Your people
We phish your staff, call your help desk with a pretext and see who hands over a login. Where your people are in scope, we test them the way a criminal would.
Who opens the door, and why
Red Teaming · Global
Red teaming services that show you how far an attacker gets before anyone notices.
You name the thing that would hurt most. Our red team attacks it the way a real criminal group would, through your people, your network, your cloud, your buildings and your suppliers, and records every step. You get the chain we walked, with timestamps to hold against what your monitoring saw, and the fix for each link. Built for organisations that already pass their penetration tests and want to know whether the whole business holds.
CREST-certified operators · OSCP holders · 1,000+ tests delivered · every finding human-verified
What is red teaming?
In red teaming, a team of operators plays the attacker. They pick an objective a real intruder would want, the customer database, the payment system, a director’s mailbox, and try to reach it by any route, the way a criminal group would. They phish your staff, work through your network and cloud, try your doors and lean on your suppliers. Your defenders find out the way they would in a real attack: when, and if, their monitoring catches it.
You walk away knowing how far an attacker gets, how long they moved before anyone noticed, and which single fixes would have broken the chain. We scope each engagement on a call: you see the objective, the routes and the timeline before you commit, and you pay for the work rather than a package.
A red team sits alongside three other disciplines that often get sold under the same name. Our Field Note on adversary simulation vs red teaming sets out what each one tells you and how to stack them.
Which test do you need?
Red teaming vs penetration testing
Buyers get sold these as interchangeable. Each one answers a different question, and buying the wrong one wastes a budget cycle.
| Activity | What it answers | Best for |
|---|---|---|
| Vulnerability scan | What might be wrong, according to a tool. | Monthly hygiene. It produces a list, with no evidence behind it. |
| Penetration test | Which weaknesses in a defined scope actually open a door, proven. | Coverage. Showing your controls hold, and satisfying an auditor or a client questionnaire. |
| Adversary simulation | Whether your security operations team detects a named threat actor’s playbook, technique by technique. | Grading detection against the groups that target your sector. |
| Red team | How far a determined attacker gets towards one objective, by any route, before anyone notices. | Realism. Testing your people, your detection and your response together. |
Most mature security teams run more than one. The penetration test finds the known doors across your estate. The red team tells your board whether a motivated attacker gets in at all, and whether your team would see it happen.
What a red team covers
Every route a real attacker would try
We agree the routes with you up front. A targeted red team goes after one objective by the most likely path. A full red team uses every route on this list.
Your network and Active Directory
From the first foothold we move the way an intruder does: escalate privileges, cross your segments and head for domain admin and the systems behind it.
How far one laptop takes us
Cloud and identity
We test the roles, keys and permissions in AWS, Azure and Google Cloud, and whether a stolen identity reaches data that should sit out of its reach.
The permission that hands over your data
Physical entry
Where you put it in scope, an operator tries the doors, tailgating and badge cloning, then tests the office wireless and whether the guest network really stays separate.
Whether someone can walk in and plug in
Suppliers and partners
An attacker who cannot get through you will try the IT provider, the outsourcer or the vendor you trust. We test that trusted path into your estate.
The side door your supplier holds open
Your detection and response
We log every step with a timestamp. Your team can hold that log against what its monitoring recorded and see when, or whether, anyone reacted.
How long we moved before anyone noticed
If you run language models, agents or copilots, an attacker will try those too. Our AI red teaming service attacks them on their own or as one route inside a wider engagement.
How it runs
From the objective to the retest
Six steps. You know what happens at each one, and you sign off before anything starts.
- 01
Objective and rules of engagement
You name what would hurt most: the customer database, the payment system, a director’s mailbox. We agree what is in scope, what is off limits and who on your side knows the test is running. You sign the authorisation before anyone starts.
- 02
Reconnaissance
We map your organisation from the outside, the way an attacker would, using public sources and nothing you handed us: staff, domains, exposed systems, suppliers.
- 03
Initial access
We pick the route most likely to work against you, a phishing email, an exposed login, a door, a supplier, and take the first foothold.
- 04
Escalation and lateral movement
From that foothold we work towards the objective, quietly, the way a real intruder avoids your monitoring. Where something stops us, we record what it was.
- 05
Objective and evidence
We reach the objective, or we show exactly where your defences held. A CREST-certified operator verifies every finding by hand before it reaches you.
- 06
Report, debrief and retest
You get the narrated attack chain with timestamps and the fix for each step. We walk your team through it, then RTP Robin re-runs the attack as you close each gap.
What you get
The chain we walked, with the fix for every link
No 200-page scanner dump. The attack as it happened, in the order it happened, with what your defenders saw at each step.
- The attack chain we walked, in order, with timestamps
- Timestamps your team can hold against what its monitoring recorded
- Findings ranked by what stops the most damage, each with its fix
- A summary your board can read and a technical section your engineers can act on
- Every finding verified by a CREST-certified operator before it reaches you
- A year of unlimited re-tests through RTP Robin, so the report never goes stale
Who it is for
When a penetration test stops being enough
If you have never had a penetration test, start there. A red team pays off once the known doors are shut and you want to know what a determined attacker does next.
- Teams that already pass their penetration tests and want to know whether their detection would catch a real intruder
- Boards that want a straight answer to how far an attacker gets, with evidence for every step
- Firms whose clients, insurers or regulators have started to ask whether they have been red teamed
- Organisations that built a zero trust architecture and have never seen it attacked
- IT providers and consultancies who want to offer red teaming to their own clients under their own brand
Proof
Named operators, held to the same bar as the large firms
CREST
We are assessed against the CREST standard, the same bar the large firms are held to.
OSCP
Every operator holds a hands-on offensive certification. Our social and physical lead runs the phishing, pretext and entry work.
1,000+
Tests delivered, most of them under NDA. The operator who scopes your engagement is the one who breaks in.
Apple
Apple credited the researcher who runs our AI penetration testing on its Web Server Security Acknowledgements for August 2026. Read the story.
We test against ISO 27001 and SOC 2, the standards your auditors and customers ask about.
For IT providers and consultancies
Your client asked to be red teamed?
You can say yes without building a red team. We run the engagement under your brand, on your paper, and your client never meets us. You keep the account and the margin.
- Your logo on the report, the portal and the re-tests
- A written promise we never contact your client
- An operator replies to your enquiry within two working days
Field Notes
How real attackers got as far as they did
Our operators write up the attacks that make the news and the engagements we can talk about. Start with these.
- Red team exercise vs penetration test: which one answers the question your board is asking
- Adversary simulation is not red teaming, and the difference decides whether your SOC sees the attack
- Zero trust does not mean zero risk: prove your architecture holds before an attacker does
- Berlin watched the data leave on 7 August. It stayed plugged into the state network until the 14th.
- One engineer’s laptop, $6.3 billion gone: what the Binance theft says about the access your own admins carry
Before you ask
Red teaming, answered
What is red teaming?
In red teaming, a team of operators picks a goal a real attacker would want, such as your customer database or your payment system, and tries to reach it by any route: your people, your network, your cloud, your buildings or your suppliers. You learn how far an attacker gets and whether your team notices, with the evidence for each step and the fix that would have stopped it.
What is a red team?
A red team is the group of operators who play the attacker. They work under a signed authorisation and agreed rules, use the same techniques criminal groups use, and report every step they took. Your defenders, the people and tools who should spot and stop the attack, are often called the blue team.
What is the difference between red teaming and penetration testing?
In a penetration test, a tester works through a defined scope and reports coverage against it, so you learn which weaknesses in that scope are exploitable. In a red team, operators pick an objective and attack the whole organisation to get there without a fixed checklist, including your people and your detection. Most mature security teams run both: the penetration test for coverage, the red team for realism.
Is adversary simulation the same as red teaming?
No. In adversary simulation, operators reproduce a named threat actor’s playbook, technique by technique, to grade whether your security operations team detects and responds. In red teaming, an operator goes after an objective by any route, to test whether the organisation holds at all. In purple teaming, both teams sit in the same room and tune detections together. Our Field Note on adversary simulation vs red teaming sets out which question each one answers.
What does a red team engagement include?
An agreed objective and rules of engagement, reconnaissance, an attempt at initial access through whichever route suits your organisation (phishing, an exposed system, physical entry or a supplier), escalation and lateral movement towards the objective, and a report. You get the attack chain with timestamps your team can hold against its monitoring, ranked findings with fixes, a debrief, and a year of re-tests through RTP Robin.
How long does a red team engagement take?
Longer than a penetration test. A defined penetration test scope usually takes a working week to a fortnight of testing. A red team runs for longer because it covers more routes and moves quietly to avoid detection. The length depends on the objective and the routes in scope, and we tell you the timeline before you commit.
How much do red teaming services cost?
Cost depends on the objective and the routes in scope, so we scope it with you on a call. If you want a first look before you scope anything, start with the free audit: a short call and a free first-look scan of how an attacker would get in.
Will a red team disrupt our business?
No. We agree what is in bounds before we touch a system, run destructive techniques only with explicit sign-off, and prove a path exists without taking you offline. You decide who on your side knows the test is happening and who finds out from the report.
Are we ready for a red team?
If you have never had a penetration test, start there. A tester finds the obvious doors faster and for less. You get full value from a red team once you have fixed the known weaknesses and you want to know whether your detection, your people and your response hold against a determined attacker.
Can you red team our AI systems?
Yes, as a separate engagement or as one route inside a wider red team. Our AI red team attacks the models, agents and copilots you run: prompt injection, data exfiltration, and tool and permission abuse. See our AI red teaming page for how that work maps to the OWASP Top 10 for LLM Applications.
Find out how far an attacker gets once inside.