Services · Test
Red teaming
A red-team engagement pursues objectives you agree with us, such as reaching a particular system or set of data, to show how far a realistic attacker could get and how well your detection and response hold up. A named control group on your side oversees it and can halt it at any time.
What it covers
- Objectives and scenarios agreed with your control group
- Initial access, lateral movement and privilege escalation, using only the techniques the rules of engagement allow
- A test of your detection and response, with only the control group told the timing
- Regular check-ins with the control group throughout
- A replay of the attack path with your defenders afterwards
How an engagement runs
Name the control group
You name a small control group who know the engagement is running, can answer our questions and can stop it at any point.
Agree objectives and rules
We agree objectives, targets, exclusions, permitted and forbidden techniques, testing windows and emergency stop contacts, and record them in signed rules of engagement.
Authorise
Nothing starts until written authorisation from someone with the authority to grant it is in place, along with any third-party permissions required.
Run the engagement
We work towards the objectives within the rules, keep the control group informed, and stop whenever they ask.
Report and replay
We report the attack path in full and replay it with your defenders against what they saw at the time.
What you receive
- A written report with the attack narrative, objectives reached and findings
- A timeline of our actions, so your team can match them against your logs
- Observations on what your detection and response caught and what it missed
- Prioritised recommendations
- A debrief with the control group and a replay session with your defenders
Talk to us about red teaming.
Tell us what you want tested and who owns it. We will start with scope and authorisation before anything else.