Full-Scope Red Team Assessment For A Multi-Site Healthcare Provider

Every engagement began where a real attacker would: with public information. We mapped the trust's internet-facing systems, staff profiles, supplier relationships and leaked credentials, building a detailed picture of the most promising ways in without touching a single internal system. Nothing was tested until the scope had been formally approved.

The research revealed exposed remote-access portals, outdated software banners and hundreds of staff email addresses in predictable formats. Several supplier websites also listed the exact medical systems the trust used, giving an attacker valuable clues about which vulnerabilities to look for and which people to target first in a phishing campaign.

The reconnaissance report alone gave the trust quick wins it could act on immediately, from removing unnecessary public information to closing forgotten portals. It also shaped the rest of the engagement, so every later step was based on genuine attack paths rather than a generic checklist of tests. It also showed leadership how much useful information an attacker could gather without breaking any law.

We designed targeted phishing campaigns tailored to each site, using realistic pretexts such as rota changes, payroll updates and supplier invoices. Emails were carefully timed around shift patterns, so they reached staff at the moments when they were busiest and least likely to stop and check. Every campaign was approved in advance by the trust's leadership.

Across all 12 sites, 34% of recipients clicked a link and a significant number entered their credentials on a cloned login page. The results were broken down by site, department and role, showing exactly where awareness was weakest and which types of message were the most convincing for clinical and administrative teams.

Rather than naming individuals, the findings were used to build targeted awareness training for the groups most at risk. Follow-up simulations three months later showed click rates falling to 11%, proving that focused, practical training can change behaviour quickly across a large, busy workforce. Repeat simulations now run every quarter to keep awareness high and track progress across each site.

Using credentials captured during the phishing phase, we gained remote access to the trust's internal network through a legacy VPN that did not enforce multi-factor authentication. From there, we operated quietly, using normal administrative tools so our activity blended in with everyday IT work. All activity was coordinated with a small trusted group inside the trust.

Within the first day, we had a stable foothold on a clinical workstation with access to shared drives, internal applications and network resources. None of this activity triggered an alert, which confirmed that the trust's monitoring was focused on external threats and had very limited visibility of suspicious behaviour inside the network.

This phase showed how a single successful phishing email could become a serious breach. It led directly to two of the most valuable fixes in the whole engagement: enforcing multi-factor authentication on all remote access and adding detection rules for unusual logins outside normal working patterns. Remote logins are now reviewed daily, and unusual patterns are escalated to the security team automatically.

From our first foothold, we mapped the Active Directory environment to find the fastest route to full control. Tools like BloodHound revealed chains of permissions, stale admin accounts and service accounts with far more privileges than they actually needed to do their jobs. Every move was logged carefully so it could be replayed later.

By cracking weak service account passwords through Kerberoasting, we moved between systems and reached domain administrator access within 48 hours. From that position, an attacker could have deployed ransomware across all 12 sites at once, accessed patient records at scale or disrupted clinical systems in ways that directly affected patient care.

Each step in the attack chain was documented with screenshots, commands and timings, so the security team could understand and reproduce it. The remediation plan focused on breaking these chains permanently, through stronger service account passwords, tiered administration and the removal of unnecessary privileges across the domain. A repeat test six weeks later confirmed that the same route to domain administrator access was fully closed.

The trust believed its medical devices sat on isolated networks that could not be reached from the corporate environment. We tested that assumption carefully, working with clinical engineering teams to make sure no device in active use could be affected by our testing. Clinical safety always took priority over completing any single test.

We found undocumented connections between corporate and device networks at several sites, created over the years for maintenance and supplier support. Imaging systems, infusion pump management servers and monitoring equipment were all reachable from a standard workstation, many running outdated software that could no longer be patched by the manufacturer.

Working with suppliers and clinical engineering, we designed a segmentation model that properly isolates medical devices while still allowing essential maintenance access. It was rolled out across all 12 sites without disrupting care, closing what had been one of the trust's most serious and least understood risks. Suppliers now connect through a monitored gateway, giving the trust a full record of every maintenance session.

Digital defences mean little if an attacker can simply walk in. With written authorisation, our consultants attempted to enter restricted areas at selected sites, posing as contractors, delivery drivers and visiting IT engineers during normal working hours. Every visit was coordinated in advance with senior site managers.

At two sites, we reached server rooms and network cabinets in under ten minutes by tailgating staff through secure doors and exploiting unattended reception desks. Once inside, we were able to plug a small device into the network, giving remote access that bypassed every perimeter control the trust had in place.

Physical findings were shared with estates and security teams straight away, and fixes were prioritised by risk. Access controls were upgraded, reception procedures tightened and staff briefed on challenging unfamiliar visitors, with every affected site retested and confirmed secure within 30 days. Spot checks now take place every quarter to make sure the improved procedures are still being followed.

Throughout the engagement, we kept a detailed log of every action and compared it with what the trust's security tools actually detected. This showed precisely where monitoring worked, where it produced noise and where attacks went completely unnoticed. This record became the basis for every improvement that followed.

Using that comparison, we worked with the security team to build new detection rules based on the exact techniques we had used, from suspicious Kerberos requests to unusual remote logins. Each rule was tested against our recorded activity to confirm it triggered reliably without flooding analysts with false alarms or low-value alerts.

After the new rules went live, a repeat of key attack steps was detected within minutes rather than going unseen. Estimated attacker dwell time fell from several days to under four hours, giving the trust a real chance to stop an intruder before serious harm was done. The security team now uses the same approach to test and improve its detection rules every few months.

The final report translated technical findings into a clear roadmap the board could act on. Each of the 24 critical and high findings came with a plain-language explanation, a business impact rating, an estimated cost and a recommended owner inside the trust. Findings were grouped so related fixes could be delivered together.

We then stayed involved during remediation, helping IT teams prioritise fixes, answering technical questions and retesting each issue once it had been addressed. Weekly check-ins kept progress visible to leadership, and quick wins were completed in the first fortnight to reduce the most urgent risks while larger projects were being planned.

All critical and high-severity findings were closed within 45 days. The trust now runs an annual red team exercise as part of its security programme, using the first engagement as a baseline to measure real improvement over time rather than relying on policy documents alone. Progress is reported to the board every quarter, keeping security firmly on the leadership agenda all year.