Passive OSINT before touching any target systems. Shodan, Censys, DNS enumeration, certificate transparency logs, job postings revealing tech stack, and employee profiles.
We simulate a real attacker from first contact to domain admin — and document every step.