How is a red team assessment different from a penetration test?

A penetration test tries to find and demonstrate the weaknesses in a named system. A red team starts from an objective you set, such as reaching a role or a piece of data, and it reports whether that objective was possible and what your teams could have seen. It is not permission to wander. If you have not had a penetration test, start there. A red team on an unknown environment mostly rediscovers the baseline.

Is social engineering included?

No, unless you opt in. If you do, the rules name the people or roles who may be approached, the pretexts that are allowed, the channels, and the stories that are forbidden. We do not target people outside that list. We do not use a pretext that threatens someone's safety, family, or employment. Phishing, if it is in scope, is a named channel with a named audience, not a blast to the whole company.

Will this disrupt the business?

It should not. You have a named contact who can halt the exercise, and so do we. Anything that would disrupt operations, destroy data, or expose real customer information is out unless the rules say otherwise, in writing, before it happens. The useful result is a path and a detection note, not an outage.

Do you emulate a specific threat group?

We will use MITRE ATT&CK to name the techniques the exercise actually used, so a detection team can map them. We do not claim to have reproduced a named group's full operation, and we do not invent a threat-intelligence story the evidence does not support. The objective you set is the assignment. The techniques are how it was or was not reached.

Who should be told in advance?

The rules name who knows. Sometimes that is a small group, so detection can be observed. Sometimes a wider group needs to know so that a phone call is not mistaken for a crime. We will not agree to an exercise in which nobody can stop it. The emergency contact is not optional.

Red Team Assessment & Social Engineering

What is a red team assessment?

A red team assessment is an authorized exercise with an objective you set: reach a system, a role, or a piece of data, from a starting position you choose. The useful result is whether that objective was possible, what made it possible, and what your teams could have seen along the way. It is not a penetration test with a more dramatic name, and it is not permission to wander through the organization until something interesting appears.

What we test

The objective decides the ground. A path might cross a web application, a remote-access gateway, or an identity plane. We stay inside the assets and the people the rules name. Social engineering is off unless you opt in. When it is on, the rules name the roles who may be approached, the pretexts that are allowed, the channels, and the stories that are forbidden. Phishing is one of those channels. It is not a default, and it is not sent to people who were never listed.

We record the techniques that worked and the ones that did not. Where it helps your detection team, we label a technique with a MITRE ATT&CK identifier. The label is there so they can look it up. It is not a costume. We do not write a narrative that implies a breach you did not authorize us to attempt.

Physical access, if you want it, is a separate line in the rules: which sites, which hours, what “success” means, and who in the building knows. We do not show up at a reception because it would make a better story.

Approach and standards

This engagement assumes you already know your baseline. A penetration test or a network penetration test is the right first purchase when you do not. A red team on an environment that has never been tested mostly spends its time on issues a scoped test would have listed more cheaply and more clearly.

The rules carry an emergency stop. You have a named contact who can halt the exercise. We have one too. Destructive actions, denial of service, and anything that would expose real customer information are out unless the rules allowed that specific action in writing beforehand. The methodology still applies: if it is not written down, it is not in the exercise.

Detection can be part of the objective. If it is, we coordinate the debrief with the people who were watching, and we separate “nobody saw it” from “nobody was asked to look.” Those are different findings.

How long it takes and what affects the price

A red team is often several weeks, not several days. The length follows the objective, the number of steps you are willing to let the exercise take, whether social engineering or physical access is included, and whether a detection team is participating in real time. A one-week sprint with a single objective and no social engineering is possible. It should not be sold as a simulation of a patient adversary.

Price follows that length, the specialties the objective needs, and the care required around production. We will decline an objective that cannot be stopped, or that asks us to deceive people about their safety or their job. That is a scoping decision, not a negotiation.

What you receive

You receive the rules and the emergency stop, the objective and the out-of-scope list, an exercise report, and a debrief with the teams you name. The report is a narrative of the paths that worked and the ones that did not, tied to evidence. It is not a catalog of every missing patch on the way. Where you want detection notes, they say what was visible and what was not, in the logs you actually have. The document types sit alongside the ones described on the methodology page.

When to choose this

Choose this when a specific objective matters more than a complete list of weaknesses, and when you can name the people who may know and the person who can stop the work. Choose a penetration test when you need that list. Choose a vulnerability assessment when you need coverage against a control set. Social engineering without a red-team objective is still a scoped exercise, and we will write it that way rather than wrap it in language it has not earned. If you are unsure which of these you are asking for, say so on the contact page. We would rather start with the smaller engagement.