Skip to content
RootCut
Portal
All services

Red team

Adversary simulation against agreed objectives

We attack your organisation the way a real adversary would, combining technical, physical and human techniques to reach agreed objectives, and measure what your team detects, blocks and misses along the way.

DORA TLPT and TIBER-EU

Under the Digital Operational Resilience Act (DORA), financial entities named by their authority must run a threat-led penetration test (TLPT) at least every three years. TLPT follows the TIBER-EU framework: a threat intelligence provider builds realistic attack scenarios for your organisation, and a red team carries them out against your live production systems.

Our red team engagements follow the same phases: preparation, threat intelligence, red team testing, and closure with a replay for your defenders. They can serve as a TLPT where your authority accepts us as the testers, as a rehearsal before one, or for organisations under NIS2 that want proof their defences work.

What the red team report adds

  • Attack path: every step from first access to the objective, in order and with time stamps.
  • MITRE ATT&CK mapping: each step tagged with its tactic and technique.
  • Detection matrix: per tactic, what your defences blocked, detected or missed, and how long detection took.
  • Findings: the weaknesses that made each step possible, with remediation and retests.

How we test

The red team engagement simulated a realistic, objective-based attack on the client's organisation. Unlike a penetration test, which aims to find as many vulnerabilities as possible, a red team engagement tests whether an attacker can reach agreed objectives, and how well the organisation's people, processes and technology detect and respond to the attack. The objectives and targets are listed under Scope & dates.

Attack techniques are described with reference to MITRE ATT&CK. The rules of engagement, including allowed techniques, out-of-scope systems and emergency contacts, were agreed with the client before the start.

Phases

  • Reconnaissance: collection of information about the organisation, its people and its technology from public sources.
  • Initial access: attempts to gain a first foothold, for example through exposed services, phishing or other agreed techniques.
  • Establishing a foothold: keeping access and setting up controlled command and control.
  • Privilege escalation and lateral movement: moving through the environment and gaining the access needed to reach the objectives.
  • Actions on objectives: showing that the objectives could be reached, using harmless proof (such as reading a marker file) rather than causing damage.
  • Reporting: the attack path is described as a timeline, together with the weaknesses used and the points where the attack was or could have been detected.

Limitations

  • A red team engagement follows one or a few attack paths. It does not aim to find every vulnerability, and areas outside the chosen paths may contain issues that are not reported.
  • The engagement is a point-in-time assessment within the agreed test dates.
  • Actions that could cause damage, loss of data or service disruption were not performed.