Test whether you'd actually detect a real adversary.
A pen test enumerates findings. A red team has an objective — and tests whether your detection, response, and recovery actually work. Annual exercise that validates what your SOC catches and what slips through.
- Duration
- 4–8 weeks
- Method
- Objective-based
- Detection-aware
- Yes
- Debrief
- Purple-team session
What we do
Objective-based scoping
Concrete goals: 'reach the customer database', 'exfiltrate finance data', 'achieve domain admin'. Not generic 'find vulnerabilities'.
Multi-vector access
Phishing, valid-account abuse, exposed-service exploitation, supply-chain pretext — whatever a real adversary would use.
Detection-aware execution
We track which actions triggered alerts, which were investigated, and which slipped through entirely.
Living-off-the-land technique
We use the same tools an adversary would — not noisy red-team frameworks that your EDR catches in the first five minutes.
Purple-team debrief
Joint debrief with your SOC where we walk through the timeline, alert by alert. The biggest learning happens here.
Detection-engineering recommendations
Specific detections to write — with sample rules — based on what we got away with.
Engagement lifecycle
- 01Weeks 1–2
Objective + recon
Objective agreed with executive sponsor (often kept from the SOC). External recon and target profiling.
- 02Weeks 2–5
Access + traverse
Initial access vectors executed. Lateral movement, persistence, privilege escalation toward the objective.
- 03Weeks 5–6
Objective + exit
Objective achieved (or documented why not). Clean exit with all artifacts cataloged.
- 04Week 7
Purple-team debrief
Joint walkthrough with your SOC. Timeline overlaid against your alerts. Honest conversation about what worked.
- 05Week 8
Detection engineering
Detection rules drafted for the techniques that slipped through. Roadmap for the next 90 days.
What you walk away with
- Honest read on what your SOC actually catches
- Catalog of techniques that slipped through detection
- Detection rules for the gaps, ready to deploy
- Purple-team muscle memory for your defenders
- Defensible audit-evidence of adversary-emulation testing
- Executive-ready narrative for the board