Offensive · Red & Purple Team
Find out whether your defenses hold against a real attack.
A red team pursues a business objective with the tradecraft of a real adversary. A purple team runs the same techniques with your SOC in the room, so every gap becomes a working detection.
- Typical length
- 4–8 weeks
- Method
- MITRE ATT&CK, threat-led objectives (TIBER-EU-style)
- Formats
- Red, purple or assumed breach
Campaign · Objective: payment dataSimulated environment, real workflow.
Scope
What we cover.
Pick what matters for this engagement. We help you scope it in the first call.
Objective-based red team
A goal such as reaching payment data or the CEO's mailbox, pursued covertly end to end.
Purple team exercises
Techniques run openly with your analysts, tuned until each one is detected.
Assumed breach
Start from a compromised laptop or account to test internal detection and response.
Social engineering
Phishing, vishing and pretexting campaigns against agreed groups.
Physical intrusion
Badge cloning, tailgating and on-site device drops, where in scope.
Threat-led scenarios
Campaigns modeled on groups that target your sector.
Methodology
How the engagement runs.
- 01
Threat model
Pick the adversaries and objectives that matter to your business.
Output: Threat profile
- 02
Plan
Agree rules of engagement, a control group that knows, and safe stop conditions.
Output: Rules of engagement
- 03
Operate
Run the campaign, logging every action with timestamps for later replay.
Output: Action log
- 04
Replay
Walk your SOC through the timeline to see what fired, what was missed and why.
Output: Detection-gap timeline
- 05
Harden
Build and test new detections together until the gaps close.
Output: New detections
One path to the crown jewels, then closed.
We chain small weaknesses into the route a real adversary would take, then prove the fix breaks the chain.
- Attack path
- Reachable, not exploited
| Step | Asset | What happened |
|---|---|---|
| 1 | Phishing email | Macro-enabled invoice opened |
| 2 | Workstation | Payload runs as the user |
| 3 | Cached admin creds | Admin token in browser storage |
| 4 | Domain controller | Token reused for directory admin |
| 5 | Customer DB | Target: 1.2M customer records |
Simulated environment, real workflow.
Findings
Where the chain was weakest.
Every finding is tied to the stage of the attack it enabled, so you fix the links that broke the chain first, not the longest list.
- Critical
- High
- Medium
- Low
| Group | Critical | High | Medium | Low | Total |
|---|---|---|---|---|---|
| Access | 1 | 2 | 3 | 2 | 8 |
| Execution | 0 | 3 | 2 | 1 | 6 |
| Escalation | 2 | 1 | 2 | 0 | 5 |
| Lateral | 1 | 2 | 3 | 2 | 8 |
| Objective | 1 | 1 | 0 | 1 | 3 |
Simulated environment, real workflow.
Deliverables
What you walk away with.
Written for the engineers who fix things and the leaders who fund them.
- Named lead for the whole engagement
- Critical issues flagged the same day
- Retest included
Attack narrative
The full campaign as a timeline, with each step mapped to ATT&CK.
Detection gap matrix
Which techniques were prevented, detected, logged only or missed.
Detection content
Rules and queries built in the purple-team phase, ready for your SIEM.
Detections delivered
Every missed technique handed to your SOC, or ours, as a tested detection and a threat-hunting lead.
FAQ
Questions we hear most.
What is the difference between red and purple teaming?
Red teaming is covert and tests your response end to end. Purple teaming is collaborative and builds detections as you go. Many clients run red first, then purple.
Who in our company needs to know?
A small control group, usually the CISO and one or two others, who can stop the exercise and tell real incidents apart.
How do you keep it safe?
Written rules of engagement, no destructive actions, and agreed stop conditions. Every action is logged.
Can our managed SOC take part?
Yes. If our SOC monitors you, the exercise also tests that service, and we report on it openly.
Related
Often paired with.
Scope your Red & Purple Team engagement.
A 30-minute call with a senior practitioner. You leave with a scope, a timeline and a fixed quote.