SCHULTE & CO. · SCHEDULE C · THE SECURITY PRACTICE · INCIDENT READINESS & EVIDENCE

Prove the response.

An incident plan is a theory until the team has to use it.

Your security team has tools, procedures, logs, runbooks, escalation paths, and years of experience. The question leadership actually needs answered is simpler:

When something happens, can the team determine what is true?

We survey the environment your organization actually operates, recreate the systems and evidence that matter inside an isolated assessment range, introduce an unknown security condition, and observe your team investigate it for four hours. No production attack. No rehearsed answer. No known outcome.

At the end, leadership receives an evidence-backed measure of how well the organization can identify an incident, determine its scope, preserve the record, make containment decisions, and explain what actually happened.

ONE ENVIRONMENT MAPPED·ONE RANGE BUILT·ONE BLIND CASE·FOUR HOURS OBSERVED·ONE READINESS SCORE

FIG. C2

The Binder Test

POLICY IS NOT PERFORMANCE

Most organizations can show you an incident response plan. The plan says who should respond, which systems should be checked, when leadership should be notified, and what should happen next. It does not tell you whether any of that will happen.

A PENETRATION TESTmeasures whether a weakness can be exploited.

A TABLETOPmeasures whether a team knows what it should do.

THIS ASSESSMENTmeasures whether the team can actually investigate the environment it operates.

DOCUMENTED

✓IR PLAN

✓SIEM

✓EDR

✓ESCALATION MATRIX

✓FORENSIC PROCEDURE

✓CONTAINMENT PLAN

OBSERVED

?FIRST OWNER

?FIRST QUERY

?EVIDENCE FOUND

?ESCALATION TIME

?EVIDENCE PRESERVED

?SCOPE ESTABLISHED

?CORRECT DECISION

THE GAP IS THE ASSESSMENT

If someone was in your environment right now, how long would it take your team to prove how they got in, what they touched, whether they are still there, and when it started?

FIG. C3

The Environment Survey

CLOUD · ON-PREM · IDENTITY · APPLICATIONS · SECURITY · EVIDENCE

A generic cyber range tests generic skills. We start with the environment your team is actually responsible for.

Working with technology and security leadership, we map the infrastructure, cloud providers, identity systems, critical applications, security controls, logging sources, network boundaries, and operational dependencies that determine how an investigation would actually unfold. Not every system needs to be copied. Every system that changes the investigation needs to be understood.

INFRASTRUCTURE

E-01On-premise networks

E-02Cloud accounts & subscriptions

E-03Containers & orchestration

E-04Remote access

IDENTITY

E-05Active Directory

E-06Cloud identity

E-07SSO / MFA

E-08Privileged access

APPLICATIONS

E-09Critical business services

E-10Web applications

E-11Databases

E-12Third-party services

SECURITY & EVIDENCE

E-13SIEM

E-14EDR

E-15Cloud audit logs

E-16Network telemetry

E-17Retention & forensic sources

FIG. C3 · EVERY ASSET, TRACED TO ITS EVIDENCE. LINES THAT NEVER REACH THE PLANE ARE FINDINGS ALREADY.

ON-PREM AD┆AUTH LOG

ENTRA ID┆CLOUD AUDIT

AKS┆K8S AUDIT

ERP┆APP LOG · NO APP LOG

SQL┆DB AUDIT

ENDPOINTS┆EDR

M365 MAIL┆MAIL LOG · 30-DAY RETENTION

WE ARE NOT INVENTORYING TECHNOLOGY. WE ARE MAPPING WHERE TRUTH WOULD HAVE TO COME FROM DURING AN INCIDENT.

FIG. C4

The Reconstruction

BEHAVIORALLY FAITHFUL · ISOLATED · DISPOSABLE

We reproduce the portions of the environment required to make the investigation authentic: representative infrastructure, identities, applications, security tooling, logging relationships, network boundaries, and data flows. The assessment happens there. Production is not the target. Customer information does not need to become training data.

The objective is not pixel-perfect duplication. It is investigative fidelity: when an analyst follows the evidence, the environment behaves closely enough to the real organization that the decisions mean something.

FIG. C4 · A SECTION THROUGH BOTH ESTATES. THE RANGE ANSWERS TO THE SAME QUESTIONS; IT JUST CANNOT HURT ANYONE.

ENTRA ID┆DIRECTORY

AKS┆CONTAINER CLUSTER

M365┆MAIL / IDENTITY

CROWDSTRIKE┆ENDPOINT TELEMETRY

SENTINEL┆SIEM

ERP┆REPRESENTATIVE APP

SQL┆REPRESENTATIVE DATA

FUNCTIONALTELEMETRYIDENTITYNETWORKINVESTIGATIVE

FIG. C5

The Blind Case

ONE ENVIRONMENT · THREE STATES · SEALED UNTIL START

Before the assessment begins, an eligible case is selected from scenarios designed for the reconstructed environment. The responders do not know which state they received. Neither does the evidence give them an immediate answer. That uncertainty is intentional.

A security team that knows there is a breach behaves differently from one that has to determine whether a breach exists at all.

CASE 01

SIGNAL WITHOUT COMPROMISE

Something looks wrong. Nothing is compromised.

The team must distinguish suspicious activity from a security incident and build enough evidence to defend that conclusion.

THE QUESTION

Can you prove nothing happened?

CASE 02

BOUNDED COMPROMISE

Something happened. The first alert is not the full story.

One or more systems or identities are affected. Evidence exists across multiple sources, and the team must find where it stops.

THE QUESTION

Can you determine exactly where the incident stops?

CASE 03

ESTABLISHED PRESENCE

The incident began before the exercise did.

Persistence, historical artifacts, and lateral movement may exist across systems and time.

THE QUESTION

How far did the actor get, and how far back can you prove they were there?

THE DRAW IS BOUNDED, NOT RANDOM: ONLY CASES YOUR ESTATE COULD ACTUALLY PRODUCE ARE ELIGIBLE. THE SEAL BREAKS AT START.

FIG. C6

Four Hours

240 MINUTES · ONE TEAM · THEIR PROCESS · THEIR DECISIONS

The security and evidence team receives the case exactly as they would receive a real security concern: incomplete information and an environment they must interrogate. For four hours, they investigate. We observe rather than steer.

We record where they look, what evidence they request, which hypotheses they form, how quickly they abandon bad ones, whether they preserve volatile evidence, how they establish scope, when they escalate, and what actions they would take next. The exercise is not scored by whether someone guesses the answer. It is scored by whether the team's conclusions are supported by evidence.

FIG. C6 · THE INK LINE IS THE TEAM. THE VERMILION LINE IS WHAT ACTUALLY HAPPENED. THE ASSESSMENT MEASURES WHERE, AND WHETHER, THEY MEET.

00:00CASE OPENED

ALERT DELIVERED · INITIAL EVIDENCE IN HAND

00:15TRIAGE

WHO OWNS IT? · WHAT IS KNOWN? · WHAT IS ASSUMPTION?

01:00INVESTIGATION

EVIDENCE REQUESTED · HYPOTHESES FORMED · SYSTEMS CORRELATED

02:00SCOPE

AFFECTED IDENTITIES · AFFECTED SYSTEMS · PERSISTENCE? · EARLIEST ACTIVITY

03:00DECISION

CONTAIN? · OBSERVE? · ESCALATE? · PRESERVE?

04:00FINDING

WHAT HAPPENED? · WHAT DID NOT? · CONFIDENCE? · SUPPORTING EVIDENCE?

FIG. C6 · THE INK LINE IS THE TEAM. THE VERMILION LINE IS WHAT ACTUALLY HAPPENED. THE ASSESSMENT MEASURES WHERE, AND WHETHER, THEY MEET.

FIG. C7

The Readiness Score

LEADERSHIP GETS A MEASURE, NOT AN ANECDOTE

Security assessments often end with a long list of findings. This one ends with an answer: how prepared is this organization to determine what happened when the answer is not obvious? Every significant observation is tied to the investigation itself.

SEVEN DIMENSIONS · WEIGHTED TO WHAT LEADERSHIP NEEDS

TRUTH & SCOPEDo we actually know what happened and where it stops?/25

EVIDENCE & RIGORCan our conclusions survive scrutiny?/20

TIME TO UNDERSTANDINGHow quickly do we go from alert to defensible picture?/15

CONTAINMENT JUDGMENTWill we act without making it worse or destroying evidence?/15

VISIBILITY & COVERAGEDo our systems give responders what they need?/10

COORDINATION & ESCALATIONDoes the right person know the right thing at the right time?/10

DOCUMENTATIONCan another responder reconstruct our reasoning?/5

SECURITY RESPONSE READINESS · WORKED EXAMPLE74 / 100

OBSERVED

O-01Affected identity found in 17 minutes

O-02Endpoint telemetry checked before cloud authentication history

O-03Earliest known activity missed by 31 hours

O-04Proposed containment would have destroyed volatile evidence

O-05Escalation occurred only after scope was established

IMPLICATION

I-01STRONG INITIAL TRIAGE

I-02CLOUD INVESTIGATION GAP

I-03TIMELINE RECONSTRUCTION GAP

I-04EVIDENCE PRESERVATION GAP

FIG. C8

Train What Failed

OBSERVE · SCORE · TRAIN · REASSESS

A score without improvement is just documentation. The investigation tells us exactly where capability breaks down: technical knowledge, evidence handling, tooling, escalation, process design, communication, or visibility.

Follow-on sessions are built from those findings. Not generic cybersecurity training. The team trains the decisions it actually struggled to make.

OBSERVED GAP → FOLLOW-ON SESSION

Cloud identity correlation→Identity investigation lab

Timeline reconstruction→Evidence & chronology lab

Weak scoping→Lateral movement hunt

Evidence destroyed early→Preservation & containment drill

Slow escalation→IR command exercise

SIEM blind spot→Telemetry & logging workshop

Unclear ownership→Incident command redesign

ASSESSMENT 0174

│ TRAIN THE GAPS ▼

REASSESSMENT88

MEASURABLE IMPROVEMENT, NOT A ONE-TIME REPORT. THE BASELINE CARRIES TO THE NEXT EXERCISE.

WHAT YOU WALK AWAY WITH

D-01The environment mapSystems, identities, controls, telemetry, and evidence relationships

D-02The assessment rangeA customer-specific, isolated investigative environment

D-03The case recordScenario, ground truth, evidence trail, responder actions, timeline

D-04The readiness scorecardLeadership-level scoring with supporting evidence

D-05The capability gap registerPeople, process, technology, and visibility gaps observed

D-06The training planSessions targeted at the capabilities that need improvement

D-07The reassessment baselineA measurable starting point for the next exercise

WE DO NOT LEAVE LEADERSHIP WITH A LIST OF CVEs. WE LEAVE THEM KNOWING WHAT THEIR TEAM CAN PROVE.

[ COMMISSION SCHEDULE C ]REVIEW THE ASSESSMENT METHODRETURN TO THE STRUCTURAL SURVEY

SCHEDULE C · THE SECURITY PRACTICE · A SUPPLEMENT TO THE STRUCTURAL SURVEY · DRAWING STATUS: DESIGN STUDY · NOT FOR CONSTRUCTION

END OF THE DRAWING SETReady to talk?WORK@SCHULTEAND.CO · TAMPA, FLORIDA