Red teaming, and testing detection and response
We find out how your defences work under a realistic attack.
Against agreed objectives and scenarios, we attempt the attack and test how your organisation prevents, detects, reports and responds to it. We review the results with the teams involved and turn them into the improvements and re-checks that are needed.
How does the organisation prevent, detect and respond under a realistic attack?
We assess whether attack objectives were reached, together with the evidence of response.
Reviewed
Choose by the question you want answered. Every service can be contracted on its own or combined with others.
Objective-based red team exercise
Would the organisation notice and stop an attacker going after an agreed objective?
We act as a real attacker going for an agreed objective, and record and assess, stage by stage, when your organisation notices and how it stops and responds.
Red team testing led by threat intelligence
If the attackers relevant to us came for real, how would the organisation respond?
We build the scenario from threat intelligence relevant to you, to see whether you are ready for the attacks you could realistically face.
Attack and defence test detection together
Does our detection really catch the attacks we believe we are ready for?
Attack and defence work openly together, check technique by technique whether detection catches it, and fix what is missed on the spot.
You have tools and procedures, and need evidence that you would notice and stop an attack before it reaches its objective. A Red Team Assessment fits.
You want to test against the threat actors and methods relevant to your organisation and industry, or a supervisor or parent company has asked for testing under a set framework. TLPT fits.
Monitoring reports say ‘nothing unusual’, or new detection rules have gone in, and you want attack and defence to check together, technique by technique. Purple Teaming & Detection Validation fits.
For all three, these are settled with an authorised approver before we start.
The objective, the systems and people in scope, the methods used, and what we will not do.
Anything that could affect operations happens only with an agreed immediate-stop procedure in place.
Announced, limited or unannounced. Whichever you choose, an authorised approver is always aware and there is a contact line throughout. Purple teaming is open from the start.
Afterwards the records are reviewed with the teams involved and turned into improvements and re-checks.
Evidence on whether the objectives were reached, a record of prevention, detection and response, and the improvements to make next. Purple teaming leaves detection results by technique and the rules that were tuned.
Under which conditions the agreed objectives were reached, or where the attempt was stopped.
What was blocked, detected and reported at each stage, and how the organisation responded.
Improvements agreed with the teams involved, and the items to check again afterwards.
Resilience here means prevention, detection and response in agreed cyber-attack scenarios, not company-wide business continuity.
Related research: Offensive Engineering (EXPLOIT) — We research ways to analyse and verify vulnerabilities and their impact from an attacker's perspective.
