About
We think like adversaries so defenders can win. 0gr3 Security Consulting runs realistic, threat-informed red team simulations that test people, process and technology together — then helps you turn every finding into a detection, a control, or a decision.
Principles
- Authorized engagements only — signed scope and Rules of Engagement first.
- Safety over trophies — no destructive actions, simulated data markers.
- Detection validation is the deliverable, not just a list of vulnerabilities.
- AI is advisory — a human authorizes every active action.
- Clear, warm, plain-English reporting for executives and engineers.
Services
- Red Team Adversarial Simulation
- Objective-based, threat-informed campaigns emulating real adversaries end to end.
- Assumed Breach
- Start from a foothold you provide; measure how far an attacker gets and how fast you respond.
- Purple Team
- Collaborative sessions with your SOC: execute, observe, tune detections, repeat.
- External / Internal Assessment
- Perimeter and internal network testing with prioritized, actionable findings.
- Social Engineering (authorized)
- Phishing, vishing and pretext simulations under explicit written approval and HR/legal sign-off.
- Wireless / RF Assessment
- Receive-only survey and authorized wireless testing of in-scope infrastructure.
- Reporting & Detection Validation
- Executive and technical reporting, MITRE ATT&CK mapping, detection coverage scorecards and retest.
Packages range from a free 30-minute scoping call to full red team campaigns; every engagement is scoped and quoted individually (no list prices published).
Process
- Scope & Rules of Engagement — objectives, threat model, in/out of scope, emergency stop, sign-off.
- Recon — passive intelligence gathering and planning.
- Exploitation simulation — controlled, authorized emulation of adversary techniques.
- Post-exploitation — objective pursuit, impact demonstration, detection measurement.
- Reporting — executive summary, technical narrative, ATT&CK heatmap, remediation.
- Debrief & retest — purple-team walkthrough, detection tuning, validation retest.
Rules of Engagement (summary)
- Signed authorization from an accountable owner before any activity.
- Explicit in-scope assets, time windows and a do-not-touch list.
- Named deconfliction contacts and an emergency stop word either side can use.
- Non-destructive by default; impact shown with simulated markers only.
- Evidence handled carefully and destroyed on schedule.
Operator
Michael M Schlosser (0gr3n) — Offensive Security Consultant with over 20 years of experience in adversarial and offensive security consulting. Senior Consultant, Offensive Security, Cyber Risk at Kroll; Member of the Board of Advisors (Red Teaming Division) at HACKERverse. Full resume: LinkedIn profile.
Service sheet
A one-page overview of services, process, engagement types and principles: 0gr3-service-sheet.pdf (PDF, 1 page).
Case studies
Composite / illustrative — based on typical engagement patterns, not a specific client. All numbers are illustrative. In the terminal: cases.
Healthcare: a two-week purple-team detection sprint
Healthcare (multi-site provider) · Purple team · 2 weeks, collaborative · composite / illustrative
Analysts, detection engineers and the red side in one room. Emulate, look together, tune, re-run.
What changed:
- Missing log sources onboarded, with health monitoring so they don't silently drop again.
- Vendor rules reviewed: noisy ones tuned, disabled ones re-enabled with exclusions.
- Asset criticality and identity context enriched into alerts.
- Short playbooks written for the alert types exercised, owned by the SOC lead.
- A coverage matrix adopted as the SOC's quarterly scorecard.
Regional financial services: assumed breach to the payments tier
Financial services (regional) · Assumed-breach red team · 4 weeks · composite / illustrative
From one ordinary workstation toward a simulated payments-tier objective. Privilege paths were the problem; detections followed fast.
What changed:
- A tiered administration model, with privileged-access workstations for the most sensitive roles.
- Service-account permissions reduced and credentials vaulted and rotated.
- Detection logic added for the unwatched log sources, and the auto-closed alert rule re-tuned.
- An escalation SLA agreed with the outsourced SOC for this alert class.
- A purple-team session scheduled each quarter to re-validate the missed techniques.
SaaS: external-to-cloud objective test
B2B SaaS (growth stage) · Objective-based red team · external start · 5 weeks · composite / illustrative
Could an outsider reach the production cloud control plane? Identity and CI/CD trust were the story.
What changed:
- Short-lived, federated credentials replaced long-lived keys for people and pipelines.
- CI/CD roles scoped to the minimum needed, with production deploys requiring approval.
- An external attack-surface inventory, reviewed monthly.
- Alerting on high-risk control-plane events, routed to on-call engineers.
- A redacted summary of the test shared with enterprise customers during security reviews.
Privacy
No cookies, no analytics, no tracking, and no third-party scripts or fonts — everything is served from this site.
The terminal remembers a few preferences (theme, plain view, sound, notifications, achievements, puzzle progress, the weather opt-in) in your browser's localStorage. They are never sent anywhere; clear them with your browser's site-data settings or the privacy clear command.
Local weather in the terminal tray is off by default. If you turn it on, your browser asks for your location (if you decline, an approximate IP lookup is made via ipapi.co / ipwho.is) and the forecast is fetched from Open-Meteo. Nothing is sent to 0gr3. Type privacy in the terminal for details or weather off to stop.
