Security Control validation
Cube Cyber's security control validation tests whether the controls you have paid for, EDR, email security, segmentation, backup isolation, logging and detection, actually behave as intended against current attack techniques, mapped to MITRE ATT&CK. It converts assumed protection into evidenced protection, and it routinely finds that the difference between the two is larger than anyone in the room expected.
Validate Our Controls
Control validation exists because deployment is not protection:
Validation earns its keep at specific moments: after deploying or replacing a major control, when the marketing claims meet your configuration; before renewals, when evidence of what the tool actually catches should inform what you pay; ahead of audits and insurance questionnaires, where evidenced answers beat asserted ones; and after incidents elsewhere in your sector, when the board asks would that have worked on us and deserves a factual answer. It also pairs naturally with red teaming, validation checks the controls, red teams check the whole defence.
Core capabilities & deliverables
Endpoint control validation
Structured execution of attack techniques against your EDR and endpoint stack, initial access behaviours, credential theft, persistence, evasion, measuring what is blocked, what is detected and what passes silently, per technique, per policy.
Email and perimeter validation
Delivery testing of current phishing and payload techniques against your email security, and probing of web filtering and perimeter controls, the entry points that begin most incidents, tested the way attackers actually use them.
Segmentation and containment validation
Practical verification that segmentation holds: what a compromised host can actually reach, whether management planes and backups are genuinely isolated, and whether the containment your architecture promises exists in packets, not just policy.
Backup and recovery validation
Testing that backups are isolated from the attack paths that ransomware uses, and that restoration actually works at the scale and speed an incident would demand, the control everyone reports and few have proven.
Detection and logging validation
Verification that attack techniques generate the telemetry, alerts and escalations they should, whether your monitoring is internal or ours, closing the gap between coverage claimed and coverage real.
Continuous validation programs
Scheduled re-validation as techniques evolve and environments change, turning a point-in-time answer into an ongoing assurance metric your security reporting can carry.
Validation runs as a controlled, repeatable discipline:
Select
Choose the controls and the ATT&CK techniques that matter for your threat profile, breadth is possible, but depth on the controls that carry your risk is usually worth more.
Execute
Run techniques in a controlled manner, agreed windows, safe payloads, production-respecting methods, recording outcomes per technique: blocked, detected, logged only, or silent.
Analyse and tune
Convert results into specific configuration, policy and detection changes, with our engineers or yours, this is where validation pays, in fixes, not findings.
Re-validate
Re-execute after tuning to confirm the improvement, and establish the ongoing cadence, because control effectiveness is a moving target.
Validation is mapped to MITRE ATT&CK and aligned to ASD Essential Eight strategies, application control, macro settings, hardening and backups all being controls the model expects to be effective, not merely present. Results provide the evidence layer for ISO 27001, APRA and insurer assurance, and feed detection engineering in our Managed Cybersecurity practice or your own SOC.
ISO 27001
MITRE ATT&CKAPRAFrequently asked questions
A penetration test finds paths through your environment; control validation systematically measures specific controls against specific techniques. A test might bypass your EDR once on its way to an objective; validation tells you which fifty techniques the EDR blocks, which it only observes, and which it misses entirely. One is a journey, the other is an audit of the guardrails.
Yes, by design. Techniques are executed with safe payloads and controlled methods, in agreed windows and against agreed systems, the goal is measuring control behaviour, not causing impact. Anything with production risk is flagged, scheduled or run in representative environments instead.
The ones carrying your riskiest assumptions: EDR blocking mode and coverage, backup isolation and restorability, segmentation around crown jewels, and email security against current phishing tradecraft. Those four cover the assumptions most ransomware incidents disprove, and validating them changes real decisions fast.
A per-technique, per-control scorecard, blocked, detected, logged, silent, with the configuration and detection changes that would move each result, then a re-validated scorecard after tuning. It reads as evidence, not opinion, which is exactly what boards, auditors and insurers want attached to the word protected.
Yes, and independent validation of managed controls is one of the most common engagements, the party operating a control should not be the only party attesting to it. Results are shared constructively with your provider, and where we are that provider, the same independence logic applies: validation evidence goes to you, not just to us.
Whenever the ground moves: after significant control changes or upgrades, after environmental change, and on a scheduled cadence, quarterly for the critical few, at least annually for the rest. Attack techniques update continuously; a validation result is a photograph, and the scenery keeps changing.
We're here to help.
Talk to a practitioner, not a call centre. Tell us what you're trying to solve and we'll come back to you within one business day. If you're dealing with an active incident, call us directly.
Send us a message
Tell us what you're trying to solve and we'll get back to you within one business day.
We use the details you provide to respond to your enquiry. Your information is stored in our Microsoft 365 environment and handled in line with our Privacy Policy, which explains how to access or correct it and how to make a complaint.