Red Team Engagements & Adversarial Simulation
Red Team Engagements & Adversarial Simulation
Goal-oriented adversarial simulation.
Multi-week engagements where we work toward specific objectives — not a finding count. Phishing, endpoint compromise, lateral movement, exfiltration. Mapped to MITRE ATT&CK with detection metrics included.
Different exercise. Different outcomes.
A pentest tells you what's vulnerable. A red team tells you what an attacker would actually do — and whether you'd catch them. The deliverable isn't a finding count; it's a narrative of objectives met, detection gaps surfaced, and response performance measured.
- Objectives, not coverage: 'access customer PII', not 'test 1,000 endpoints'
- Multi-vector: phishing, social, web, cloud, supply chain, physical
- Stealth scoring: how long until detected, by whom, with what signal
- Response evaluation: did your SOC actually act on the alerts they generated
OBJECTIVE 1 Customer PII exfiltration Path: phishing → endpoint → AWS keys → S3 → 2.4M records Detection: none for 14 days MITRE: T1566.001, T1078.004, T1530 OBJECTIVE 2 Production deploy access Path: stolen GitHub creds → Actions OIDC → prod IAM role Detection: none MITRE: T1199, T1098.003 OBJECTIVE 3 Customer wire transfer Path: BEC → finance team → bank portal Detection: caught at hour 4 MITRE: T1534, T1656 → 2/3 objectives met undetected. → Detection gaps: 4 specific MITRE techniques.
Every action tagged. Every gap traceable.
Findings aren't a vulnerability list — they're a coverage map of MITRE ATT&CK techniques against your detection stack. You walk away knowing exactly which techniques you'd catch, miss, or partially detect.
- TTPs mapped to MITRE ATT&CK in real time during engagement
- Detection scoring per technique: missed, partial, caught
- Comparison against industry baselines for your sector
- Purple team workshop on closeout to remediate detection gaps
INITIAL ACCESS T1566.001 (Spearphish attach) MISSED T1190 (Public-facing app) CAUGHT EXECUTION T1059.001 (PowerShell) CAUGHT T1059.003 (Cmd) PARTIAL PERSISTENCE T1098.003 (Add cloud admin) MISSED T1136.003 (Create cloud acct) MISSED CREDENTIAL ACCESS T1552.001 (Creds in files) MISSED T1555.005 (Password manager) CAUGHT EXFILTRATION T1530 (Cloud storage) MISSED T1041 (C2 channel) CAUGHT Coverage: 4/10 techniques caught Industry baseline (SaaS): 6/10
Engagement vectors
Multi-vector adversarial simulation.
Targeted spearphishing, vishing, smishing. Custom infrastructure. Tracked clicks and credential capture.
Internet-facing assets — chained with phishing for realistic initial access.
Post-phishing — privilege escalation, EDR evasion, persistence, lateral movement.
AWS / GCP / Azure — IAM abuse, instance metadata, cross-account assumption.
Dependency confusion, typosquatting, CI/CD compromise via OIDC trust.
Office access, badge cloning, USB drops, network jack assessment.
Goal-priced. Multi-week. Multi-vector.
Deliverables
Detection scorecards, not vulnerability counts.
Day-by-day operational log: what we tried, what worked, what was detected, when, by whom. Reads like an incident timeline. The single most useful artifact for your detection engineering team.
Per-technique coverage map: which TTPs your stack caught, partially caught, missed entirely. Comparison against industry baseline for your sector.
Closeout session with your SOC and detection engineering team. We walk through every undetected technique, explain what signals were generated, recommend specific detection rules.
90-minute exec briefing with screenshots and video of the most critical compromises. Built specifically for board-level audiences. Doesn't require security expertise to follow.
Frequently Asked Questions
Common questions, answered.
How is this different from your pentest service?
How long is a typical engagement?
Will our SOC team know it's a test?
What about legal authorization and scoping?
How much does a red team engagement cost?
Do you do physical red teaming?
Can you do supply chain attacks?
Do you provide MITRE ATT&CK mapping?
Can the engagement be remote-only?
What if you find something critical mid-engagement?
Do you offer purple team workshops?
How does this compare to FedRAMP / NIST 800-53 red team requirements?
How is red teaming different from penetration testing?
Will our SOC team know it's a test?
What about legal authorization and rules of engagement?
Can you do physical / social engineering on-site?
What's the difference between red team and bug bounty?
Do you require any specific tools or telemetry from us?
What is a red team engagement
Goal-driven adversarial simulation, not a longer pentest.
Red team engagements are multi-week adversarial simulations where an offensive security team works toward specific objectives — accessing customer data, achieving production deployment, exfiltrating financial information — using whatever realistic attack vectors are in scope (phishing, web/cloud exploitation, supply chain compromise, occasionally physical access). The goal isn't a finding count; it's an honest answer to the question: "could a real attacker do this, and would we catch them?"
Where a pentest tells you what's vulnerable, a red team tells you what an attacker would actually do and whether your detection-and-response capabilities would catch them. Findings are framed as objectives met or not met, mapped to MITRE ATT&CK techniques, and accompanied by detection scorecards showing which TTPs your SOC caught, partially detected, or missed entirely.
Red teaming complements rather than replaces application pentesting. A pentest provides broad-coverage finding lists; a red team provides narrow-but-deep narrative-driven scenarios. Most mature security programs run both: pentests for coverage, red teams for validation.
- Multi-week engagements (4-12 weeks typical)
- Mapped to MITRE ATT&CK (full TTP traceability)
- Detection scorecards: caught / partial / missed per technique
- Purple team workshops on close to remediate detection gaps
Pricing & timeline
Multi-week, fixed-fee, scoped by objectives.
Red team engagements are scoped by objective complexity, vector mix (phishing only? phishing + cloud + endpoint?), and duration. The largest cost driver is dwell-time — short engagements run lean, longer engagements add infrastructure, persistence, and detection-evasion work.