Services

Aegis & Spear runs five service lines: penetration testing, social engineering assessment, compliance audits, cybersecurity hygiene assessment, and strategic advisory. Each engagement is fixed-scope, fixed-fee, and time-boxed. Each produces a deliverable calibrated to the audience that needs to act on it, with remediation guidance specific enough to execute against. The pages below describe what each service is, what’s in scope, how engagements actually run, and who each engagement does and doesn’t fit.

Penetration Testing

Penetration testing produces a defensible read on what an attacker could actually do against the environment, not what a scanner reports as theoretically vulnerable. Aegis & Spear runs four engagement types under this banner: external, internal, wireless, and physical, each delivered as a fixed-scope, fixed-fee engagement against the Penetration Testing Execution Standard. Findings are prioritized by demonstrated exploitability and business impact, with remediation guidance specific enough for a sysadmin to act on without the tester present. Read more about penetration testing.

Social Engineering

Social engineering engagements measure how the organization actually performs when targeted by adversary tradecraft, with per-recipient verdict attribution and email gateway behavior characterized rather than assumed. Three engagement types are available: phishing, vishing, and physical pretexting. The deliverable is structured to drive program decisions rather than to embarrass employees, with pretext-class comparison surfacing where awareness program attention actually pays back. Read more about social engineering.

Compliance Audits

Compliance audits produce a defensible read on the gap between stated controls and operational reality, framed against the specific framework the organization is preparing against: NIST CSF, NIST SP 800-53, CIS Controls v8, ISO 27001, HIPAA Security Rule, SOC 2 Trust Services Criteria, or GLBA Safeguards Rule. The deliverable is gap analysis with a remediation roadmap sequenced for execution, not formal audit attestation. Read more about compliance audits.

Cybersecurity Hygiene Assessment

A cybersecurity hygiene assessment is the right first engagement when the organization isn’t yet sure whether it needs a penetration test, a compliance audit, or something else entirely. The engagement surveys foundational security posture against the CIS Controls v8 IG1 baseline, cross-walks findings into NIST CSF 2.0, and produces an honest next-step recommendation calibrated to what the organization actually needs to do next. Read more about hygiene assessments.

Strategic Advisory

Strategic advisory engagements operate above the technical testing layer: objective-based red team operations, secure architecture review for cloud and hybrid environments, executive tabletop exercises at the board or C-suite level, and incident response advisory. The work is available capability for organizations that have already passed through foundational and technical testing and now need outside perspective at the strategic level, where the architecture itself is the constraint or the strategic question requires evidence-based input. Read more about strategic advisory.