Data theft: one way out is all it takes.

Our campaigns use synthetic payloads only: no real customer business data is used as a campaign payload, which is why they can run in production. The agent runs on a representative Windows machine in your estate (signed binary); other systems: ask us. You stay in control of the scope: together we define the segments tested, the agents and when each campaign runs. To get started, the POC runs a standard scenario with synthetic data from a representative machine placed in your network: the test traffic crosses your real egress controls, with no real business data.

A Windows software agent (signed binary) on a representative machine: one execution point per exit path or egress policy you want to test. One agent per VLAN or subnet may be needed when routing or policies differ. An orchestrator drives the agents and consolidates the results, and a console lets you launch and monitor campaigns. Agents in your environment, orchestration as an Enforcis SaaS; on-premises deployment possible, subject to assessment, for critical environments. Hybrid topologies (your private cloud) are under study. Upcoming versions will bring SIEM integrations.

With a 30-minute guided demo, on pre-built result sets, of how version 1.0 works and of its interface: a campaign across the 8 channels covered, the report and the report detail. Nothing to install, no contact with your environment. Next comes the POC: a standard scenario, with synthetic data, from a representative machine placed in your network. The test traffic crosses your real egress controls, with no real business data. Fast, usually free. Then a paid production pilot on a limited scope, with synthetic payloads only: dated results, a report you can read in detail, findings analysed with our team, and the campaign replayed on request to check the fixes. Together we set the scope, the duration and the launch date. After that, campaigns can be relaunched as needed. Upcoming versions will let you schedule periodic replays, or replays triggered by a change, depending on how critical the scope is and how fresh the results need to be.

Today, each campaign gives dated, traceable results within the scope actually tested: for each scenario, what was expected, attempted, transmitted, collected and persisted, the execution status (complete, partial, missing) and the observed transmission rate (transmitted / expected, in files and in volume), in a report you can read in detail. A transmission that does not complete is not, by itself, proof that a control worked: the reading against your DLP or SOC logs is done during the analysis. Tests are already mapped to MITRE ATT&CK in the console. Upcoming versions will bring multi-level reporting (leadership, CISO, operations), MITRE D3FEND where the correspondence is established, and SIEM integrations. They will also bring contextual, prioritised recommendations, validated by retest.