A security firm is hired to break into Spud Buds. With permission, on a schedule, and with a promise to explain exactly how they did it. Meet the crew, the people they're up against, and how the job runs from handshake to report.
In the movies, the heist starts with a crime. In real life, it starts with a contract. Nothing happens until the client and the firm agree, in writing, on what's allowed.
Which parts of the building the crew may test, and which are off limits. A rented app, for example, may need its owner's permission too.
Dates, working hours, what counts as "stop", and what the crew must never do, like touching real customer money or taking anything home.
A signed letter from the client saying this work is approved. It's what separates a security test from a crime, and the crew carries it for the whole job.
Usually only a handful of leaders at the client know a test is happening, so the defenders behave normally. There's always a named person to call if something goes wrong.
In security, the people who play the attacker are called the red team. The same name is used for the biggest kind of job, where most of the crew works together. Either way, security testing isn't one skill. It's a team of specialists who rarely do each other's jobs. Someone who tests networks works very differently from someone who tests a single web app, and both differ from someone who tests whether staff will hold the door.
Every heist film has the people running the casino. In security they're the blue team: the defenders whose job is to notice, respond and recover. A good test is as much about them as about the crew.
Once the paperwork is signed, the job runs in a few broad beats. What happens inside each beat depends on the specialists and the scope, and that part stays between the crew and the client.
Understand the company the way an outsider would see it.
Pick the approaches that fit the scope and the client's real worries.
Each specialist works their part, inside the rules.
Prove it could be done, then stop. Nothing is kept or damaged.
For where each kind of test starts and which rooms it covers, see the Security view of the Spud Buds building.
This is where real life beats the movies. The crew hands everything back and explains exactly what they did, so the company can fix it.
A short, plain account of what was at risk and how serious it is.
How small weaknesses lined up into something bigger. Usually the most useful part.
Each problem, ranked by how much it matters, with what to change.
Crew and house sit down together and walk through it. Often there's a retest later to confirm the fixes worked.
Spud Buds, the firm and the crew are made up. Nicknames are for fun; real teams use job titles. This page describes what each role is for, not how the work is done.