// red team
Red team, Stage2
A pentest asks what's broken. A red team asks could a real adversary reach the crown jewels. We agree an objective — admin access, customer data, production control — then try to reach it across any in-scope path, mapped to MITRE ATT&CK.
// scope
What's in scope
We scope every engagement in person-days against your real attack surface. Here's what a typical test of this kind covers.
- A defined objective agreed up front
- External perimeter and exposed applications
- Phishing and social engineering (by agreement)
- Cloud and identity attack paths
- Lateral movement and privilege escalation
- Detection and response evasion (purple-team option)
- Data exfiltration simulation to the objective
- Anything not needed to reach the agreed objective
- Destructive actions or genuine data theft
- Targeting staff outside the agreed rules of engagement
// method
How we test it
Manual-first, grounded in our five-stage methodology. Scanners cover ground; a person reproduces and proves every finding.
- 01
Set the objective
We agree the goal, the rules of engagement and the safe limits in a signed authorization.
- 02
Recon & foothold
Map the surface, find the weakest realistic entry point and establish an initial foothold.
- 03
Advance
Move laterally, escalate and chain weaknesses toward the objective — the way an attacker actually operates.
- 04
Reach & prove
Demonstrate reaching the objective with evidence, without causing real damage.
- 05
Debrief & retest
Full attack narrative, detection gaps, and a retest after you remediate.
// deliverables
What you get
A report a developer can act on and a manager can understand — plus a free retest to confirm the fixes.
- The full attack narrative, step by step, mapped to ATT&CK
- Where detection and response worked — and where it didn't
- Prioritised fixes for each stage of the chain
- An optional purple-team session with your defenders
- A free retest of the path once you remediate
// faq
Common questions
How is this different from a pentest?
A pentest maximises coverage of a defined scope. A red team maximises realism toward a single objective, including stealth and your detection capability.
Is phishing included?
Only by explicit agreement, with clear rules of engagement that protect your staff. Many clients keep it in scope because it's how real intrusions start.
Who should do this?
Teams that already run pentests and want to test whether their monitoring and response actually catch an intrusion in progress.
Test your defences for real
Share your targets and timeline and we'll reply with a scope and a quote. Most scoping calls take thirty minutes.