Red Team Operations
Objective-driven adversary simulation measured against your detection and response.
Coverage
Objectives
Agreed crown jewels: a domain, a payment system, a data set.
Initial access
Phishing, exposed services, physical drop-box where agreed.
Persistence and movement
Realistic tradecraft, logged so the SOC can replay it.
Detection review
What fired, what did not, and why.
Purple-team debrief
Attackers and defenders in one room, one timeline.
Detection gap report
Prioritised list of what to add to your SIEM and EDR.
How an engagement runs
Objective-driven adversary simulation: phishing, initial access, persistence, lateral movement, measured against your detection and response, not a checklist.
- Scoping call and rules of engagement.
- Testing with daily syncs.
- Executive and technical report.
- Free retest within 90 days.
- Rules of engagement workshop
- Purple-team debrief
- MITRE ATT&CK mapping
- Detection gap report
FAQ
How is this different from a pentest?
A pentest finds as many vulnerabilities as possible in scope. A red team pursues an objective the way a real adversary would and tests your people and detections as much as your systems.
Do you notify our SOC?
Only the white cell (a small named group) knows. Everyone else responds as they would to a real incident.
Is social engineering included?
Phishing and vishing are included when the rules of engagement allow; physical entry is optional.