Red team and adversary simulation.
Campaigns test whether people, process, and tooling detect, escalate, contain, and recover when controls fail. Execution stays inside approved objectives and safety boundaries.
- Scope
- People, process & tooling
- Deliverables
- Detection and response findings
- Approach
- Signed Rules of Engagement
- Red teamFull-scope, objective-led campaigns from initial access through identity, lateral movement, persistence, and a defined business impact target.
- Purple teamCo-designed with defenders, with live feedback loops, replayable artefacts, detection engineering, telemetry review, and playbook validation.
- Adversary emulationA named or curated threat profile, realistic access vectors, ATT&CK-mapped progression, and measured defensive outcomes across a defined window.
- Ransomware simulationSafe-mode rehearsal of access, privilege escalation, lateral movement, backup and recovery paths, containment, and executive decision points without actual destruction.
- Social engineeringAuthorised pretexts, helpdesk and workflow testing, business-process manipulation, and optional physical scenarios with HR-aligned guardrails.
- Phishing simulationRole-targeted email or SMS campaigns across baseline, uplift, and validation waves, measured through reporting, escalation, and control effectiveness.
Nothing happens outside what is signed.
- AuthorisationRules of Engagement cover objectives, scope, test windows, escalation paths, approved AI use, model and data boundaries, synthetic voice or imagery, and stop conditions.
- PeoplePeople-layer work is HR-aligned and respect-first. Results are aggregated and are not used for individual blame, humiliation, or performance management.
- AI-assisted tradecraftOperator-reviewed tooling can support pretext drafts, recon synthesis, or detection queries when relevant. Messages, payloads, and targeting remain human-authorised.
- Evidence handlingOnly the material needed to prove risk and guide uplift is retained. Artefacts, scripts, recordings, and staff interactions are confidential and follow agreed retention controls.
- OutputsA chronological campaign narrative, detection and response gaps, ATT&CK mapping, replay notes, prioritised defender actions, and a working debrief.
Choose the right exercise.
- Start with an objectiveDefine the business scenario and the defensive decisions to assess. A red team tests a bounded objective; it is not intended to catalogue every vulnerability across the estate.
- Confirm readinessAgree executive sponsorship, an authorised control group, operational contacts, permitted systems and clear stop conditions. Decide which defenders will know about the exercise and how real incidents will be distinguished from test activity.
- Set the boundariesSocial engineering, physical access, data handling and any potentially disruptive activity need explicit agreement. Scope, duration, permitted channels, sites and defender collaboration determine the estimate.
When is a penetration test a better starting point?
Choose a penetration test when you need detailed coverage of a defined application or environment and a prioritised set of weaknesses to fix. A red team is more suitable when you want to assess how controls and defenders respond to an agreed scenario.
When should we choose purple teaming?
Choose collaborative purple-team work when the priority is improving telemetry, detection rules and response procedures with the defenders involved. The report records what was observed and what needs improvement, not just whether an objective was reached.
What happens after the exercise?
We work through the evidence, timeline and control gaps with the agreed audiences. Any follow-up validation or repeat exercise is defined in the engagement scope; it should target the changes the defenders and system owners have made.
Send the objective and constraints.
Include the question the campaign must answer, the environment and people in scope, relevant threats, required stakeholders, and any safety boundaries.