OFFENSIVE SECURITY · PROFESSIONAL SERVICES
Find out how far a real attacker gets
The truest test available of whether people, process and technology together can detect and stop a realistic, determined attacker: an objective-based simulation run against your live estate under agreed rules of engagement, from first access to the objective, measured against what your defenders actually saw — by a team that combines offensive and DFIR expertise.
ENGAGEMENT AT A GLANCE
ScopePeople, process and technology
BasisSigned rules of engagement
OutputAttack narrative + detection gaps
YOU RECEIVE
Rules of engagement and agreed objectives, signed before we start
Full attack narrative with timeline and evidence
Detection and response gap analysis, stage by stage
Findings mapped to MITRE ATT&CK techniques
Purple-team debrief with your SOC
WHAT'S COVERED
Scope of the engagement
01
Objective setting
What success means for the attacker — a payment run, a customer database, domain control — agreed with you before anything starts.
02
Reconnaissance
What your organisation exposes without meaning to: staff, suppliers, leaked credentials and infrastructure nobody remembers owning.
03
Initial access
Technical, physical and social vectors where they are in scope — the ways in a real campaign would actually use.
04
Lateral movement
Privilege escalation, movement toward the objective and persistence, run quietly enough to test whether anybody notices.
05
Detection measurement
What your tooling logged, what your team escalated, and how long each stage of the chain survived before anyone reacted.
06
Purple-team debrief
The chain re-run with your SOC watching, so every missed step turns into a detection they have seen fire.
COMMON QUESTIONS
Before you ask
How is this different from a penetration test?
A penetration test enumerates weaknesses in a defined system. A red team pursues an objective across the whole organisation and stops when it reaches it — so the finding is how far the chain got and who noticed, not a catalogue of every flaw along the way.
Will this disrupt production?
The rules of engagement name the systems that are out of bounds, the actions that need approval first, and a contact on both sides who can stop the exercise immediately. Destructive actions are never in scope.
Should our own security team know it is happening?
Usually only a small number of people do, because that is what makes the detection measurement mean anything. Who is briefed is your decision and it is written into the rules of engagement.
THE DELIVERABLE
What lands on your desk at the end
Before you sign, ask us exactly what the report contains — it is the fastest way to judge whether the work is worth buying.
REPORT CONTENTS
Executive narrative of the campaign, written for a board
Stage-by-stage attack chain with evidence and timestamps
Detection gap analysis — what was logged, alerted and escalated
Findings mapped to MITRE ATT&CK tactics and techniques
Prioritised remediation and detection-engineering backlog from the purple-team debrief
WHAT WE NEED FROM YOU
A signed rules-of-engagement document
A named authorising officer and an emergency stop contact
Agreed objectives and an explicit out-of-bounds list
A deconfliction channel open for the duration of the exercise
FRAMEWORKS THIS EVIDENCES
MITRE ATT&CKISO/IEC 27001:2022 Annex A
Findings are mapped to control references so the report can be handed to an auditor without translation.
Ready to secure your business?
Book a consultation with our engineers. Bring your architecture and your constraints — we'll tell you what we would do first, and why.
WHAT A CONSULTATION LOOKS LIKE
01
A conversation with an engineer
Not a sales call. Bring your architecture and your constraints.
02
A written gap summary
Prioritised, with what we would do first and why.
03
No obligation, no follow-up sequence
If it is not a fit we will say so on the call.
Not ready to talk? See the company facts — entity details, offices and our NTRA certification.
One inbox, answered by an engineer — not a routing queue.