Anatomy of an attack
Scroll to follow one simulated attack on a Chennai business, from first scan to containment, and see where Ausec steps in.
Global view · attacks between countries48,213 attacks today (simulated)
// Penetration testing, PCI DSS, ISO/IEC 27001, Managed security
Audit. Assure. Secure.
Ausec watches your systems, finds the weaknesses before attackers do, and helps you respond when something happens. Managed security, penetration testing and AI security, from Chennai.
01 · Recon
Someone is already looking
Automated scanners sweep the internet around the clock, mapping exposed services, leaked passwords and unpatched software. Your organisation is on a target list long before anyone types its name.
$ scan 203.0.113.0/24 → 22, 443, 3389 open
Ausec: We run the same reconnaissance first, so you see your exposure the way an attacker does. Penetration testing →
02 · Initial access
One click is enough
A convincing invoice email, a reused password or a forgotten VPN appliance. The attacker only needs one way in, and people are the most common one.
$ auth success user=finance01 src=198.51.100.24
Ausec: Phishing simulations and awareness training make that click less likely, and easier to report. Security training →
03 · Detection
The minutes that matter
Once inside, attackers move quietly between systems and can go unnoticed for weeks. Spotting the unusual login or the odd data transfer early decides how bad the day gets.
$ ALERT impossible travel: finance01 Chennai → Frankfurt in 4 min
Ausec: Our managed security service watches your logs and alerts around the clock and triages what matters. Managed security →
04 · Response
Contained, then hardened
Isolate the host, reset the credentials, close the gap that let them in, then record what happened. That is the incident response cycle ISO/IEC 27001 (A.5.24 to A.5.28) and PCI DSS (12.10) expect you to run.
$ host WS-114 isolated · credentials rotated · rule deployed
Ausec: We help you respond, then fix the root cause so the same attack fails next time. How an engagement runs →
Demo feed
- highSQL injectionfrom 198.51.100.23→ Blocked by WAF
- mediumCredential stuffingfrom 203.0.113.77→ Rate limited
- mediumPhishing emailfrom 192.0.2.140→ Quarantined
- lowPort scanfrom 198.51.100.5→ Logged
- highDDoS (UDP flood)from Botnet (2,400 IPs)→ Scrubbed upstream
- mediumXSS attemptfrom 203.0.113.19→ Encoded, CSP enforced
- highRDP brute forcefrom 192.0.2.66→ Account locked
- highMalware downloadfrom 198.51.100.201→ EDR isolated host
- mediumSuspicious loginfrom 203.0.113.42→ MFA challenge
- mediumDirectory traversalfrom 192.0.2.9→ Blocked by WAF
- lowHoneypot touchfrom 198.51.100.88→ Alert raised
- highDNS tunnellingfrom 203.0.113.150→ Egress blocked
What we do
We watch your environment, test it the way attackers would, and help you respond when something happens.
- MSS
Managed Security Services
Around-the-clock monitoring, alert triage and incident response support.
24/7 monitoring · Alert triage · Incident response · Vulnerability management · Managed tooling
- VAPT
Penetration Testing and Security Assessment
Web, API, network and infrastructure testing, validated by hand.
Web applications · APIs · Networks · Infrastructure
- AI-SEC
AI Security
Testing for LLM applications, and guidance for adopting AI safely.
Prompt injection · Data leakage · API abuse · Secure adoption
- AGENT
Remote Agent Support
A lightweight agent for remote monitoring, patch checks and incident support.
Remote monitoring · Patch checks · Configuration checks · Incident support
// Standards we work to
The layers we test and harden
Most organisations run some version of this stack. Select a unit to see what it does and what we check.
- Filters traffic between networks according to rules.
- Inspects web requests and blocks attacks such as SQL injection and XSS.
- Watches network traffic for known attack patterns and can block them.
- Collects logs from across the estate and correlates them into alerts.
- Monitors endpoints for malicious behaviour and can isolate a machine.
- Verifies who is signing in, with a second factor.
- Keeps restorable copies of data, ideally offline or immutable.
- A decoy system that raises an alert when an attacker touches it.
Firewall
Filters traffic between networks according to rules.
We review rule sets for overly broad access and test what actually gets through.
● allowed● stopped
Watch an attack, then switch the defence on
A phishing attack, start to finish. Play it with the defence off, then on, and compare.
Simulation
- Attacker does
- Sends a convincing email that links to a fake sign-in page.
- System sees
- An email from a look-alike domain, then a login from an unusual location.
- Without defence
- The user enters their password and the attacker signs in as them.
Email filteringMFATraining
$ tail -f events.log
How an engagement runs
The same disciplined sequence for a penetration test, an audit or a compliance programme.
- 1
Scope and discover
We agree what is in scope and map every exposed asset. Nothing is tested without written approval.
- 2
Assess
Configuration, architecture and policy are reviewed against the standard that matters to you.
- 3
Exploit safely
Testers prove which weaknesses are real by exploiting them in an agreed, controlled way.
- 4
Harden
Each finding comes with a plain fix. We work with your team on the order to close them.
- 5
Monitor
We check that logging and alerting would catch the attacks we just ran.
- 6
Verify and report
We re-test the fixes and hand over a report you can share with auditors and customers.
How ready is your organisation?
Ten questions drawn from controls that PCI DSS, ISO/IEC 27001 and NIST CSF all expect.
Question 1 of 10
Do you have a documented, management-approved information security policy?