Red Team Assessment

A penetration test enumerates weaknesses across a defined scope; a red team tests whether your defence stops a focused attacker reaching one agreed objective. The practical difference is what gets measured. A test is judged on coverage: how much of the application or network segment was examined and how many issues were found. A red team is judged on the path taken and on what your defenders saw while we took it, so people, process and detection are all in the measurement. That means a red team deliberately leaves findings on the table. If one route reaches the crown-jewel objective, we do not enumerate the other four. Most organisations need both, and in that order, because an unfixed obvious flaw turns the exercise into a short and uninformative story. Our guide comparing red teaming with penetration testing sets the two side by side if you are deciding between them.

Scope is written down and signed before anything starts, and it names both what we may reach for and what we must leave alone. Usually in scope: your internet-facing estate, staff who can be reached by phishing or pretext calls, the identity and Active Directory paths between a foothold and the objective, cloud tenants you control, and suppliers you have the authority to include. Usually out of scope: systems you do not own or cannot authorise, anything a supplier contract forbids, denial-of-service and destructive actions, data exfiltration beyond the proof needed, and any host your team marks out of bounds. Physical intrusion and on-site entry are out of scope and are not part of this engagement unless separately agreed in writing. From you we need the asset list, the named trusted agents, and written authorisation from someone empowered to give it. Where an asset sits with a provider, we need their permission in writing too.

The rules of engagement fix the objective, the tactics allowed, the safety limits and the stop conditions, and both sides sign before any testing begins. Four controls do most of the work. A small group of named trusted agents knows the exercise is running, so your team can confirm that an alert is us and not a genuine intruder. A deconfliction channel stays open throughout for exactly that question. Emergency stop conditions are agreed in advance and either side can invoke them without argument. If an action risks affecting a live system, we pause and check with your named contact rather than proceeding and apologising afterwards. Each action we take is logged with timestamps so it can be attributed later. You also decide how covert the exercise is, and that decision is written into the rules of engagement before testing starts rather than revisited halfway through.

The report is built so each claim can be checked against your own logs. The attack narrative is a step-by-step timeline with timestamped proof captured at each milestone, so you can line up what we did against what your telemetry recorded. Beside it sits a detection scorecard grading each action we take as detected, missed or blocked and mapped to MITRE ATT&CK, which is the section your defenders should argue with. Findings are prioritised with practical fixes rather than generic advice, and a separate executive briefing is written for leadership and the board. The purple-team replay runs the key steps again in front of your team so they can watch the alerts arrive and tune rules while we are still there. What the report does not claim is completeness: it documents the paths we took, not every path that exists.

A red team is premature when you already know the answer will be yes. If there is no central logging, nobody watching alerts outside office hours, unpatched internet-facing services or no asset inventory, we will reach the objective and the report will tell you things you could have written yourself. The exercise earns its place when you have controls you believe in and want tested, and defenders who will act on a scorecard. Signs you are ready: testing has been running long enough that findings close rather than accumulate, someone owns detection, and leadership will fund what the replay surfaces. Signs you are not: this is your first security engagement, or an auditor asked for evidence and a red team looked like the strongest answer. In that case a penetration test and a configuration review give you more, and we will say so on the scoping call.