The Slow and Steady Approach to Embedded Recon

Today I want to talk a bit about ways to improve your embedded recon, and one of the most common mistakes I see new black teams run into while performing this high stress form of reconnaissance.

A quick reminder on the various forms of recon that you can perform:

• OSINT - What can you discover from your laptop, far away from the target building?

• Long range recon - What can you see at distance using things like telescopes and long range cameras?

• Short range recon - What can you discover by moving around, but not inside, the target building? Think of walking your dog around the street, or going for a job nearby.

• Embedded recon - Get inside the target building under real or false pretext. Think going into a bank to ask about opening a bank account.

Each of these will provide you with different info assuming they are all viable on your engagement. Many assignments will not warrant all of the above; for example, if your target building is inside a dense urban environment, you may not have the ability to use telescopes and long range cameras clandestinely. Or if you find yourself doing a remote power station, walking your dog around the facility may also not be an optimal strategy.

But today, we are talking about embedded recon, which in my opinion is probably the most valuable and often overlooked form of reconnaissance.

The Importance of Embedded Reconnaissance

Embedded reconnaissance involves gathering information and observing security measures from within a target building, often under a false or real pretext. The primary objective is to remain inconspicuous, ensuring that your presence does not raise suspicion.

The Two Big Mistakes I Often See