Does your SOC see what's coming?
A pentest tells you which vulnerabilities exist. Red teaming answers the question your board actually asks: if a real attacker hits today - do we notice, do we stop it, or do we read about it in the news?
Commercial red teaming: formats, sizing, delivery, difference to a pentest.
Regulatory obligations are not covered here - see /dora-tlpt and /tiber-eu.
- How does red teaming differ from a penetration test?
- Which format fits our maturity?
- How does an operation run - and what is in the rules of engagement?
Red teaming tests your blue team. Pentesting tests your systems.
The NATO Cooperative Cyber Defence Centre of Excellence puts it plainly: a penetration test hunts vulnerabilities. A red team simulates an adversary - with the explicit purpose of exercising the defenders. If you've never tested your detection and response plan while actually being attacked, you don't know whether it works.
That's why red teaming makes sense the moment you have a defensive strategy you actually want to stress-test: SOC, EDR, SIEM use-cases, incident-response playbooks, awareness programmes, physical controls. Without those, a red team produces spectacular screenshots and little learning. With them, it delivers the only credible statement about your real resilience.
Two instruments, two questions.
| Penetration test | Red teaming | |
|---|---|---|
| Question | Which vulnerabilities exist? | Does the defence detect and stop us? |
| What's tested | The system | The people, processes and tools defending it |
| Scope | Defined systems, breadth first | Attack path to an objective - across the organisation |
| Announcement | Known and coordinated | Covert - only a small white team is informed |
| Output | Prioritised vulnerability list | Assessment of your detection & response capability |
| Maturity where it pays off | From day one | Once a SOC / blue team exists or is being built |
The two are complementary. Pentests harden the substance. Red teams harden the defenders.
Not every red team is a six-figure TIBER exercise.
TIBER-DE, CBEST and DORA TLPT are the gold-standard format for regulated financial institutions. For everyone else, a focused, scenario-based red team gives you the decisive answer at a fraction of the cost and in a few weeks. The point isn't to tick a framework box - it's to spend defensive budget where it actually matters.
Focused scenario
One adversary, one objective, 3-5 weeks. Example: 'ransomware crew reaches domain admin in 10 days.'
Full operation
Multiple scenarios, 8-14 weeks. Cyber, social engineering and physical - end-to-end like a real actor.
TIBER-DE / DORA TLPT
Regulatory delivery to TIBER-EU methodology with white team, threat-intelligence report and attestation.
TIBER/DORA page →Who would attack you? How? And what holds?
We don't start with your systems - we start with the actors you're a target for: ransomware crews, initial access brokers, insiders, nation-state operators, activist groups. From their objectives and typical techniques (MITRE ATT&CK) we derive the scenarios that could actually hit you. Anything else is cinema.
Who?
A threat-intel picture of actors actively targeting your sector and geography.
How?
Your most plausible attack paths - initial access, lateral movement, impact - cleanly mapped to ATT&CK.
What holds?
Objective assessment of your detection and response chain, technique by technique.
Concrete questions we answer with a red team.
Manufacturing company
What tangible and demonstrable options does an activist group with malicious intent but a budget below €5,000 have to disrupt our daily operations?
Defense company
As we are entering the Ukraine/Russia conflict as a weapons provider: How well are our defences tuned against Russian APT attacks?
Logistics company
As ransomware attacks are being carried out by organised crime groups (OCGs) against other companies in our sector: how are our defences holding up against such attacks?
A low-budget adversary walks through the lobby. Does anyone notice?
Not every adversary sends phishing mail. Activists - from Fridays for Future to Extinction Rebellion - have disrupted production lines, blocked vehicles and reached data-centre floors without writing a single line of code. Petty criminals lift laptops from meeting rooms. Competitors send someone in a hi-vis vest with a clipboard to photograph whatever looks interesting.
Our physical red teams test what your cameras, locks, reception process and workforce actually deliver right now: tailgating at the side entrance, unlocked desktops in meeting rooms, unsecured server rooms, cleaning-crew pretext at midnight, USB drops in the car park. The report is uncomfortable - which is precisely what makes it valuable.
Budget where it works
You learn which control actually stopped the attack - and which merely looks good in a compliance report. A red team replaces gut feel with evidence.
Make dwell time visible
Mandiant M-Trends 2024 reports a global median attacker dwell time of 10 days. You only know your own number after a covert operation.
Reality beats assumptions
Verizon DBIR 2024: 68% of breaches involve a human element. A red team stresses that whole chain - people, process, technology - as one system.
Six formats - from focused scenario to continuous programme.
Adversary simulation
APTs, OCGs and initial access brokers of your sector, mapped to MITRE ATT&CK.
Social engineering
Phishing, vishing, pretexting - through to measurable impact, not just click-through.
Physical intrusion
Access testing, tailgating, USB drops, server-room and MDF access.
Purple Team
Joint exercise with your blue team - measurably better detections, playbook by playbook.
TIBER-DE / DORA TLPT
Intelligence-led, regulator-recognised operation to the TIBER-EU methodology.
Priority page →RTaaS
Continuous red-team campaigns instead of a one-off snapshot.
We compromise without destroying. Your production stays up.
A small white team is briefed - the rest of the organisation is tested for real.
The operation can be paused within minutes. Always.
Find out not just whether you're vulnerable - but how your defence fares against the actors that actually matter for you.
30 minutes with a senior operator. We settle on the right format, a realistic scenario and a price range - before you commit to anything.
Red team assessment, adversary simulation, RTaaS - frequent questions
What is a red team assessment?
A red team assessment is a goal-oriented, covert attack simulation against a company. Unlike a pentest, the focus is not breadth of findings but a concrete objective - for example access to a crown-jewel application, Domain Admin, or payment authorisation. The scope covers technology, people, processes, and detection & response.
Red team assessment vs. penetration test - what's the difference?
A pentest looks for as many vulnerabilities as possible within a defined scope over a few weeks. A red team assessment pursues a realistic attacker objective under stealth conditions over several weeks and explicitly measures the blue team's response. Neither replaces the other - they answer different questions.
How long does a red team assessment take?
Realistically 8-16 weeks from kick-off to final report: 1-2 weeks of threat modelling and OSINT, 6-12 weeks of active operation, then reporting and a purple-team replay. Under six weeks is rarely useful because detection engineering and persistence need time to play out.
What is adversary simulation?
Adversary simulation (also: adversary emulation) means replaying the TTPs of a specific threat group as documented in MITRE ATT&CK. We use this format when a client wants to test a specific threat hypothesis - for example the modus operandi of a ransomware crew.
What does red team as a service mean?
Instead of a one-off exercise, we contract a continuous mandate: multiple smaller goal scenarios per year combined with detection-engineering cycles. Only useful past a certain SOC maturity - otherwise the same attack path just keeps succeeding.
Do we need a red team assessment or a pentest?
If you first want to know where your weaknesses are or need to assess a specific application: pentest. If you want to know whether a real attack would be noticed and whether your detection response works: a red team assessment. If regulation requires it (DORA TLPT, TIBER-EU): a red team run under the TIBER framework.
Red teaming, TIBER-EU and DORA TLPT - who answers what
Explains the ECB framework: roles, phases, national variants.
Open pageExplains DORA Article 26: scope, deadlines, provider requirements.
Open pageOur service: how Exploit Labs delivers and documents a regulated operation.
Open pagePractical checkpoints per phase for teams starting preparation now.
Open pageRequest red team scoping - confidentially.
Describe in a few sentences what needs testing. We come back with concrete questions, the right type of exercise and an effort range - before you commit to anything.
Not ready to talk yet? The Scope Check returns exercise type, tester-days and a budget range in two minutes - no email gate.