Red Team Assessment

Flow chart of the Red Team Assessment engagement, 5 phases in order, each one selectable. Phase 1, Objectives and Rules of Engagement. We agree the goals, the systems in scope, the tactics allowed and the safety limits. Everyone signs off before anything starts, so the exercise is realistic and controlled. Activities: Define the crown-jewel objective and success criteria with your leadership; Set the scope, allowed tactics and out-of-bounds systems; Agree emergency stop conditions and named trusted agents; Establish deconfliction and communication channels for live testing; Capture written authorisation and rules of engagement sign-off. Hands over Signed Rules of Engagement and Scope Document. Phase 2, Reconnaissance. We map your public footprint, staff, technology and supply chain to build an attack plan. Most of this looks exactly like what an outside attacker can see. Activities: Enumerate internet-facing hosts, domains and cloud tenants; Harvest employee names, roles and email formats from public sources; Profile suppliers and third parties with access to your estate; Collect leaked credentials from breach data for your domains. Hands over Target Profile and Attack Plan. Phase 3, Initial Access. We gain a foothold through the path a real adversary would choose, including phishing, pretext calls and other social engineering, alongside exposed services and weak credentials. Activities: Design pretexts matched to real lures your staff receive; Run targeted phishing and pretext calls against selected roles; Test exposed services for weak or reused credentials; Establish a resilient command and control channel. Hands over Initial Access Record with Evidence. Phase 4, Lateral Movement and Objectives. From the foothold we escalate, move across your network and work toward the agreed objective, capturing evidence at each step without disrupting your operations. Activities: Map Active Directory attack paths to privileged accounts; Escalate privileges and harvest credentials from compromised hosts; Pivot toward the agreed crown-jewel objective; Capture timestamped proof at every milestone. Hands over Attack Narrative and Evidence Pack. Phase 5, Detection Scorecard and Purple-Team Replay. We score which actions your team detected, missed or blocked. Then we replay the key steps alongside your defenders so they can tune alerts and close the gaps for good. Activities: Score every action as detected, missed or blocked; Map the operation to MITRE ATT&CK coverage; Replay key steps live alongside your defenders; Agree detection rules and response fixes with owners. Hands over Detection Scorecard. Each phase begins from the artefact the phase before it produced.