What is an assumed-breach start, and which detections can it never test compared with earned initial access?

## What "assumed breach" actually changes An **assumed-breach** engagement begins after initial access. By agreement, the client hands the operator the starting position: an implant installed on a managed workstation, a standard build to work from, or a valid low-privilege account. The exercise then measures what happens *after* someone is inside — discovery, credential access, lateral movement, persistence, collection, exfiltration. ### Why anyone would design it that way Time and certainty. Earning access is unbounded work: the operator may spend the whole engagement probing an internet-facing edge and never get in, and you will have paid a full engagement fee to learn that the perimeter held that week against that operator. An assumed-breach start guarantees the internal technique set — usually the thing the client actually wanted measured — is exercised. It is also the standard start for a purple exercise, where the point is per-technique detection evidence rather than a path. ### The cost, stated precisely Everything up to and including initial access is **outside the exercise**, and therefore unmeasured: - The internet-facing remote-access appliance's own authentication log records nothing about the exercise, because no credential was presented to it. - Perimeter flow records at the ingress point contain nothing attributable to it. (Those records carry the five-tuple, byte and packet counts and timestamps — they can show that a session existed and how much moved, and they carry no payload at all, so they never show what moved.) - Exploit-attempt detection on the public surface, phishing controls on the mail platform, and every preventive control at the edge are untouched. The trap is the report's reader. "No perimeter detections fired during the engagement" is true and worthless, and an executive will hear "the perimeter held". Absence of a signal on a surface that was never asked a question is not a pass; it is an untested surface. Say so in the limitations section, and write that section before you know the result. ### What earned access buys instead An earned-access engagement — the operator must find and use a real route in — tests the initial-access detections and the preventive controls for real, and it produces genuine artefacts on the edge surfaces: a successful authentication on the appliance from an unusual source, a session in the ingress flow records with byte counts consistent with a tunnel. Note the direction of claim even then: a successful authentication event proves **a credential was accepted**, not that the legitimate owner was present. Its costs are the mirror image. It is unbounded in time; it may consume the budget before any internal technique runs; the result depends heavily on what happened to be patch-current that fortnight; and a failure to get in is weak evidence, because it is one operator's sample. ### The hybrid most mature programmes buy Time-box the earned attempt, with a granted foothold as a contractual fallback: "if no access by day five, we place an implant on an agreed host and continue". You keep a genuine test of initial access while guaranteeing the rest of the technique set gets measured, and the report can honestly separate the two halves. ### One artificiality worth telling the SOC If defenders detect the assumed-breach implant and investigate, their investigation will dead-end: there is no upstream story, because there was no intrusion into the estate. A competent analyst will keep digging for an origin that does not exist. Debrief that explicitly, or the exercise quietly teaches the team that a missing entry point is normal — and record it as a known artificiality of the design rather than as a gap in the analyst's tradecraft.