Red team
Find out where your defences actually give.
A red team exercise is an authorised, realistic attack on your organisation. We take on the role of the adversary, with a written scope and your sign-off, to show what a real attacker could reach and how fast you would notice.
- Starts with
- A scoping call
- Authorisation
- Written, signed
- Typical length
- Two to six weeks
- Ends with
- Debrief + retest
Why it matters
A scan tells you which doors exist. A red team checks which ones open.
Scanners and audits look at controls one by one. Attackers don't. They chain small weaknesses together: a reused password, a misconfigured share, an over-privileged service account, until they reach something that matters.
A red team exercise tests that chain. We agree a goal with you, for example reaching the finance system or customer data, and then try to get there using the same techniques real attackers use, within the limits you set.
Just as important as getting in is whether anyone notices. We measure how far we got, which alerts fired, and how your team and suppliers responded, so you know what to fix and what already works.
Scope
What can be in scope
- 01External attackYour public systems as the entry point: web apps, VPNs, mail and exposed services.
- 02Assumed breachWe start as a compromised laptop or account to test what an insider could reach.
- 03Lateral movementPaths from a normal user to admin rights and sensitive systems.
- 04Cloud & SaaSMisconfigurations and token abuse in your cloud and business tools.
- 05PeoplePhishing and phone pretexts, only if agreed up front.
- 06Physical (optional)Badge and access checks at an agreed site, with a named contact on call.
- 07DetectionWhich of our actions your monitoring saw, and how quickly someone acted.
How an engagement runs
From first call to lasting result.
- 1Signed rules of engagement
Scope and rules of engagement
We agree the goal, the targets, what is off limits, the timing and who knows about the test. A named contact can stop it at any moment.
- 2Attack surface notes
Reconnaissance
We gather what an attacker could learn about you: people, systems, suppliers and technology. This often surfaces exposure on its own.
- 3Live critical alerts
The attack
We work toward the agreed goal, carefully and without damaging production. Critical issues are reported to you immediately, not at the end.
- 4Attack narrative + retest
Debrief and retest
We walk your team through the full attack path step by step, agree the fixes, and come back to verify they hold.
What you get
What the report reads like
Illustrative example. Your own results appear in your console and in a weekly report you can forward as is.
day 1Valid staff address list built from public sourcesday 3Weak VPN password found, sign-in without MFAday 4Service account with domain admin rights reachedday 5Finance share read. Goal reached, no alert firedfixFour concrete changes that would have stopped this pathHow we work
Rules we don't bend.
Always authorised.
Written scope and sign-off before anything starts. No exceptions.
Realistic, not destructive.
We act like attackers without breaking production or touching real data more than needed.
A stop button.
Your named contact can pause or end the exercise at any time.
Clear remediation.
Each path we find ends in a concrete fix, and we retest it.
A good fit when
- You have basic controls in place and want to know if they hold
- You need evidence for a board, customer or insurer
- You invested in monitoring and want to test whether it sees an attack
Not the right start when
- There is no MFA, backup or patching yet (fix the basics with our blue team first, it is cheaper)
Is this legal?
Yes, because you authorise it in writing and we stay inside the agreed scope. We never test systems you do not own or control without the owner's permission.
Who in our company knows about it?
Usually a small group: a sponsor and an emergency contact. Keeping the rest unaware gives a realistic view of detection. You decide.
Could you break something?
We avoid destructive techniques and agree fragile systems up front. If anything unexpected happens we stop and call your contact.
What is the difference with a penetration test?
A penetration test tries to find as many weaknesses as possible in one system. A red team works toward a goal across your whole organisation and also tests whether you detect it.
More of what we do
Secure smarter.
Know where you stand.
Run the free domain scan now, or talk to us about a full outside-in look.