Red Team Engagements

A penetration test is a focused, time-limited assessment of specific systems or applications — the scope and targets are agreed in advance. A red team engagement is objective-based: we're given a realistic attacker goal (e.g. access the CFO's email, extract customer records, compromise an OT network segment) and use a wide array of means to achieve it, across people, processes, and technology. The blue team typically does not know the engagement is happening.

Most red team engagements run 4–8 weeks to allow enough time for realistic multi-stage attack chains. Shorter 2–3 week 'assumed breach' scenarios are also available for organizations that want to test detection and response rather than initial access.

That depends on your objectives. In a full red team, only a small group of stakeholders (the 'white cell') are aware — the security operations team is deliberately kept uninformed to provide a realistic test of detection and response. In a purple team exercise, the defenders participate and respond in real time, which accelerates learning.

We use the same techniques as real-world threat actors: phishing and spear-phishing, credential harvesting, living-off-the-land (LOLBAS), lateral movement, Active Directory attacks, cloud pivot techniques, and physical intrusion simulation where in scope. All techniques are mapped to MITRE ATT&CK.

You receive a full attack narrative documenting every stage of the campaign, a MITRE ATT&CK heat map showing which techniques succeeded and which were detected, and a prioritized list of defensive improvements. We also offer a findings debrief with your security and leadership teams.

Initial access (T1566 phishing, T1190 public-facing application exploitation), credential access (T1003 OS credential dumping, T1558 Kerberoasting), lateral movement (T1021 remote services, T1550 pass-the-hash), and persistence (T1053 scheduled tasks, T1547 boot/logon autostart) are the most frequently successful. Defence evasion — particularly LOLBAS techniques and disabling security tools — is where most blue teams struggle to detect us.

Yes. For organizations with converged IT/OT environments, we offer red team engagements that cross the IT/OT boundary — simulating how a real threat actor would pivot from a compromised IT workstation into an OT network segment. Our OT specialists ensure all techniques are safe for live industrial environments. These engagements are scoped carefully and typically require additional preparation time.