Home
Penetration testing
Red team services

Red teaming that tests whether anyone notices

An objective-based simulation of a real adversary: we pick a goal, take any route to it without warning your defenders, and show you exactly what your SOC did and didn’t catch.

Get a quote See a sample report

What a red team covers

01 · What it is

A goal, and no warning to the defenders

A penetration test finds vulnerabilities in a defined scope. A red team picks an objective — “reach the payment system” — and tests whether your people, process and technology stop a real attacker getting there.

Objective-based

We agree a goal that matters to the business, then find any route to it

Realistic initial access

Phishing, exposed services, physical and supply-chain routes, as agreed

Tests your blue team

Whether your SOC and tooling detect and respond, not just whether a bug exists

Full kill chain

Access, persistence, movement and actions on objective, mapped to MITRE ATT&CK

Discuss a red team engagement

02 · Pentest or red team?

Two different questions

They’re not interchangeable. Most organisations should be confident in their basics (a penetration test) before they test detection and response (a red team).

Penetration test

Red team

Question it answers

What’s vulnerable in this scope?

Can a real attacker reach our crown jewels?

Scope

Defined assets, broad coverage

A single objective, any route

Defenders know?

Usually yes

No — detection is part of the test

Best when

You want to find and fix weaknesses

Your basics are solid and you’re testing your SOC

Decide which you need

03 · How it runs

Access to objective, quietly

We move the way an adversary does, staying below the alert threshold wherever we can, and record what your defenders saw.

Phase 1

Initial access

A targeted phish or an exposed service, as agreed.

Phase 2

Establish

Persistence and command-and-control that evades tooling.

Phase 3

Move

Lateral movement toward the objective, quietly.

Phase 4

Test response

What your SOC detected, and how fast it acted.

Phase 5

Objective

Reach the goal, then replay the whole chain with your team.

The debrief is the point: a timeline of what we did against what you saw, so you know exactly where detection and response need work.

Plan a red team

04 · Questions

Red team FAQ

Get a quote

More in our guide to adversary simulation.

How is a red team different from a penetration test?

A penetration test finds and lists vulnerabilities across a defined scope. A red team picks one objective and tries any route to it, without warning the defenders, to test detection and response as well as technical weaknesses.

Should we do a red team or a penetration test first?

Almost always a penetration test, or several, first. A red team tests whether your SOC catches an attacker; that’s only worth doing once your basic vulnerabilities are under control and you have detection to test.

Does the red team cover physical and social engineering?

It can. Phishing is standard; physical intrusion, vishing and badge cloning are included when they’re a realistic route to the objective and you authorise them in the rules of engagement.

Is this the same as TLPT for DORA?

Threat-led penetration testing (TLPT) under DORA is a regulated, intelligence-led red team with specific rules. A red team is the broader discipline. See our DORA and TLPT page for the regulatory detail.

What do we get at the end?

An attack narrative mapped to MITRE ATT&CK, a detection-and-response timeline comparing what we did to what you saw, and prioritised recommendations for both prevention and detection.