How Mandiant can help test and strengthen your cyber resilience
Ilan Lanz
Product Marketing Manager, Mandiant
Nadean Tanner
Head of ThreatSpace, Mandiant Academy
Your security program is robust. Your audits are clean. But are you ready for a real-world attack? A tenacious human adversary can create a critical blind spot for security leaders: A program can be compliant, but not resilient. Bridging this gap requires more than just going through the red-teaming motions.
To help security teams forge better instincts when responding to actual cyber-crisis events, we developed ThreatSpace, a cyber proving grounds and realistic corporate network that includes all the digital noise of real employee activities.
From gaps to battle: The ThreatSpace cyber range
The ThreatSpace environment is architecturally stateless and disposable to allow the deployment of real-world malware. It emulates the tactics, techniques, and procedures (TTPs) of real-world adversaries, informed by the latest, unparalleled threat intelligence from Google Threat Intelligence Group and Mandiant. By design, it never puts your actual business assets at risk.
Recently, stakeholders from the U.S. Embassy, the FBI, and Cote d'Ivoire cybersecurity agencies used ThreatSpace to conduct advanced defense training. Funded by the Bureau of International Narcotics and Law Enforcement Affairs (INL), this workshop brought together public and private sector partners to strengthen regional digital security.
“Cybersecurity is a team sport, and our goal is to make Cote d'Ivoire a safer place for Ivorians and Americans to do business. This five-day workshop, funded by INL, brought together world-class instructors from Mandiant with local agencies and private sector partners to build the collaborative muscle we need to defend against modern threats," said Colin McGuire, FBI law enforcement attaché, Dakar in Cabo Verde and Gulf of Guinea.
More than just helping to train individuals, we helped make the global digital ecosystem safer by uniting diverse groups of defenders facing shared threats. By practicing collaboration during a crisis, and operating as a unit, we can help empower defenders to fight and win against adversaries.
ThreatSpace provides a safe place for your team to miss an indicator of compromise, exercise processes, and stress test collaboration and build the muscle memory and confidence needed to execute flawlessly when real adversaries come knocking. This is where an Offensive Security red team assessment comes in.
Catch me if you can: The Mandiant red team reality check
The Mandiant red team doesn’t follow a script. Our work on the frontlines of incident response lets us see precisely how determined adversaries operate, including their persistent, creative approaches to exploiting the complex seams between your technology, your processes, and your people.
These observations enable our offensive security experts to mimic and emulate genuine threat actor behavior to achieve specific business objectives. Here are three scenarios developed by our red team to help stress-test and enhance our customers’ defenses:
- The "Impossible" Blackout. One organization believed their grid controls were isolated and secure. When our team demonstrated that a nationwide blackout was technically possible through their current architecture, the conversation shifted from compliance to survival. This finding empowered them to implement stricter controls immediately, preventing a theoretical catastrophe from becoming a reality.
- The Runaway Train. In another engagement, we gained remote system control of a locomotive train. The client didn't just get a technical report; they learned exactly how physical access vectors could bypass digital security. This exposure allowed them to harden their operational technology against vectors they had previously considered secure.
- The Generous Chatbot. Innovation brings new risks. In a recent test of a financial services chatbot, our team used simple prompts to bypass safety filters, ultimately convincing the AI to approve a 200-month loan at 0% APR. This finding prompted the client to immediately implement critical guardrails and grounding sources, ensuring they could innovate safely without exposing their business to manipulation.
From reactive to resilient
Building true cyber resilience requires a continuous feedback loop. It starts with analyzing your current state and enhancing your capability roadmap to align with operational priorities. Then you validate them through incident response learnings and offensive security insights and feed those back into the loop for the next iteration.
By combining these disciplines, and grounding them with threat intelligence, you can move your organization from a reactive posture to a state of proactive resilience. You find and expose your weaknesses today, so you can build the strength required to secure your future.
To battle-test your defenses, contact Mandiant to learn how our Offensive Security and ThreatSpace cyber range services can help you strengthen your defenses and build your resilience.
