Adversary simulation, three weeks to six hours.
Before
Three-week cycle to validate a single new tactic. Five engineers stitching together tooling that didn't talk to each other.
After
Tactics ship in under a day. One engineer owns each workflow end-to-end. Five initiatives run in parallel where one used to.
Where they started
The team ran adversary-simulation campaigns against the firm's own infrastructure — a Fortune-500-sized estate of public services, internal applications, and partner integrations. The work was important, well-funded, and stuck.
Validating a single new TTP took three weeks. Most of that time wasn't research — it was orchestration. Stitching enumerators, scanners, parsers, and reporting into one pipeline. Maintaining the scripts that glued them together. Coordinating five engineers around a workflow that wouldn't fit in one person's head.
What changed
They moved the orchestration off bespoke scripts and onto Trickest workflows. Each tactic became a graph: a composition of tools from the library, agents where reasoning was useful, and splitters where parallelism was. The same DAG ran on their infrastructure, against their targets, with their secrets.
Fleet handles the fan-out. A single workflow node can dispatch across hundreds of ephemeral runners, so the engineers stopped writing queue managers and started writing tactics.
What it shipped
Tactic-to-production dropped from three weeks to under a day. Each campaign is owned end-to-end by one engineer instead of five. The four engineers that came back are running four more initiatives — five parallel campaigns where there used to be one.
Coverage went from periodic to continuous: 100+ auto-scaling runners hold 500,000+ subdomains under live monitoring. The data lands in queryable tables, not PDFs.
By the numbers.
3 weeks → 6 hours
tactic dev cycle
5 → 1
engineers per workflow
5×
parallel initiatives
100+
auto-scaling runners
500,000+
subdomains under coverage
24/7
continuous coverage