Stonegate Defense is an offensive security and incident response practice. We test your systems the way a real attacker would, tell you plainly what we found, and stay on the line until it is actually fixed.
Capabilities
Most of our work starts in one of these three places. It usually ends somewhere else, because a good test finds the thing nobody scoped for.
01
Adversary simulation against a defined scope, with written authorization and rules of engagement agreed before anything is touched.
02
Something is already inside. The priority order is stop the bleeding, preserve the evidence, then work out how far it got.
03
The part most firms leave you to do alone. A report is not an outcome; a closed finding is.
Method
No black boxes and no surprise invoices. You know the scope, the timing, and the escalation path before we start — and you hear from us the same day if we find something that cannot wait for the report.
The sequence below follows established public methodology rather than a proprietary one, so your auditors and your insurers recognise it.
Targets, exclusions, testing windows, escalation contacts, and a signed authorization to test. Nothing is touched before this exists in writing.
We build the same picture of your organization an attacker would — exposed services, forgotten hosts, leaked credentials, third-party footprint, and the people named on your website.
Validated exploitation only: we prove impact rather than forward a scanner's guess. Where a finding chains into something worse, we follow the chain and document each hop.
An executive summary a non-technical board can read, and a technical body with reproduction steps, evidence, and a fix for every finding. Then a live walkthrough with the engineers who have to do the work.
Findings prioritized by real-world risk, with owners and target dates. We stay available to your team while they close them.
Once the fixes land we test them again and issue a clean-state attestation letter you can hand to a client, an auditor, or an underwriter.
Standards we work to
Testing is mapped to public frameworks so findings translate cleanly into whatever regime you already answer to.
Adam Austin · Founder
Who you get
Stonegate Defense is led by Adam Austin, a twenty-year technology veteran and NITRO-certified practitioner. There is no bench of juniors behind the proposal — the consultant you meet in the scoping call is the one running the engagement and writing the report.
That matters most in the hours after a breach, when the useful thing is not a ticket queue but somebody who has seen this before, picking up the phone.
Emergency
Do not wipe the machine. Do not pay anything yet. Isolate what you can, leave it powered on, and get us on the line — the first two hours decide how much of this you can prove later.
Next step
Scoping starts with a conversation, not a questionnaire. Describe the environment and the concern; we will tell you what a useful test looks like — including when the honest answer is that you do not need one yet.