The technical frontline of cybersecurity

Within the Cyber & Privacy domain, the SecOps team plays a vital role in protecting organizations against digital threats. The team consists of highly skilled technical professionals and focuses on some of the most hands-on areas of cybersecurity: penetration testing, red teaming, and incident response. But what are these areas of cybersecurity?

Penetration testing represents a core capability within the SecOps service offering. It is a structured and controlled method of simulating real-world cyberattacks on an organization’s digital assets to uncover vulnerabilities before malicious actors can exploit them. These tests assess the resilience of client systems - including web and mobile applications, internal IT infrastructure, cloud environments, and externally facing services - against a wide range of cyber threats. The scope of each engagement depends on the type of penetration test being performed. For example, in a black-box test, little to no information is provided upfront, while a white-box test involves full access to system details, credentials, and architecture. Importantly, these tests are conducted in coordination with the client — meaning the client is informed about what will be tested, under which conditions, and how the assessment will be carried out.

Organizations frequently request penetration tests in response to growing regulatory requirements, particularly under frameworks such as the Network and Information Security Directive (NIS2) and the Digital Operational Resilience Act (DORA), which mandate regular security assessments and evidence of effective vulnerability management. Penetration testing is often conducted ahead of product launches, platform rollouts, or major system upgrades to support a secure-by-design approach and help prevent reputational or financial damage post-launch.

The testing process involves a combination of manual techniques and automated scanning tools, tailored to the client’s specific environment. SecOps analysts mimic attacker behavior to assess for weak configurations, outdated software, unpatched vulnerabilities, insecure coding practices, or improper access controls. Findings are documented in detailed reports, including root causes, detailed finding description, risks, and recommendations. If critical issues are identified, a follow-up retest can be performed to verify that the problems have been resolved.

Penetration testing can also include phishing simulations to evaluate the human layer of security. These simulations test how users respond to deceptive emails or messages, helping organizations understand the likelihood of successful social engineering attacks and identify where additional training or awareness efforts may be needed.

Overall, penetration testing within SecOps provides clients with a proactive, realistic view of their security posture, supports compliance, and strengthens their ability to manage cyber risk in a rapidly evolving threat landscape.

Red teaming offers a more comprehensive and realistic evaluation of an organization’s security framework than traditional penetration testing. In close collaboration with the client, a tailored attack scenario is designed to reflect likely threat actors or specific risks. These scenarios often combine multiple techniques such as social engineering, lateral movement within networks, and the exploitation of vulnerabilities in web applications or infrastructure - such as misconfigured services, outdated systems, or insecure authentication mechanisms - to simulate a coordinated, multi-step intrusion.

Unlike standard penetration tests - where the organization is typically aware of the assessment - red teaming is conducted with awareness restricted to a very limited number of individuals within the organization. The aim is not just to find weaknesses, but to test detection, response, and escalation procedures under realistic conditions. This approach helps reveal blind spots in monitoring, communication gaps, or delayed response times.

At the end of the exercise, a joint debrief with the client is held to walk through the full attack chain, highlighting what was detected, what was missed, and where improvements can be made across both technology and processes.

SecOps also provides critical support during cyber incidents, often collaborating closely with insurance providers or responding directly when a client faces a security breach. These incidents can include ransomware attacks, data exfiltration, denial-of-service (DDoS) attacks, and other forms of cyber intrusions that threaten business continuity, confidentiality, and data integrity.

Incident response within SecOps follows a structured and methodical approach, based on the key phases of the incident response lifecycle: preparation, identification, containment, eradication, and recovery. This framework ensures that cyber incidents are handled efficiently, minimizing disruption while providing clients with clear insight and support throughout the process.

Incident response begins long before an incident takes place. In the preparation phase, the SecOps team continuously monitors emerging threats, maintains up-to-date knowledge of the latest vulnerabilities and attack methods, and develops internal procedures and tooling. This proactive approach ensures the team is equipped to respond quickly and effectively when incidents do arise. In addition, clients are supported in improving their own preparedness, for example through tabletop exercises or by reviewing their existing detection and response capabilities.

The concepts of red and blue teaming originate from military terminology: red teams simulate attackers, while blue teams defend. The SecOps team specializes in red teaming, simulating real-world attackers to test resilience, but also contributes to blue team activities, including malware analysis and the development of detection strategies.

In advanced scenarios such as Threat-Led Penetration Testing (TLPT) - a requirement under DORA - red and blue teams operate in parallel over several months. Threat actors are emulated using specific tools and techniques agreed upon in advance. The exercise concludes with a lessons-learned session, reviewing detection capabilities and improving the organization’s defensive posture.Unlike standard penetration tests - where the organization is typically aware of the assessment - red teaming is conducted with awareness restricted to a very limited number of individuals within the organization. The aim is not just to find weaknesses, but to test detection, response, and escalation procedures under realistic conditions. This approach helps reveal blind spots in monitoring, communication gaps, or delayed response times.

At the end of the exercise, a joint debrief with the client is held to walk through the full attack chain, highlighting what was detected, what was missed, and where improvements can be made across both technology and processes.

Beyond testing and response, the SecOps team at KPMG also provides technical support to other teams and clients. This includes security architecture reviews, SOC optimization, and technical evaluations of controls.