What is offensive security?

Offensive security is the practice of safely simulating real attacks to find weaknesses before a genuine adversary exploits them. Defensive security asks how do we keep attackers out. Offensive security asks the harder, more honest question: if someone tried, what would actually happen? The only reliable way to know whether a control works is to attack it.

Why simulate the attacker

You cannot defend against a threat you do not understand, and you cannot understand an attack you have never seen executed against your own environment. Vulnerability scanners produce lists. They do not tell you which weakness an attacker would chain to which other weakness to reach the data that matters. A skilled human, now often an AI-assisted human, thinking like an adversary does.

Offensive security closes that gap. It produces evidence, not "this port is open" but "from a single phished user we reached your customer database in three hours, here is the exact path, and here are the four changes that break it."

The family of activities

"Offensive security" is an umbrella. The members differ in scope, knowledge, and goal.

A penetration test is the workhorse: a time-boxed, scoped, authorised engagement that goes beyond "is it vulnerable?" to "prove it, and show the impact." A red team raises the bar, emulating a specific adversary, staying stealthy, and pursuing an objective such as "reach the payment system" rather than enumerating every flaw. Purple teaming drops the stealth and runs the attack with the defenders so both sides learn.

The non-negotiable: authorisation

What separates offensive security from crime is explicit, written authorisation and a defined scope. Every technique you will learn is to be used only against systems you are contracted and permitted to test, within agreed Rules of Engagement. This is covered in depth in Rules of engagement and scoping, and it is the first thing any professional engagement captures.

A penetration test and a breach can use identical techniques. The difference is a signed scope, a defined boundary, and a duty of care. Never lose sight of which side of that line you are on.

Where AI fits, and where it does not

Modern operators increasingly work alongside an AI assistant. Used well, it accelerates the labour-intensive parts of the discipline: summarising reconnaissance output, suggesting next enumeration steps, drafting finding narratives from real evidence, and recalling the exact syntax of a rarely used tool. It is a force multiplier on breadth and speed.

Its limits are just as important. An AI model will confidently invent a CVE number, a command flag, or an "exploited" result that never happened. It has no inherent sense of your scope or your legal boundary. So the honest division of labour is this: let AI propose and draft, but a human verifies every claim against real output, approves every consequential or state-changing action, and owns scope and authorisation absolutely. Anything that touches credentials, changes system state, or leaves the agreed boundary is a human decision, never an automated one.

The mental models that follow

The rest of these fundamentals build the worldview a good operator carries into every engagement:

• Assumed breach: start from "they are already in," because eventually they will be.
• Defense in depth: the layered defence you are testing, and the lens for prioritising findings.
• The kill chain and MITRE ATT&CK: the shared language for describing how attacks unfold.
• Risk, impact and CVSS: how to turn "this is broken" into "this matters, this much."
• Engagement types and the penetration-test lifecycle: the shapes the work takes.

The techniques are the same ones a real adversary uses. The discipline around them, the authorisation, the duty of care, the honest reporting, is what makes it a profession.