Red team & adversary simulation
A simulation of a real attacker working towards a set objective, across your people, processes and technology. Unlike a pentest, the main thing measured is your detection and response. TTPs are mapped to MITRE ATT&CK, and we finish with a purple-team debrief so your defenders learn from it.
People, process & technology
A red team is narrow, goal-oriented and stealthy. It measures whether your organisation can prevent, detect and respond, not how many vulnerabilities exist. We use assumed breach to spend more of the time on the objective, and map every technique to MITRE ATT&CK.
- OSINT and threat intelligence to design a realistic scenario
- Initial access through phishing, social engineering, physical entry or an exploit, or by assumed breach
- Foothold and command-and-control, staying hidden (Stealth, Defense Impairment)
- Privilege escalation, lateral movement and discovery toward the crown jewels
- Action on objectives with a controlled exfiltration simulation
- Detection and blue-team response measured throughout
Objective-based, ATT&CK-mapped
We structure the engagement according to PTES and map activity to MITRE ATT&CK, using its adversary emulation plans to design scenarios. Everything requires explicit prior authorisation, and defenders are usually not told in advance so the test stays realistic. There is no pass or fail: the value is in what your team learns.
- 1
Pre-engagement & rules
We agree objectives, scope, the threat profile and rules of engagement, with explicit authorisation and an NDA.
- 2
Threat intel & scenario design
OSINT and threat intelligence (Reconnaissance, Resource Development) shape a bespoke, ATT&CK-mapped scenario.
- 3
Initial access & foothold
We establish a foothold and C2 through phishing, social engineering, physical entry or an exploit, or start from assumed breach.
- 4
Objectives
We escalate, move laterally and pursue the agreed objectives while staying hidden, with controlled exfiltration.
- 5
Reporting & purple-team debrief
An attack-narrative report and a collaborative purple-team debrief turn findings into defensive improvements.
What you receive
The main deliverable is what your defenders saw and what they missed, written up as an attack narrative with an ATT&CK heatmap and then worked through together.
- Executive summary as a narrative attack story
- Objectives achieved versus not, mapped to the agreed goals
- Full attack narrative / kill chain mapped to MITRE ATT&CK
- Detection gaps and blue-team performance (the main finding)
- An ATT&CK technique coverage map / heatmap
- Prioritised remediation and a purple-team debrief workshop
Grounded in MITRE ATT&CK & PTES
Techniques are mapped to MITRE ATT&CK (Enterprise v19, fifteen tactics; the former Defense Evasion tactic is now split into Stealth and Defense Impairment). The engagement is structured according to PTES and uses ATT&CK adversary emulation plans. A red team measures detection and response. It is a learning exercise, not a pass/fail test.