Red Team Assessment

We start by agreeing what “success” means for the attacker and what’s genuinely off limits. Everything else stays open, because a real adversary doesn’t respect your network diagram. That freedom is the point: it surfaces the gaps between your neatly-scoped controls, which is exactly where real breaches happen.

Unlike a pentest, where noise is fine, a red team assessment is graded partly on staying undetected. We move slowly, blend into normal traffic, and use living-off-the-land techniques so that every alert we do or don’t trigger tells you something about your monitoring. Everything runs under a strict rules-of-engagement document and NDA.

We build a picture of your organisation the way an attacker would: exposed infrastructure, employee footprints on social media and in breach data, suppliers, physical sites. From this we model the most realistic threat actor for your business and plan the campaign around how they would actually operate, not around what’s easiest for us.

Getting in is rarely the hard part. A targeted phishing campaign against a handful of well-chosen employees, an exposed service with a weak credential, or a tailgate through a side door during a smoke break: any of these gives the foothold. We use whichever fits the threat model and, where you allow it, more than one, because the goal is to reach the objective, not to demonstrate a single trick.

Command and control

Once inside, we establish quiet, resilient communication back to our infrastructure using modern C2 tooling configured to look like ordinary web traffic. How long that channel survives, and whether anything flags it, is one of the most valuable data points the engagement produces.

From the foothold we escalate, move laterally and hunt for the path to the goal, exactly as covered in our internal-network and Active Directory work but with stealth as a constant constraint. When we reach the crown jewels we prove it, gather evidence, and stop. We never exfiltrate real sensitive data; a marker file or a redacted sample is enough to demonstrate the impact.

The written report tells the full story from reconnaissance to objective, with every technique mapped to MITRE ATT&CK and a clear timeline of what your defenders saw and when. Then we sit down with your team for a debrief and, if you want it, a replay where we walk through each step so your SOC can tune its detections against real attacker behaviour.

You’ve bought the EDR, stood up the SOC, written the runbooks. The only way to know they function against a real intrusion is to run one. We tell you which of our actions raised an alert, which were investigated, which were escalated, and which sailed straight through unnoticed.

Mean time to detect and mean time to respond are only theoretical until they’re tested. A red team assessment gives you real numbers against a real campaign: how long we sat on the network, how long from our first noisy action to a human looking at it, and whether the response contained us or just watched.

Each of your controls may be fine in isolation. The gaps are in the seams: the alert that fires but goes to an unmonitored inbox, the segmentation that stops the wrong traffic, the process that assumes someone else is watching. Objective-led testing lives in those seams.

One person clicks, one credential is captured, and the question becomes how far that single mistake reaches. This scenario tests the whole chain: email filtering, MFA, endpoint detection, segmentation and the SOC’s ability to spot a foothold turning into lateral movement. It’s the most common real-world breach, so it’s the most instructive to rehearse.

Here we start with the access a disgruntled employee or a compromised contractor already has, and see how much damage that trusted position allows. It exposes over-broad permissions and the absence of controls that assume the threat is always external.

We follow the playbook a ransomware crew uses up to the point of deployment: initial access, credential theft, reaching the backup infrastructure and domain controllers. Reaching the backups without triggering a response is the finding that changes how most boards think about their recovery plan.

A readable story of the engagement for leadership and the board: what we set out to steal, whether we got it, how long it took, and what a real attacker doing the same would cost you. This is the version that gets budget approved.

Every technique documented with evidence, mapped to MITRE ATT&CK tactics and techniques, cross-referenced against what your telemetry captured. Your blue team gets a precise list of detection gaps to close, ranked by how much they’d have mattered.

A live debrief and optional purple-team session, an attestation letter for regulators and clients, and a follow-up test after you’ve made changes to confirm the gaps are genuinely closed.

For financial entities, DORA introduces threat-led penetration testing as a formal expectation, building on the established TIBER-EU framework for intelligence-led red teaming. Our engagements are structured to support these requirements, with the threat intelligence, scenario design and reporting they call for.

NIS2 raises the bar for essential and important entities to test their resilience, ISO 27001 Annex A vulnerability-management controls benefit from adversarial testing, and SOC 2 auditors increasingly ask for evidence that detection and response actually work. A red team report speaks to all three.