Full attack narrative
Chronology from initial access to objective, with vector, command, screenshot and timestamp at every hop. Written so your team can reproduce each step.
Service 01
Red teaming and adversary simulation
A red team does not measure vulnerabilities. It measures whether your organisation stops a determined attacker before he reaches the objective. It runs against agreed business goals, under stealth, over weeks, and it ends by measuring the only thing that matters — what your SOC saw, and when.
Criteria
When it makes sense, and when it does not
A red team is expensive and slow. It only pays off if your organisation has already fixed the obvious and has a detection capability it genuinely wants to test. If you have never run an internal penetration test, a red team will tell you what you already know at a far higher price.
- You run a SOC or a managed detection service and want to know whether it holds against a real adversary.
- You are a financial entity in scope of DORA and must evidence threat-led penetration testing.
- Your board or a key client requires an independent assessment that goes well beyond a vulnerability scan.
- You suffered an incident and need to verify that the measures you deployed hold against the same class of actor.
Scope
What you receive
Four documents and two sessions. None of it is optional and none of it is billed separately.
Report
Report
Board summary
Four pages, no jargon: which objective was reached, how long it took, what would have stopped it and what decision now has to be made. This is the document that reaches the board.
Detection
SOC traceability table
Every offensive action with its exact time, source address and expected artefact, so your team can establish what raised an alert, what was logged without alerting, and what left no trace at all.
Closure
Purple team and retest
A joint session replaying the undetected techniques alongside your defenders, followed by verification of the fixes and a formal closure record.
Delivery
How it runs
Aligned with the TIBER-EU framework. The threat intelligence phase drives everything else: the exercise emulates actors with real motivation and intent against your sector, not a generic technique list.
01
Scoping and ROE
Business objectives, excluded systems, stop criteria, the control team and signed authorisation.
02
Threat intelligence
Actors relevant to your sector, documented TTPs, and real attack surface versus documented surface.
03
Initial access
Chosen vector across perimeter, social engineering or physical. Stealth as a requirement, not a preference.
04
Operation
Escalation, lateral movement, persistence and approach to the objective, with full activity logging.
05
Closure
Report, technical session, board session, purple team and retest of remediations.
FAQ
Frequently asked
How long does a red team take?
Six to twelve calendar weeks for a standard mid-sized engagement. A full TIBER-EU exercise, with its formal threat intelligence phase and coordination with the control team, typically runs four to six months. Anyone offering you a two-week red team is selling a penetration test under a different name.
How is this different from a penetration test?
A penetration test seeks coverage: enumerate the maximum number of exploitable weaknesses within a defined scope, with your team's knowledge. A red team seeks depth and stealth: reach a specific objective without being detected, measuring detection and response along the way. They are complementary, and the correct order is penetration test first.
Does it satisfy the TLPT requirement under DORA?
Article 26 of the DORA Regulation requires certain financial entities to carry out threat-led penetration testing following the TIBER-EU framework. A formal TLPT exercise additionally requires an internal control team, a threat intelligence provider and validation by the competent authority. I design and execute the red team component within that structure; coordination with the supervisor remains with the entity.
Is the security team told in advance?
No, and that is the point. Only a small control team knows about the exercise, and its composition is agreed in writing before we begin. There is always an emergency contact available to halt the operation within minutes if anything touches production.
Which one fits your case?
Describe the environment and the reason behind the engagement. I will reply with the recommended mode and an estimated order of effort.