Cybersecurity
Red teaming
A red team engagement asks whether a realistic attacker, working patiently toward a goal, could succeed without being stopped. It tests detection and response as much as prevention.
The problem this service solves
Penetration tests look for as many weaknesses as possible in a defined scope. A red team does something different: it picks an objective, such as reaching a particular dataset or taking control of a specific system, and pursues it using the quietest route available, the way a motivated attacker would.
The result tells you about the whole system: whether the phish gets through, whether the endpoint tool notices, whether the SOC escalates, whether the incident process works under pressure. If your basic controls are not yet in place, a penetration test or purple team will be more useful and cost less.
What is in scope
Objectives are specific and agreed. Techniques are drawn from realistic threat behavior, not from a checklist.
-
Objectives
For example: reach a named data store, obtain domain-level control, or demonstrate access to a sensitive business process.
-
Initial access
Phishing, exposed services, valid credentials from earlier compromises, or an assumed foothold to save time.
-
Persistence and movement
Techniques mapped to MITRE ATT&CK, chosen for plausibility against your environment.
-
Evasion
Working within your detection stack to learn what it sees, and what it does not.
-
Detection and response
Observe how your team responds, where signals are lost and how escalation works.
-
Optional physical element
On request and with separate written authorization, assess physical access controls.
How the work runs
Prepare
Set the rules and the target.
-
1
Threat profile
Choose adversary behaviors relevant to your industry and environment.
-
2
Rules of engagement
Authorization, objectives, off-limits systems, escalation and the procedure for stopping.
Operate
Pursue the objectives.
-
3
Initial access and foothold
Gain a position using the agreed methods.
-
4
Pursue objectives
Move toward the goal, adapting to what the defenders do.
-
5
Regular check-ins
The white cell receives progress updates so safety and the plan stay aligned.
Learn
Turn the exercise into improvements.
-
6
Timeline reconstruction
A shared timeline of attacker actions and defender observations.
-
7
Replay workshop
Walk through each step with the defenders, then work out detections and process changes.
-
8
Purple follow-up
Optional follow-on to rebuild the weakest detections.
What you receive
- Executive summary: did the objective succeed, and what stopped or failed to stop it
- Full attack timeline with ATT&CK mapping
- Detection and response observations
- Prioritized improvements for people, process and technology
- Replay workshop with your team
Tooling and technique
We do not publish the specific tools or techniques used in an engagement. They are chosen per target, and they vary.
Standards we map to
Mapping findings to a framework is not the same as certification against it.
Before we start
What we need from you
- A very small group aware of the test (often called the white cell)
- Written authorization from executive leadership
- Agreed objectives, no-go areas and communication plan
- A deconfliction process so real incidents are not confused with the exercise
What this service is not
- A first security assessment (start with a vulnerability assessment or penetration test)
- An open-ended test with no objective or rules
- A way to evaluate individual employees
What changes afterwards
- Leadership learns how the organization performs against a realistic adversary
- Detections are rebuilt on evidence from your own environment
- Response roles and escalation paths are tested before an incident
Questions people ask
Is red teaming the same as penetration testing?
No. A penetration test aims for broad coverage within scope and is usually announced to defenders. A red team pursues specific objectives over a longer period, with few people aware, and measures detection and response.
Is it safe?
The rules of engagement, check-ins and the white cell exist for safety. We avoid destructive actions and stop immediately if there is a risk to operations.
What if the defenders catch us?
That is a good result. The exercise records when and how, then continues if the rules allow, or stops. We do not treat being caught as a failure of the engagement.
Related
-
Purple teaming
Collaborative exercises where attackers and defenders work side by side to test and improve detections, technique by technique.
-
Detection engineering
Design, write, test and maintain detections tied to specific attacker behaviors, with false-positive control and documented response steps.
-
Tabletop exercises
Facilitated discussions where executives and technical teams work through a realistic incident, find gaps and agree changes.
Need to understand your security exposure?
Speak with a security expert
Talk through your environment and goals. We reply to scope the work before anything is tested.
Speak with a security expertPlan an assessment
Answer a few questions and get a structured preliminary scope you can send us.
Use the plannerUnder attack right now?
Call the US office and tell us what you are seeing. Do not wait for a form reply.
Incident response