Red Team
A team of operators replicates a real adversary for weeks: phishing, physical access, lateral movement and exfiltration. You find out how far an attacker would get, and your team learns how to stop them.
- Threat intelligence
- Initial access
- Lateral movement
- Closing purple team
- of engagements reach a critical objective
- 94%
- of engagements reach a critical objective
- average campaign length
- 6 wks
- average campaign length
- methodology aligned with DORA TLPT
- TIBER-EU
- methodology aligned with DORA TLPT
In detail
A real adversary, with clear rules and a business objective.
A pentest tells you which vulnerabilities you have. A Red Team tells you whether a determined attacker would reach what matters most: treasury, customer data, the ERP or the plant. We start from a concrete objective (for example, ordering a transfer or reading the CEO’s mailbox) and work backwards.
During the campaign we combine social engineering, technical exploitation and abuse of legitimate configuration in Active Directory, Entra ID, AWS or Google Workspace. We measure not only whether we got in, but how long your team took to see us and what it did next.
The real value comes at the end: we replay every technique alongside your SOC in purple team sessions, so each finding becomes a tested detection rule rather than another page in a report.
Real scenarios
What usually happens when we test it.
From inbox to domain in 3 days
A phishing email with a legitimate shared document gave us a session on a laptop. An over-privileged service account took us to domain admin without a single alert.
The cloned access badge
We cloned a proximity badge in the building’s café and planted a network implant in a meeting room. Traffic left over HTTPS and nobody noticed.
The supplier as a door
We compromised a maintenance supplier’s remote support account and reached production from there. That path was not in any risk register.
What you get
One report your board understands and one your SOC uses.
- Executive report with the attack chain and business impact
- Technical report with every technique mapped to MITRE ATT&CK
- Attack timeline versus what your team detected
- Remediation plan prioritised by risk and effort
- Detection rules validated in purple team sessions
- Results presentation to leadership
How we engage
Three formats depending on your maturity.
Assumed breach
We start inside, as if an employee had already been compromised.
- 2 to 3 weeks
- Focus on lateral movement
- Ideal first exercise
- Most chosen
Full scope
From outside, with no prior information and every vector.
- 5 to 8 weeks
- Phishing, physical and technical
- Purple team included
TLPT / TIBER-EU
Regulated exercise for financial entities under DORA.
- Threat intelligence
- Regulator coordination
- Reports in official format
Offensive security
What is included
- 01
Threat intelligence
We profile the groups targeting your sector and build the scenario from their real techniques.
- 02
Initial access
Targeted phishing, vishing, leaked credentials and, if authorised, physical intrusion.
- 03
Lateral movement
We escalate privileges across Active Directory, cloud and OT without tripping alarms.
- 04
Closing purple team
We replay the attack with your SOC so every technique leaves a new detection.
Red Team
How we work
- 1
Scope and rules
We set objectives, red lines and the control team who knows about the exercise.
- 2
Reconnaissance
We map your external surface, key people and suppliers.
- 3
Execution
A stealthy campaign with daily reporting to the control team.
- 4
Close-out
Executive and technical reports plus a purple team session.
FAQ
Frequently asked questions
Can it disrupt operations?
No. We work within agreed red lines and a control team can pause the exercise at any time.
Does it count for DORA?
Yes. We follow TIBER-EU, the framework behind the TLPT testing DORA requires from financial entities.
Who in my company should know?
Only a small control team, usually the CISO and one or two executives. Everyone else, including the SOC, should not know so the measurement is real.
What if something critical turns up mid-exercise?
We tell the control team immediately. If the risk is serious, we pause and help you fix it before continuing.
How often should we repeat it?
Once a year is typical. DORA requires TLPT at least every three years for in-scope entities.
You may also need
Next step
Shall we talk about your case?
30 minutes with a partner, not a salesperson. No commitment.