04 — OSEP

The Offensive Security Experienced Penetration Tester (OSEP) path moves beyond individual-host penetration testing into the assessment of complex enterprise environments.

At this stage, the objective is no longer simply:

Find a Vulnerability
      ↓
Gain Access

Instead, you learn to think in terms of:

ENTERPRISE ENVIRONMENT
        ↓
IDENTITIES
        ↓
SYSTEMS
        ↓
TRUST RELATIONSHIPS
        ↓
SECURITY CONTROLS
        ↓
ATTACK PATHS
        ↓
BUSINESS IMPACT

OSEP-oriented skills are particularly relevant for:

Senior Penetration Tester

Enterprise Penetration Tester

Red Team Operator

Offensive Security Engineer

Security Consultant

Adversary Simulation Specialist

Perform enterprise offensive-security activities only inside systems you own, purpose-built labs, or environments where you have explicit authorization and clearly defined rules of engagement.

Certification Information

Certification: OSEP
Primary Domain: Advanced Enterprise Penetration Testing
Skill Level: Advanced
Career Direction: Enterprise Pentesting and Red Team Operations
Core Transition: Host exploitation → Enterprise attack-path analysis
Recommended Foundation: Strong OSCP-level networking, Windows, Linux, Active Directory, scripting, enumeration, privilege analysis, and reporting skills

What OSEP Should Build

Your preparation should develop competency around:

Enterprise Architecture

Windows Security

Active Directory

Identity Relationships

Authentication

Authorization

Privilege Relationships

Network Segmentation

Endpoint Security Controls

Application Control

Operational Security

Attack-Path Analysis

Adversary Simulation

Evidence Collection

Remediation

Professional Reporting

OSEP Career Position

A practical progression is:

NETWORKING
     ↓
LINUX + WINDOWS
     ↓
PENTESTING FUNDAMENTALS
     ↓
OSCP
     ↓
ENTERPRISE SECURITY
     ↓
ACTIVE DIRECTORY
     ↓
DEFENSE AWARENESS
     ↓
OSEP
     ↓
RED TEAMING
     ↓
SENIOR OFFENSIVE SECURITY

01 — Understand the Enterprise Pentesting Mindset

A single-host assessment may look like:

TARGET
  ↓
SERVICE
  ↓
WEAKNESS
  ↓
ACCESS
  ↓
PRIVILEGE

Enterprise assessments add another dimension:

IDENTITY
   ↓
WORKSTATION
   ↓
SERVER
   ↓
APPLICATION
   ↓
DOMAIN
   ↓
TRUST
   ↓
SENSITIVE ASSET

The security question becomes:

How Can Multiple
Individually Limited Weaknesses
Combine Into a Meaningful
Enterprise Attack Path?

02 — Think in Attack Paths

An attack path represents relationships between:

Identity

Privilege

System

Credential

Application

Network

Trust

Example:

STANDARD USER
      ↓
WORKSTATION
      ↓
EXCESSIVE LOCAL PRIVILEGE
      ↓
SERVER ACCESS
      ↓
PRIVILEGED IDENTITY EXPOSURE
      ↓
SENSITIVE RESOURCE

The important skill is understanding why each transition is possible.

03 — Build an Enterprise Architecture Model

Before testing, map the environment.

A simplified enterprise may look like:

                    INTERNET
                        |
                     FIREWALL
                        |
                       DMZ
                        |
              +---------+---------+
              |                   |
          WEB TIER            VPN / ACCESS
              |
          APP TIER
              |
          DATABASE

INTERNAL NETWORK
      |
      +-- User Workstations
      |
      +-- Application Servers
      |
      +-- File Servers
      |
      +-- Domain Controllers
      |
      +-- Management Systems
      |
      +-- Security Systems

04 — Identify Security Zones

Enterprise networks commonly contain zones such as:

Internet

DMZ

User Network

Server Network

Management Network

Database Network

Security Network

Backup Network

Cloud Network

For each zone determine:

Who Can Reach It?

From Where?

Using Which Protocol?

Under Which Identity?

What Security Controls Exist?

05 — Understand Trust Boundaries

A trust boundary separates different security contexts.

Examples:

Internet → DMZ

DMZ → Internal Network

User Network → Server Network

Workstation → Domain Controller

Standard User → Administrator

On-Premises → Cloud

Attack-path analysis frequently begins by asking:

Can This Trust Boundary
Be Crossed in a Way
the Organization Did Not Intend?

06 — Build an Asset Inventory

Document:

Asset	Role	Zone	Identity Context	Criticality
WS01	Workstation	User	Standard User	Medium
APP01	Application	Server	Service Identity	High
DC01	Domain Controller	Management	Domain Services	Critical
DB01	Database	Data	Service Identity	Critical

07 — Build an Identity Inventory

Enterprise security is increasingly identity-driven.

Inventory:

Standard Users

Administrators

Service Accounts

Application Identities

Domain Accounts

Local Accounts

Machine Accounts

Emergency Accounts

Third-Party Identities

08 — Build a Privilege Matrix

Create:

Identity	System	Privilege	Purpose	Expected?
UserA	WS01	Standard	Daily work	Yes
AdminA	SRV01	Admin	Server management	Yes
ServiceA	APP01	Service	Application	Yes
UserB	SRV02	Admin	Unknown	Review

This can expose:

Privilege Creep

Unnecessary Administration

Weak Separation

Unexpected Trust

09 — Understand Windows Enterprise Security

OSEP preparation requires strong Windows knowledge.

Understand:

Local Users

Domain Users

Groups

Privileges

Services

Scheduled Tasks

Registry

NTFS Permissions

Windows Firewall

PowerShell

Event Logging

Remote Administration

Windows Security Model

IDENTITY
   ↓
TOKEN
   ↓
GROUPS + PRIVILEGES
   ↓
ACCESS CHECK
   ↓
RESOURCE

10 — Understand Access Tokens

After authentication, Windows creates a security context containing information such as:

User Identity

Group Membership

Privileges

Integrity Context

Conceptually:

USER
 ↓
AUTHENTICATION
 ↓
ACCESS TOKEN
 ↓
RESOURCE ACCESS

Understanding this model helps explain why group membership and privilege assignments matter.

11 — Review Local Administrative Access

Local administrator rights are highly security-sensitive.

Assess:

Who Has Local Admin?

Why?

On Which Systems?

How Is Membership Managed?

Are Rights Temporary?

Are They Reviewed?

12 — Understand Privilege Creep

Privilege creep occurs when identities accumulate access over time.

USER
 ↓
PROJECT A ACCESS
 ↓
PROJECT B ACCESS
 ↓
TEMP ADMIN
 ↓
ROLE CHANGE
 ↓
OLD ACCESS NEVER REMOVED

Eventually:

EXCESSIVE PRIVILEGE

can create enterprise attack paths.

13 — Understand Active Directory Architecture

You should be comfortable with:

Forest

Domain

Domain Controller

Organizational Unit

Users

Groups

Computers

Group Policy

Trusts

DNS

LDAP

Kerberos

NTLM

AD Architecture

FOREST
  |
  +-- DOMAIN
        |
        +-- Domain Controllers
        |
        +-- Users
        |
        +-- Groups
        |
        +-- Computers
        |
        +-- OUs
        |
        +-- GPOs

14 — Understand Domain Controllers

Domain controllers provide critical services such as:

Authentication

Directory Services

Kerberos

Group Policy Distribution

Identity Management

They should therefore be treated as:

CRITICAL SECURITY ASSETS

15 — Understand Kerberos

At a high level:

USER
 ↓
AUTHENTICATION
 ↓
TICKET-GRANTING TICKET
 ↓
SERVICE REQUEST
 ↓
SERVICE TICKET
 ↓
RESOURCE

Your goal should be to understand:

Identity

Tickets

Service Accounts

Trust

Authorization

rather than merely memorizing attack terminology.

16 — Understand NTLM

NTLM remains relevant in many Windows environments because of:

Legacy Systems

Compatibility Requirements

Application Dependencies

From a security-assessment perspective, determine:

Where Is It Used?

Why Is It Required?

Can Usage Be Reduced?

What Monitoring Exists?

17 — Understand LDAP

LDAP provides directory access.

Conceptually:

CLIENT
  ↓
DIRECTORY QUERY
  ↓
DOMAIN CONTROLLER
  ↓
DIRECTORY OBJECTS

Directory information can include:

Users

Groups

Computers

Organizational Units

Service Information

18 — Understand DNS Dependency

Active Directory relies heavily on DNS.

Conceptually:

CLIENT
 ↓
DNS
 ↓
DOMAIN SERVICE LOCATION
 ↓
DOMAIN CONTROLLER

DNS problems can therefore become:

Authentication Problems

Service Discovery Problems

Operational Problems

19 — Understand Group-Based Privilege

Enterprise access frequently follows:

USER
 ↓
GROUP
 ↓
ROLE
 ↓
RESOURCE

Review:

Direct Membership

Nested Membership

Administrative Groups

Application Groups

Delegated Groups

20 — Understand Nested Group Risk

Nested groups can make effective access difficult to see.

USER
 ↓
GROUP A
 ↓
GROUP B
 ↓
PRIVILEGED GROUP
 ↓
SENSITIVE RESOURCE

The user may have significant privilege without appearing directly in the final group.

21 — Understand Delegation

Organizations delegate administrative responsibility so every task does not require the highest privilege.

Examples include:

Password Reset

User Administration

Computer Administration

OU Management

Application Administration

Poor delegation can create unintended privilege paths.

22 — Understand Group Policy

Group Policy can control:

Security Settings

Firewall

Scripts

User Rights

Application Configuration

System Configuration

Conceptually:

DOMAIN
  ↓
OU
  ↓
GPO
  ↓
COMPUTER / USER

23 — Assess GPO Security

Review:

Who Can Create GPOs?

Who Can Edit Them?

Where Are They Linked?

Which Systems Receive Them?

Can Delegated Users Modify Sensitive Policy?

A configuration-management mechanism can become a privilege path if its permissions are weak.

24 — Understand Service Accounts

Service accounts support:

Applications

Databases

Scheduled Tasks

Services

Automation

Review:

Purpose

Privilege

Credential Management

Interactive Login

Rotation

Ownership

Lifecycle

25 — Prefer Managed Identity Patterns

Where supported, organizations should consider mechanisms such as:

Managed Service Accounts

Group Managed Service Accounts

Platform-Managed Identities

Workload Federation

instead of unnecessary long-lived manually managed credentials.

26 — Understand Credential Exposure

Credentials may be exposed through:

Configuration

Scripts

Deployment Files

Backups

User Behavior

Administrative Processes

Application Secrets

The assessment question is:

What Credential Exists?

What Can It Access?

Why Is It Exposed?

How Should It Be Protected?

27 — Treat Credentials as Sensitive Evidence

Never unnecessarily reproduce secrets in reports.

Prefer:

Credential Type

Affected Asset

Privilege

Exposure Location

Redacted Evidence

instead of publishing complete credentials.

28 — Understand Administrative Separation

A mature environment may separate:

Standard User Identity

Workstation Admin Identity

Server Admin Identity

Domain Administration Identity

Conceptually:

DAILY USER
   ≠
PRIVILEGED ADMIN

This reduces the chance that compromise of one identity automatically exposes every privilege tier.

29 — Understand Privileged Access Workstations

Highly privileged administrative activity may be restricted to specially managed systems.

Conceptually:

ADMINISTRATOR
      ↓
SECURED ADMIN WORKSTATION
      ↓
PRIVILEGED RESOURCE

rather than:

ADMINISTRATOR
      ↓
EVERYDAY WORKSTATION
      ↓
PRIVILEGED RESOURCE

30 — Understand Network Segmentation

Segmentation limits:

Reachability

Lateral Movement

Administrative Exposure

Attack Surface

Segmentation Model

USER NETWORK
     |
     X
     |
SERVER NETWORK
     |
     X
     |
MANAGEMENT NETWORK

The X represents controlled boundaries rather than unrestricted connectivity.

31 — Evaluate Segmentation

For each boundary ask:

Source?

Destination?

Protocol?

Port?

Identity?

Business Requirement?

Security Control?

32 — Understand Lateral Movement Conceptually

Lateral movement refers to movement between systems or security contexts after initial access.

Conceptually:

HOST A
  ↓
AUTHORIZED RELATIONSHIP
  ↓
HOST B

Common legitimate administrative technologies involved in enterprise environments include:

RDP

SMB

SSH

PowerShell Remoting

Management Platforms

Security problems arise when these relationships are exposed through:

Weak Credentials

Excessive Privilege

Poor Segmentation

Weak Administrative Separation

33 — Understand Pivoting

A pivot allows an assessment to evaluate another authorized network segment through an already controlled lab system.

TESTING SYSTEM
      ↓
LAB HOST A
      ↓
INTERNAL LAB NETWORK
      ↓
LAB HOST B

The foundational knowledge is:

Routing

Interfaces

Ports

Reachability

Segmentation

34 — Build a Network Reachability Matrix

Source	Destination	Service	Expected	Observed
User Zone	Web Tier	HTTPS	Yes	Yes
User Zone	Database	Database Port	No	Review
Web Tier	Database	Database Port	Yes	Yes
User Zone	DC	Admin Service	Restricted	Review

This turns segmentation into measurable evidence.

35 — Understand Endpoint Security Controls

Modern enterprise environments may use:

Antivirus

EDR

Host Firewall

Application Control

Attack Surface Reduction

Device Compliance

Central Logging

OSEP preparation should include understanding what these controls are designed to prevent and detect.

36 — Think Like a Security Engineer

Do not treat endpoint security merely as:

Something to Bypass

Understand:

What Does It Detect?

Which Telemetry Does It Collect?

Which Behavior Is Restricted?

How Would the SOC Investigate It?

37 — Understand Antivirus

Antivirus commonly evaluates:

Files

Signatures

Known Threats

Potentially Suspicious Content

Modern endpoint protection may add additional behavioral and cloud-based analysis.

38 — Understand EDR

Endpoint Detection and Response may collect telemetry around:

Processes

Parent-Child Relationships

Network Connections

Files

Registry

User Activity

Security Events

Conceptually:

ENDPOINT
   ↓
TELEMETRY
   ↓
DETECTION
   ↓
SECURITY PLATFORM
   ↓
SOC ANALYST

39 — Understand Application Control

Application control restricts what software can execute.

Possible approaches include:

Allowlisting

Publisher Rules

Path Rules

Hash Rules

Managed Installer Trust

From an assessment perspective, determine:

What Is Allowed?

What Is Blocked?

Why?

Which Systems Are Covered?

Are Exceptions Controlled?

40 — Understand PowerShell Security

PowerShell is an important Windows administration platform.

Organizations may apply controls around:

Script Logging

Module Logging

Transcription

Application Control

Endpoint Monitoring

Language Restrictions

OSEP-level knowledge should include both:

Administrative Utility

and:

Defensive Visibility

41 — Understand Security Telemetry

During an enterprise assessment, think about what defenders may observe.

AUTHENTICATION
      ↓
LOGON EVENT

PROCESS START
      ↓
PROCESS TELEMETRY

NETWORK CONNECTION
      ↓
NETWORK TELEMETRY

PRIVILEGE CHANGE
      ↓
DIRECTORY / AUDIT EVENT

42 — Build Defender Awareness

For each simulated activity ask:

Which Log Would Record This?

Which Security Product Might Detect It?

What Alert Could Be Generated?

What Evidence Would the SOC See?

This improves both offensive and defensive understanding.

43 — Understand Operational Security

Operational security means controlling how an authorized assessment is conducted so it does not create unnecessary risk.

Consider:

Scope

Timing

Noise

Artifacts

Sensitive Data

Persistence

Cleanup

Communication

44 — Rules of Engagement

Before testing, define:

Authorized Targets

Excluded Targets

Permitted Techniques

Restricted Techniques

Testing Window

Escalation Contacts

Emergency Stop Procedure

Data Handling

Reporting Requirements

45 — Understand Production Risk

A technique that is acceptable in a dedicated lab may be inappropriate in production.

Always consider:

Could This Crash a Service?

Could This Lock an Account?

Could This Corrupt Data?

Could This Trigger Business Disruption?

Could This Affect Other Tenants?

46 — Use Controlled Validation

Professional assessments should seek:

MINIMUM ACTION
      ↓
SUFFICIENT EVIDENCE
      ↓
CONFIRMED RISK

not:

MAXIMUM POSSIBLE DAMAGE

47 — Understand Adversary Simulation

Adversary simulation tests whether an organization can:

Prevent

Detect

Investigate

Contain

realistic attacker behavior under controlled conditions.

48 — Pentest vs Red Team

A penetration test often asks:

What Security Weaknesses Exist?

A red-team-style exercise may ask:

Can a Realistic Attack Path
Reach a Defined Objective,
and Can the Organization
Detect and Respond to It?

49 — Define Exercise Objectives

Examples:

Evaluate Administrative Separation

Evaluate Network Segmentation

Evaluate Identity Controls

Evaluate Detection Coverage

Evaluate Privileged Access Governance

Avoid vague objectives such as:

Hack Everything

50 — Define Crown Jewels

Crown jewels are high-value business assets.

Examples:

Identity Infrastructure

Critical Databases

Production Management Systems

Sensitive Intellectual Property

Backup Infrastructure

Security Management Systems

51 — Work Backward from the Objective

If the objective is:

CRITICAL APPLICATION

ask:

Who Administers It?

Which Identities Can Access It?

Which Systems Can Reach It?

Which Authentication Is Required?

Which Trust Relationships Exist?

This creates a potential attack-path map.

52 — Build an Attack-Path Graph

Conceptually:

USER A
  |
  v
WORKSTATION
  |
  v
GROUP B
  |
  v
SERVER C
  |
  v
SERVICE IDENTITY
  |
  v
SENSITIVE APPLICATION

Every edge should represent a real, validated relationship.

53 — Document Attack-Path Preconditions

For every transition record:

Source:

Destination:

Required Identity:

Required Privilege:

Required Network Access:

Required Configuration:

Observed Control:

Security Concern:

54 — Avoid Attack-Path Assumptions

Do not conclude:

A Can Reach B
Therefore
A Can Compromise B

Validate:

Authentication

Authorization

Configuration

Privilege

Control Effectiveness

55 — Understand Privilege Escalation in Context

Privilege escalation is not limited to:

User → SYSTEM

Enterprise privilege escalation may also involve:

User
 ↓
Application Administrator

Server Administrator
 ↓
Identity Administrator

Service Account
 ↓
Sensitive Database

56 — Understand Vertical and Horizontal Movement

Vertical

LOW PRIVILEGE
      ↓
HIGHER PRIVILEGE

Horizontal

SYSTEM A
    ↓
SYSTEM B

Enterprise attack paths often combine both.

57 — Understand Administrative Paths

A secure environment should define:

Who Administers Workstations?

Who Administers Servers?

Who Administers Domain Controllers?

From Which Devices?

Using Which Accounts?

Uncontrolled overlap increases risk.

58 — Understand Tiering Concepts

A simplified privilege model may separate:

TIER 0
Identity Infrastructure

TIER 1
Servers and Applications

TIER 2
User Workstations

The goal is to prevent lower-trust systems from becoming stepping stones toward highly privileged environments.

59 — Evaluate Administrative Logons

Ask:

Where Do Privileged Accounts Log In?

Do Domain-Level Admins Use Workstations?

Do Server Admins Browse the Internet?

Are Admin Sessions Isolated?

Are Privileged Sessions Monitored?

60 — Understand Credential Hygiene

Credential security includes:

Unique Passwords

Rotation

MFA

Managed Credentials

Limited Privilege

Secure Storage

Restricted Logon

Monitoring

61 — Understand Local Administrator Password Management

Organizations should avoid unmanaged reuse of local administrator credentials.

Modern environments can use centralized mechanisms for:

Unique Credentials

Rotation

Controlled Retrieval

Auditing

62 — Understand Service Account Risk

Service accounts may become high-value because they often have:

Long Lifetimes

Application Access

Server Access

Database Access

Automation Privilege

Review:

Can Interactive Login Be Disabled?

Can Privilege Be Reduced?

Can Managed Identity Be Used?

Is Credential Rotation Automated?

63 — Understand Active Directory ACLs

Directory objects have permissions.

Conceptually:

IDENTITY
  ↓
DIRECTORY PERMISSION
  ↓
OBJECT

Review whether delegated identities can perform sensitive operations beyond their intended role.

64 — Understand Ownership

Object ownership can be security-sensitive because owners may have capabilities affecting object permissions.

Assess ownership of:

Groups

Service Accounts

Policies

Administrative Objects

Applications

65 — Understand Trust Relationships

Enterprises may contain:

Domain Trusts

Forest Trusts

Application Trusts

Cloud Federation

Third-Party Trust

Trust should always be evaluated from both directions.

66 — Trust Does Not Mean Equal Security

A trusted environment may have:

Different Security Controls

Different Administrators

Different Patch Levels

Different Monitoring

Therefore:

TRUST RELATIONSHIP
        +
WEAKER ENVIRONMENT

can increase enterprise risk.

67 — Understand Hybrid Identity

Modern organizations may connect:

On-Premises Active Directory
          ↓
Identity Synchronization
          ↓
Cloud Identity Platform
          ↓
SaaS / Cloud Resources

This creates new relationships between:

On-Prem Identity

Cloud Identity

Applications

Devices

Administrative Roles

68 — Hybrid Attack-Path Thinking

Ask:

Can On-Premises Privilege
Influence Cloud Access?

Can Cloud Privilege
Influence On-Premises Systems?

Which Synchronization Components
Are Highly Privileged?

69 — Understand Cloud Integration

Enterprise offensive security increasingly intersects with:

Microsoft Azure

AWS

Google Cloud

SaaS

Cloud Identity

Cloud Management

OSEP foundations therefore benefit from understanding hybrid architecture.

70 — Understand Data Protection

During assessments, sensitive information may be encountered.

Define procedures for:

Collection

Storage

Encryption

Access

Retention

Deletion

71 — Minimize Sensitive Data Collection

Prefer:

Enough Evidence
to Demonstrate Risk

rather than:

Copy Every Available File

72 — Build an Enterprise Enumeration Workflow

Use:

01 Understand Scope

02 Map Network

03 Identify Systems

04 Identify Services

05 Map Identities

06 Map Groups

07 Map Privileges

08 Map Trust

09 Map Segmentation

10 Map Security Controls

11 Identify Potential Paths

12 Validate Paths

13 Assess Impact

14 Collect Evidence

15 Cleanup

16 Report

73 — Re-Enumerate After Every Context Change

Whenever you gain a new authorized security context:

NEW IDENTITY
     ↓
RE-ENUMERATE

Whenever you reach a new network:

NEW NETWORK
     ↓
RE-ENUMERATE

Whenever privilege changes:

NEW PRIVILEGE
     ↓
RE-ENUMERATE

74 — Build an Identity Relationship Matrix

Identity	Groups	Systems	Privilege	Sensitive Access
UserA	Employees	WS01	Standard	No
AdminA	Server Admins	SRV01	Admin	Yes
ServiceA	App Services	APP01	Service	Database

75 — Build a Security-Control Matrix

Control	Coverage	Purpose	Validation
MFA	Admins	Authentication	Review
EDR	Endpoints	Detection	Review
Firewall	Servers	Segmentation	Review
App Control	Admin Systems	Execution Control	Review
SIEM	Enterprise	Monitoring	Review

76 — Build a Findings Register

Use:

ID	Finding	Asset	Severity	Attack Path
ENT-001	Excessive Admin Access	SRV01	High	AP-01
ENT-002	Weak Segmentation	DB01	High	AP-02
ENT-003	Stale Privileged Account	AD	High	AP-03

77 — Build an Attack-Path Register

Attack Path ID:

Objective:

Starting Context:

Systems Involved:

Identities Involved:

Trust Relationships:

Security Controls:

Weaknesses:

Validated Impact:

Evidence:

Recommended Remediation:

78 — Prioritize Choke Points

A choke point is a control whose improvement can break multiple attack paths.

Examples may include:

Privileged Access Governance

Network Segmentation

Administrative Separation

MFA

Service Account Governance

Endpoint Hardening

This makes remediation more strategic.

79 — Think Beyond Individual Findings

Instead of reporting:

Finding A

Finding B

Finding C

show when appropriate:

Finding A
   +
Finding B
   +
Finding C
   ↓
Enterprise Attack Path

80 — Explain Business Impact

Technical statement:

Excessive Administrative Group Membership

Business-oriented statement:

Compromise of a standard operational
identity could provide a path toward
administrative access to systems supporting
a critical business application.

81 — Write Enterprise Findings

Use:

Finding ID:

Title:

Severity:

Affected Assets:

Affected Identities:

Description:

Attack-Path Relationship:

Evidence:

Technical Impact:

Business Impact:

Recommendation:

Validation Method:

Example Finding — Administrative Separation

Finding ID:
ENT-001

Title:
Privileged Administrative Accounts Used
on Lower-Trust Workstations

Severity:
High

Observation:
Highly privileged identities are permitted
to authenticate to general-purpose user
workstations.

Risk:
Compromise of a lower-trust workstation may
increase the likelihood of privileged
credential or session exposure.

Recommendation:
Implement administrative tiering and
restrict privileged identities to approved
administrative systems.

Example Finding — Segmentation

Finding ID:
ENT-002

Title:
User Network Has Unnecessary Access to
Sensitive Server Services

Severity:
High

Observation:
General user systems can directly reach
administrative or sensitive services in a
higher-trust server zone without a
documented business requirement.

Risk:
Compromise of a workstation may provide a
direct network path toward critical
systems.

Recommendation:
Restrict network access using
deny-by-default segmentation and explicitly
allow only documented business flows.

Example Finding — Service Account

Finding ID:
ENT-003

Title:
Service Identity Holds Excessive Privilege

Severity:
High

Observation:
An application service identity has
privileges significantly beyond those
required for its documented function.

Risk:
Compromise of the application or service
identity may provide access to additional
enterprise systems or sensitive data.

Recommendation:
Reduce privileges to the minimum required,
restrict interactive use, and migrate to
managed credential mechanisms where
supported.

82 — Create an Attack-Path Diagram

Example:

STANDARD USER
      |
      v
WORKSTATION
      |
      | Excessive Privilege
      v
APPLICATION SERVER
      |
      | Service Identity
      v
DATABASE
      |
      | Sensitive Access
      v
BUSINESS DATA

This is often easier for stakeholders to understand than isolated technical findings.

83 — Write an Executive Summary

Executives need:

What Was Tested?

What Was the Objective?

What Attack Paths Were Identified?

Which Business Assets Were Exposed?

Which Controls Failed?

What Should Be Fixed First?

84 — Build a Remediation Roadmap

Prioritize:

IMMEDIATE
Critical exposure

SHORT TERM
Privilege and configuration

MEDIUM TERM
Architecture and segmentation

LONG TERM
Identity and security maturity

85 — Include Detection Recommendations

Enterprise offensive-security reports can also recommend:

Authentication Monitoring

Privileged Group Monitoring

Endpoint Telemetry

Network Monitoring

Service Account Monitoring

Directory Change Monitoring

86 — Collaborate with Defenders

A mature red/purple-team workflow may involve:

OFFENSIVE TEAM
      ↓
SIMULATED ACTIVITY
      ↓
DEFENSIVE TELEMETRY
      ↓
SOC ANALYSIS
      ↓
DETECTION IMPROVEMENT

87 — Understand Purple Teaming

Purple teaming connects:

OFFENSIVE KNOWLEDGE
       +
DEFENSIVE KNOWLEDGE

to improve:

Prevention

Detection

Investigation

Response

88 — Build an OSEP Lab Environment

A dedicated authorized lab might contain:

ATTACKER / TEST SYSTEM
        |
        v
LAB FIREWALL
        |
        +-- Windows Workstation
        |
        +-- Member Server
        |
        +-- Domain Controller
        |
        +-- Application Server
        |
        +-- Linux Server

Keep it isolated from production.

89 — Lab Safety

Use:

Dedicated Virtual Network

Snapshots

Test Accounts

Synthetic Data

Documented Scope

Rollback Plan

Avoid using:

Production Credentials

Real Customer Data

Corporate Production Systems

for uncontrolled experimentation.

90 — Lab Project 01: Enterprise Discovery

Mission

Create an inventory of an authorized enterprise lab.

Document:

Hosts

Services

Operating Systems

Zones

Users

Groups

Trust Boundaries

Deliverable

Create:

Enterprise Asset Map

91 — Lab Project 02: Identity Relationship Assessment

Mission

Map:

Users

Groups

Administrative Rights

Service Accounts

Privileged Identities

Identify unnecessary relationships.

Deliverable

Identity Privilege Matrix

92 — Lab Project 03: Segmentation Assessment

Mission

Compare expected and actual connectivity between:

User Zone

Server Zone

Management Zone

Deliverable

Network Reachability Matrix

93 — Lab Project 04: Active Directory Security Review

Review:

Privileged Groups

Delegation

GPO Permissions

Service Accounts

Administrative Separation

Stale Identities

Deliverable

AD Security Findings Register

94 — Lab Project 05: Attack-Path Analysis

Build:

Starting Identity
      ↓
System Relationship
      ↓
Privilege Relationship
      ↓
Sensitive Asset

Validate each relationship safely.

Deliverable

Enterprise Attack-Path Report

95 — Lab Project 06: Detection Validation

Coordinate simulated activity with lab monitoring.

Observe:

Windows Logs

Endpoint Telemetry

Authentication Events

Directory Events

Network Events

Deliverable

Activity → Telemetry → Detection Matrix

96 — Lab Project 07: Enterprise Security Assessment

Combine:

NETWORK
   +
IDENTITY
   +
WINDOWS
   +
ACTIVE DIRECTORY
   +
SEGMENTATION
   +
SECURITY CONTROLS
   +
ATTACK PATHS
   +
REPORTING

Produce a professional assessment report.

97 — OSEP Preparation Phase 01

Focus on:

Networking

Windows

PowerShell

Active Directory

Linux

Scripting

You should already have strong fundamentals before moving deeper.

98 — OSEP Preparation Phase 02

Focus on:

Enterprise Enumeration

Identity Mapping

Privilege Mapping

Trust Analysis

Segmentation

99 — OSEP Preparation Phase 03

Focus on:

Windows Security

Endpoint Controls

Application Control

Logging

Defender Awareness

100 — OSEP Preparation Phase 04

Focus on:

Attack Paths

Administrative Separation

Hybrid Environments

Service Accounts

Privilege Relationships

101 — OSEP Preparation Phase 05

Focus on:

Adversary Simulation

Evidence

Detection Validation

Reporting

Remediation

12-Week OSEP Preparation Framework

Use this as a flexible learning structure rather than an exam guarantee.

Weeks 1–2 — Windows and PowerShell

Focus on:

Windows Architecture

Users

Groups

Privileges

Services

PowerShell

Logging

Weeks 3–4 — Active Directory

Focus on:

Domains

Users

Groups

Computers

Kerberos

NTLM

LDAP

DNS

Group Policy

Weeks 5–6 — Enterprise Identity

Focus on:

Service Accounts

Delegation

Privileged Access

Administrative Separation

Credential Governance

Weeks 7–8 — Network and Endpoint Security

Focus on:

Segmentation

Firewalling

Endpoint Security

Application Control

Monitoring

Weeks 9–10 — Attack-Path Analysis

Focus on:

Identity Relationships

Privilege Relationships

Trust Relationships

Enterprise Attack Paths

Week 11 — Full Enterprise Lab

Perform:

Discovery

Identity Mapping

Control Assessment

Attack-Path Analysis

Evidence Collection

Week 12 — Simulation and Reporting

Complete:

Timed Assessment

Attack-Path Documentation

Security Findings

Executive Summary

Remediation Roadmap

Daily Practice Model

Example:

30 Minutes
Concept Review

90 Minutes
Hands-On Lab

30 Minutes
Attack-Path Notes

30 Minutes
Defensive Analysis

OSEP Readiness Level 01 — Windows

You understand:

Users

Groups

Privileges

Processes

Services

PowerShell

Remote Administration

Logging

OSEP Readiness Level 02 — Active Directory

You understand:

Forest

Domain

Domain Controllers

Users

Groups

Computers

Kerberos

NTLM

LDAP

DNS

GPO

OSEP Readiness Level 03 — Enterprise Identity

You can assess:

Administrative Accounts

Service Accounts

Group Membership

Delegation

Privilege Relationships

Administrative Separation

OSEP Readiness Level 04 — Network Architecture

You can map:

Zones

Routes

Services

Trust Boundaries

Segmentation

Management Paths

OSEP Readiness Level 05 — Security Controls

You understand the purpose and visibility of:

Endpoint Protection

EDR

Firewalling

Application Control

PowerShell Logging

Central Monitoring

OSEP Readiness Level 06 — Attack Paths

You can take:

IDENTITIES
    +
SYSTEMS
    +
PRIVILEGES
    +
NETWORK ACCESS
    +
TRUST

and construct validated:

ATTACK PATHS

OSEP Readiness Level 07 — Defender Awareness

For simulated activity you can explain:

What Happened?

What Telemetry Should Exist?

What Could Detect It?

How Should Defenders Investigate?

OSEP Readiness Level 08 — Reporting

You can communicate:

Individual Findings

Attack Paths

Business Impact

Control Gaps

Remediation Priorities

OSEP Readiness Level 09 — Independent Assessment

You can receive an unfamiliar authorized enterprise lab and systematically:

MAP
 ↓
ENUMERATE
 ↓
UNDERSTAND
 ↓
MODEL
 ↓
VALIDATE
 ↓
DOCUMENT
 ↓
REPORT

without relying on a walkthrough.

Common OSEP Preparation Mistakes

Avoid:

Weak Windows Fundamentals

Weak Active Directory Fundamentals

Thinking Only About Individual Hosts

Ignoring Identity Relationships

Ignoring Network Segmentation

Ignoring Service Accounts

Ignoring Administrative Separation

Treating EDR Only as an Obstacle

Ignoring Defender Telemetry

Ignoring Business Impact

Poor Evidence Collection

Poor Cleanup

Ignoring Reporting

Depending Entirely on Automated Tools

Building Attack Paths Without Validating Each Step

OSEP vs OSCP

Think:

OSCP
=
Practical Penetration Testing Foundation

OSEP expands toward:

COMPLEX ENTERPRISE ENVIRONMENTS
        +
IDENTITY
        +
ACTIVE DIRECTORY
        +
DEFENSE AWARENESS
        +
ATTACK PATHS

OSEP vs OSWE

OSWE
=
Advanced Application Security

OSEP
=
Advanced Enterprise Offensive Security

A professional may pursue either direction based on specialization.

OSEP vs Red Teaming

OSEP-oriented skills provide a strong technical foundation for red-team work, but professional red teaming also requires:

Engagement Planning

Operational Security

Threat Intelligence

Detection Awareness

Communication

Risk Management

Stakeholder Coordination

Career Connection

OSEP-oriented skills support roles such as:

Senior Penetration Tester

Enterprise Penetration Tester

Offensive Security Engineer

Red Team Operator

Security Consultant

Purple Team Engineer

Adversary Simulation Specialist

Interview Question 01

What is an enterprise attack path?

An enterprise attack path is a sequence of validated relationships involving identities, systems, privileges, network access, or trust that can allow compromise to progress toward a more sensitive asset.

Interview Question 02

Why is Active Directory important in enterprise security?

Because it frequently provides centralized:

Identity

Authentication

Authorization

Policy

Administration

for large portions of the enterprise.

Interview Question 03

Why is administrative separation important?

It limits the ability of compromise in a lower-trust environment to expose highly privileged administrative identities.

Interview Question 04

Why is network segmentation important?

Segmentation reduces unnecessary connectivity and can prevent one compromised system from directly reaching higher-value assets.

Interview Question 05

Why should offensive security engineers understand EDR?

Because understanding defensive telemetry allows them to assess whether security controls provide effective visibility and helps organizations improve detection and response.

40 OSEP Interview and Review Questions

What is OSEP?
How does OSEP differ from OSCP?
What is enterprise penetration testing?
What is an attack path?
What is a trust boundary?
What is Active Directory?
What is a forest?
What is a domain?
What is a domain controller?
What is Kerberos?
What is NTLM?
What is LDAP?
Why is DNS important to Active Directory?
What is Group Policy?
Why are GPO permissions security-sensitive?
What is delegation?
What is privilege creep?
Why are nested groups security-sensitive?
What is a service account?
Why should service-account privileges be minimized?
What is administrative separation?
What is privilege tiering?
What is network segmentation?
What is lateral movement conceptually?
What is pivoting conceptually?
What is an EDR?
What is application control?
Why is PowerShell logging useful?
What is operational security?
What are rules of engagement?
What is adversary simulation?
How does a penetration test differ from a red-team exercise?
What are crown jewels?
What is a network reachability matrix?
What is an identity privilege matrix?
Why should every attack-path transition be validated?
What is purple teaming?
Why should reports include business impact?
What is a remediation choke point?
What skills make someone job-ready for enterprise offensive security?

OSEP Readiness Checklist

Windows

Active Directory

Enterprise Identity

Network Security

Endpoint Security

Attack-Path Analysis

Professional Operations

Reporting

Final OSEP Mental Model

Remember:

AUTHORIZED ENTERPRISE
        ↓
UNDERSTAND ARCHITECTURE
        ↓
MAP NETWORK
        ↓
MAP IDENTITIES
        ↓
MAP PRIVILEGES
        ↓
MAP TRUST
        ↓
MAP SECURITY CONTROLS
        ↓
IDENTIFY ATTACK PATH
        ↓
VALIDATE EACH RELATIONSHIP
        ↓
ASSESS BUSINESS IMPACT
        ↓
UNDERSTAND DEFENDER VISIBILITY
        ↓
CAPTURE EVIDENCE
        ↓
CLEAN UP
        ↓
REPORT
        ↓
RECOMMEND CONTROL IMPROVEMENTS

The OSEP mindset is not:

How Many Systems
Can I Compromise?

It is:

Which Enterprise Trust Relationships
Create Meaningful Security Risk,
How Can Those Relationships Be
Validated Safely,
and Which Controls Would Break
the Attack Path?

The strongest enterprise offensive-security professionals combine:

WINDOWS
    +
ACTIVE DIRECTORY
    +
NETWORKING
    +
IDENTITY SECURITY
    +
PRIVILEGE ANALYSIS
    +
SEGMENTATION
    +
DEFENSE AWARENESS
    +
ATTACK-PATH THINKING
    +
OPERATIONAL DISCIPLINE
    +
REPORTING

What’s Next?

➡️ 05 — OSED

Next, you will move from enterprise offensive security into advanced exploit development and low-level security research.

The next stage will focus on:

Computer Architecture
      ↓
Memory Fundamentals
      ↓
C / C++
      ↓
Assembly Language
      ↓
Registers
      ↓
Stack and Heap
      ↓
Debugging
      ↓
Binary Analysis
      ↓
Memory Corruption
      ↓
Exploit Mitigations
      ↓
Vulnerability Research
      ↓
Exploit Development

The major transition will be:

OSEP
=
Understand Enterprise
Attack Paths

toward:

OSED
=
Understand Vulnerabilities
at the Binary and
Memory Level