Network & Infrastructure
External and internal penetration testing across your perimeter, data centre, and segmented VLANs — including Active Directory attack paths.
Hale, Iosco County, Michigan · Est. 2010
Offensive security,
Offensive security,
engineered for the real world.
Advanced Concepts is an independent, owner-operated security testing practice. Since 2010 I have been hired by banks, hospitals, manufacturers, and credit unions to break into their systems — legally, carefully, and with a report they can actually act on.
[08:14:02] › engagement authorized — RoE v3 signed
[08:14:07] › scope: 10.40.0.0/16, 4 web apps, M365
[08:19:41] → host discovery [ 214 live ]
[08:31:15] → service fingerprinting [ done ]
[09:02:58] ! legacy SMBv1 reachable from user VLAN
[09:44:12] ! password spray → 1 valid cred (no lockout)
[10:06:33] ✗ lateral movement to FIN-SRV-02
[10:07:10] ✗ domain admin obtained — 3h 52m
[10:08:00] › logging evidence captured
[10:08:01] › findings queued for report
mike@advancedconcepts:~$
Tested against
NIST SP 800-115
OWASP ASVS
PTES
MITRE ATT&CK
CIS Controls
PCI DSS
HIPAA
SOC 2
Capabilities
What I actually do for you
Every engagement is scoped to a question you need answered — not to a scanner's default profile.
Web & API Applications
Manual, authenticated testing of customer-facing and internal applications against OWASP ASVS, with business-logic abuse cases automated tools miss.
Red Team Operations
Full-scope adversary simulation with phishing, physical entry attempts, and detection-evasion testing — measured against your blue team, not a checklist.
Why Advanced Concepts
One tester. No hand-offs. Ever.
I have deliberately kept this a one-person practice. The person who scopes your engagement is the person who does the testing and writes the report. There is no one else.
-
Every finding is reproducibleEach item ships with request/response evidence, affected asset, and a specific remediation path your admins can execute.
-
Testing windows that respect operationsProduction-safe exploitation. Destructive checks are agreed in advance and documented in the rules of engagement.
-
A debrief, not just a PDFExecutive readout for leadership, technical walkthrough for engineering, and a free retest of remediated findings.
Report contents — standard
| Executive summary | Plain-language risk, 2 pages |
| Findings register | CVSS 3.1 + business impact |
| Evidence | Screenshots, payloads, logs |
| Attack narrative | Step-by-step kill chain |
| Remediation | Prioritised, owner-assigned |
| Compliance mapping | PCI / HIPAA / SOC 2 / CIS |
| Retest | Included, 90 days |
Methodology
Four phases. No surprises.
My process follows PTES and NIST SP 800-115, adapted to your environment and change-control requirements.
Scope & Authorise
Written rules of engagement, target list, testing windows, escalation contacts, and a signed NDA before a single packet is sent.
Reconnaissance
Passive and active enumeration to map what is actually exposed — including assets your inventory does not know about.
Exploitation
Manual, controlled exploitation to prove business impact. Findings are validated, never inferred from a scanner banner.
Report & Retest
Draft findings review with your team, final report, executive briefing, and a retest of remediated items within 90 days.
“Mike has run our annual external and internal testing since 2016. He found things two larger firms missed, and his report was the only one our board actually read.”
Need an independent assessment?
Tell me what you need to prove. I will scope it, quote it, and tell you honestly if you do not need me.
Capabilities
Security assessment services
Nine service lines, one standard of evidence. All engagements include a signed rules-of-engagement document, encrypted evidence handling, and a retest window.
External Network Testing
Internet-facing attack surface assessment: exposed services, remote access, VPN appliances, mail gateways, and forgotten cloud assets.
Internal Network & AD
Assumed-breach testing inside your perimeter. Kerberoasting, delegation abuse, ADCS misconfigurations, and full domain-takeover paths.
Web & API Applications
Authenticated manual testing of customer portals, internal line-of-business apps, and REST/GraphQL APIs against OWASP ASVS Level 2.
Cloud & Container Review
AWS, Azure and GCP configuration and identity review, plus Kubernetes and container image assessment for privilege escalation paths.
Red Team Operations
Objective-based adversary simulation: phishing, vishing, physical access attempts, and detection evasion measured against your defenders.
Social Engineering
Phishing, pretext calling, and on-site entry attempts — with reporting that measures click rate, report rate, and time-to-detection.
Compliance-Driven Testing
Testing mapped directly to PCI DSS 4.0, HIPAA Security Rule, SOC 2 Trust Criteria, and CMMC Level 2 evidence requirements.
Vulnerability Management
Recurring scanning with human validation, so your team gets a prioritised, de-duplicated list instead of 4,000 raw scanner rows.
IR Retainer & Tabletop
Pre-arranged incident response support and facilitated tabletop exercises that test your plan against a realistic scenario.
Engagement Models
How engagements are structured
Pricing is quoted per scope — every environment is different. These are the three models most of my clients choose from.
Essential
Point-in-time testing for a defined target set. Best for annual compliance requirements.
| Scope | 1–3 targets |
| Duration | 3–5 days |
| Report | Standard + exec summary |
| Retest | 1 included |
Advanced MOST COMMON
Full-scope internal and external testing with an assumed-breach objective.
| Scope | Network + apps + cloud |
| Duration | 2–4 weeks |
| Report | Full + compliance mapping |
| Retest | 2 included, 90 days |
Adversary
Objective-based red team with social engineering and detection measurement.
| Scope | Whole organisation |
| Duration | 4–8 weeks |
| Report | Narrative + defender scorecard |
| Retest | Follow-on purple team |
Not sure which model fits?
Most clients start with a 30-minute scoping call. There is no charge and no obligation.
About the firm
Independent since 2010
Advanced Concepts was founded in Hale, Iosco County, Michigan, in 2010 by Mike Frazier to give mid-market organisations access to the same quality of offensive security testing normally reserved for Fortune 500 budgets.
The firm started with one consultant, a small office in Hale, and a handful of clients: an ISP in Iosco County, a credit union, and a small manufacturer that needed a straight answer about their exposure.
Sixteen years later the client list spans fourteen states, but the operating principle has not changed. I test the way an attacker would, I document it the way an auditor needs, and I tell you the truth about what I found — including when the answer is “you are in better shape than you think.”
I do not resell software. I do not take vendor commissions. My only product is an honest assessment, delivered by the same person who scoped it.
Headquarters
5929 E. Esmond Rd.Hale, Iosco County, MI 48739
Founded
2010Continuously operating for 16 years
Owner & Principal
Mike FrazierSole proprietor — no subcontracting
Coverage
14 statesRemote delivery nationwide
The consultant
Mike Frazier
Advanced Concepts is a sole proprietorship. There is exactly one name on your engagement letter, and he does the work.
MF
Mike Frazier
Founder & Principal Consultant
OSCPGPENCISSPPCI-ISA
Mike Frazier is the founder and sole consultant at Advanced Concepts. He has worked in information security since 2003, starting as a network administrator for a Northern Michigan internet provider before moving into offensive security full time.
He holds the OSCP, GPEN, and CISSP certifications, and has personally led more than 240 penetration tests for community banks, credit unions, critical-access hospitals, and manufacturers across the Midwest.
Mike founded Advanced Concepts on a simple premise: that an independent tester with no software to sell and no junior staff to bill for will give a more honest answer than a large firm. Sixteen years later, that is still the entire business model — one senior tester, no resale, no subcontracting, and a written report that tells you the truth, including when the news is good.
He lives in Hale, Michigan, where he is the firm's only employee. Outside of client work, he serves as Head Coach of the Whittemore-Prescott FRC team, the RoboCards, mentoring students in engineering and problem-solving through the FIRST Robotics Competition.
Milestones
Sixteen years, in order
2010
Founded in Hale, Michigan
Mike Frazier opens a one-person security consultancy serving Northern Michigan ISPs, credit unions, and small manufacturers.
2013
Payment-card practice
Added dedicated PCI DSS testing after client demand from regional retailers and payment processors.
2016
Red team capability
Expanded into full-scope adversary simulation, including social engineering and physical access attempts.
2019
Nationwide delivery
Built out encrypted remote delivery infrastructure; client base reached fourteen states.
2022
Continuous adversary retainer
Launched recurring purple-team engagements for clients who wanted testing against detection, not just prevention.
2024
Cloud & container practice
Added dedicated AWS, Azure, and Kubernetes assessment work as client infrastructure moved off-premise.
2026
240+ engagements
Sixteen years of continuous operation with no reported client breach arising from testing activity.
Operating principles
How I work
Evidence over opinion
If I cannot reproduce it, I do not report it. No inflated findings to justify the invoice.
Scope discipline
I test exactly what is authorised. Out-of-scope discoveries are reported, never exploited.
Client data stays client data
Evidence is encrypted at rest, access-logged, and destroyed on a documented schedule after engagement close.
Frameworks & Standards
Testing that satisfies your auditor
Every report maps findings to the framework your assessor, regulator, or customer actually asks about — so you are not paying twice for the same evidence.
PCI DSS 4.0
Requirement 11.4 penetration testing methodology, segmentation testing, and report content aligned to the standard's evidence expectations.
HIPAA Security Rule
Addressable and required implementation specifications mapped to technical findings, with ePHI exposure called out explicitly.
SOC 2 Trust Criteria
Security, availability, and confidentiality criteria supported with testing evidence suitable for a Type II examination period.
NIST SP 800-115
The core technical testing methodology. Assessment planning, execution, and post-execution analysis follow the publication's structure.
CIS Controls v8
Findings mapped to Control 18 (Penetration Testing) and Control 4 (Secure Configuration) for programme-level reporting.
CMMC Level 2
Assessment support for clients pursuing CMMC Level 2 certification, with evidence artefacts formatted for C3PAO review.
Methodology
Standards I test against
Questions
Frequently asked
Typical external testing runs three to five business days. A full internal and external assessment with application testing takes two to four weeks. Red team engagements run four to eight weeks depending on objectives. I will give you a firm schedule before you sign.
My default posture is non-destructive. Any check with a plausible availability impact — denial-of-service validation, password lockout testing, destructive injection — is agreed in advance and documented in the rules of engagement. Testing windows are scheduled around your change-control calendar.
Always, before any testing activity begins. The rules of engagement define in-scope targets, excluded systems, testing windows, escalation contacts, and the authorisation chain. I will not begin work without written authorisation from someone entitled to grant it.
Evidence is stored encrypted, access is restricted to me alone, and all engagement artefacts are destroyed on a documented schedule — typically 90 days after final report delivery, or sooner on written request.
Yes. Standard and Advanced engagements include retesting of remediated findings within 90 days of report delivery. I issue a retest letter you can provide directly to an auditor or customer.
Frequently. Many clients bring me in as an independent validation layer alongside an internal team. I also run purple-team engagements where your defenders are briefed and measured, rather than kept in the dark.
Every engagement carries a documented escalation path and a stop-call you can invoke at any time. If a test produces an unexpected outage or data exposure, I halt testing, notify your named contact immediately, and provide the technical detail needed to recover. This has happened twice in sixteen years, and both were resolved within the hour.
Contact
Request an assessment
Tell me what you need to prove and I will come back within one business day with a scoping call time. Existing clients with an active incident should call the number below directly.
Enquiry received
Thank you. Mike will respond within one business day.
Reference: AC-000000
Demo note: this form is not connected to a backend yet — see the setup notes in the source.