FORTRESS
Framework for Organized RedTeam Threat Response Evaluation for Security and Safeguards
Framework for Organized RedTeam Threat Response Evaluation for Security and Safeguards
Brad Ammerman is a distinguished offensive security leader with nearly two decades of experience in cybersecurity, physical penetration testing, and red team operations. As the creator of the FORTRESS Framework, Brad has developed one of the most comprehensive physical security testing methodologies available, mapping 236+ controls to over 60 compliance frameworks.
With extensive hands-on experience in physical security assessments, including lock-picking, surveillance evasion, tailgating, social engineering, and TSCM (Technical Surveillance Counter-Measures) - Brad brings a unique perspective that combines offensive tactics with deep regulatory knowledge. His career spans roles at leading security firms including Prescient Security, ProCircular, Foresite Cybersecurity, Optiv, and Lockheed Martin.
Currently serving as Senior Director of Innovation and Security Evangelist at Prescient Security, Brad leads strategic security initiatives, drives risk management programs, and oversees offensive security operations. He is also an Adjunct Faculty member at Minnesota State University, Mankato, where he has been educating the next generation of cybersecurity professionals since 2013. Brad is currently pursuing a Master of Science in Artificial Intelligence (expected 2027), combining cutting-edge AI/ML capabilities with cybersecurity to develop next-generation autonomous security testing and threat detection solutions.
A US Army veteran (Combat Medic, 2nd Infantry Division), Brad brings military discipline, tactical thinking, and leadership under pressure to every engagement. His unique combination of military service, offensive security expertise, AI/ML research, and academic experience makes him a sought-after consultant for high-stakes security assessments and innovation leadership.
Brad actively contributes to the security community through open-source tool development on GitHub, including projects like darkweb_tool, osint_runner, auto_nmap, and the FORTRESS Framework. His work spans OSINT automation, network reconnaissance, and physical security testing methodologies, making advanced security capabilities accessible to the community.
Brad's passion for physical security testing and lockpicking was ignited by his dear friend and mentor, Rance, a well-known ethical web application hacker in the cybersecurity industry. Through their friendship, Rance introduced Brad to the fascinating world of physical security challenges, lockpicking techniques, and hands-on security testing methodologies.
Together, Brad and Rance participated in numerous lockpicking competitions, physical security challenges, and collaborative learning sessions that deepened Brad's understanding of how physical security controls could be tested, evaluated, and improved. These experiences provided the foundational knowledge and hands-on skills that would later become central to Brad's professional expertise.
The pivotal moment came during Brad's tenure at Lockheed Martin, when he was asked to conduct his first formal physical security assessment. Eager to deliver a comprehensive and professional evaluation, Brad searched extensively for standardized methodologies, testing frameworks, and best practices for physical security assessments. To his surprise, he discovered a significant gap in the industry; while cybersecurity testing had well-established frameworks like PTES (Penetration Testing Execution Standard) and methodologies aligned with MITRE ATT&CK®, there was no equivalent comprehensive framework for physical security testing.
This realization planted the seed for what would eventually become the FORTRESS Framework. Over the following years, as Brad conducted hundreds of physical security assessments across various industries and compliance contexts, he meticulously documented testing methodologies, common findings, remediation strategies, and compliance mappings. Each engagement contributed to a growing repository of knowledge and best practices.
After years of real-world testing experience and accumulating insights from countless assessments, Brad recognized that the time was right to formalize this knowledge into a comprehensive framework. The FORTRESS Framework was developed not just as a personal reference, but as a resource to help new red team and blue team consultants execute their own physical security testing with confidence, consistency, and professionalism. By providing standardized methodologies, detailed test procedures, and comprehensive compliance mappings, the framework aims to elevate the practice of physical security testing and make it more accessible to security professionals entering this specialized field.
Today, the FORTRESS Framework stands as a testament to Brad's journey from learning lockpicking fundamentals with a mentor, to conducting enterprise-level physical security assessments, to creating a comprehensive framework that helps others navigate the same path. It represents the culmination of years of hands-on experience, continuous learning, and a commitment to advancing the field of physical security testing.
This framework and my journey into physical security testing would not have been possible without the mentorship, friendship, and inspiration of Rance (David Jones), a beloved figure in the cybersecurity community and a well-known ethical web application hacker.
Rance introduced me to the fascinating world of lockpicking, physical security challenges, and hands-on security testing. Through countless lockpicking competitions, collaborative learning sessions, and shared adventures, Rance not only taught me technical skills but also instilled a passion for understanding how security controls work, and how they can be tested ethically and professionally.
His playful spirit, generous mentorship, and dedication to the security community left an indelible mark on all who knew him. The FORTRESS Framework stands as a testament to the knowledge and passion he shared with me and countless others in the cybersecurity field.
"The best mentors don't just teach you what to do, they inspire you to discover what's possible. Rance did that for me, and I'm forever grateful for his friendship and guidance."
— Brad Ammerman
Leading innovation initiatives, security evangelism, and strategic technology adoption for next-generation security solutions.
Key Responsibilities
Directed security operations, team development, and client engagement strategies for growing security practice.
Brad created the FORTRESS Framework (Framework for Organized RedTeam Threat Response Evaluation for Security and Safeguards) to address the critical gap in standardized physical security testing methodologies.
Connect with Brad Ammerman on LinkedIn or GitHub to discuss physical security assessments, red team operations, offensive security engagements, open-source security tools, or the FORTRESS Framework: