Home / Methodology
Kill Chain Replay™ methodology
How every Ghost Ops engagement is scoped, executed, reported and retested — built on recognized standards and written so auditors can follow it.
Kill Chain Replay™ is Ghost Ops Security's penetration testing methodology: each finding is delivered as a step-by-step, reproducible attack path — from initial access to business impact — mapped to MITRE ATT&CK, MITRE ATLAS and the OWASP Top 10 lists.
Phase 01 of 06
Scope & threat model
We map assets, data flows and what an attacker would actually want — then agree rules of engagement in writing.
- Asset & data-flow inventory
- Threat-actor profile
- Rules of engagement
- Emergency contacts
Standards we test against
Our methodology aligns with:
PTESNIST SP 800-115OWASP WSTGOWASP API Security Top 10OWASP MASTGOWASP LLM Top 10 (2025)MITRE ATT&CKMITRE ATLASNIST AI RMFISA/IEC 62443
Rules of engagement
- Written scope, testing windows and emergency contacts before any traffic
- Safety-first testing for production and OT systems
- Critical findings reported immediately, not at the end
- All client data handled on locally hosted, air-gapped tooling — never sent to third-party AI
- Every scoping conversation covered under NDA