.

Research.

All articles

What changes.

Your EDR is not protecting what you think it is.

We run the same evasion techniques advanced threat actors use and show you exactly what your EDR misses. Detection gaps, response failures, and blind spots, mapped and measurable.

Talk to an operator