Red Team
(Adversary Simulation)
Assess the likelihood, and impact of a real-world cyber attack on your organisation.
What is a red team?
A red team engagement is designed to simulate a likely real-world threat, demonstrating if it is possible for an attacker to gain access to your organisation, evaluate the effectiveness of your defences and assess the damage that could potentially be done once inside, typically without being detected.
Testing is goal-based, and objectives are typically linked to your business-critical assets, such as intellectual property or sensitive data, and would therefore be highly impactful to your organisation if a malicious threat were to gain access to them.
Red teaming looks beyond the security of an individual application or specific network infrastructure and takes a deeper approach than other types of testing, not just uncovering vulnerabilities, but showing how these could be exploited and chained together to achieve the set goal.
We work with organisations of all sizes, whether you require a company-wide assessment or a more focused assumed compromise approach. Whatever your needs, our red team service can be tailored to suit your goals and budget, providing you with the robust cybersecurity assurances you require.
Benefits of red teaming:
Ensure critical assets are protected
Put your security defences to the test
Assess the business impact of a breach
Red teaming - the threats we simulate
We will work with you to understand the most likely real-world threats to your organisation and simulate these faithfully. These often include:
Ransomware
Ransomware attacks can have a huge impact on your business, not only can they damage the day-to-day operations, but they could also lead to reputational damage, as well as potential financial loss.
Phishing
Phishing is a common entry point for attackers. They will often attempt to deceive staff and users into clicking on malicious links, hand over sensitive information or perform actions that may compromise your security.
Supply chain compromise
Attackers don’t have to specifically target your organisation to gain access to your sensitive material or negatively affect your operations, an unsecure supply chain could offer them a backdoor in.
Remote service exploits
Staff use a myriad of applications & cloud services to access their work environments and company information. These services can provide a direct route into an organisation.
Malicious insiders
Attacks don’t just come from outside threats; insiders often have access to sensitive information & if motivated, could pose a threat to your cybersecurity.
Physical breaches
Cybersecurity doesn't just happen online, your physical premises can be a potential target for malicious attackers looking to access sensitive areas and information.
Red team approach
Red team engagements are tailored to your needs and will look provide maximum benefit to your organisation in the allocated time. One way we can tailor our red engagements is through our approach:
Black Box Approach
This approach mimics a real-life attack scenario, where we have basic knowledge of the organisation but have no prior access. A black box approach typically begins with a reconnaissance phase (such as open-source intelligence (OSINT) gathering) and is often used by clients who wish to find out how a malicious threat could gain access to their organisation from the outside.
Assumed Compromise Approach
This approach assumes that an attacker has managed to gain a level of access within an organisation’s network and is typically used by clients who wish to understand what an attacker could achieve from this position. The assumed compromise approach avoids the need for any lengthy reconnaissance phase and in many circumstances, can offer the better value testing for clients.
Red team - areas of investigation
Our consultants will look to gather information from multiple sources, utilise various techniques and attempt numerous routes to achieve their set goal. The routes we use will be dependent on the scope set, but can include a combination of:
Technology
Every connected device, website, application & server provides a potential way in for an attacker. Our consultants will look to understand your estate, probing and testing to exploit potential opportunities.
People
Our consultants can use a variety of methods, such as social engineering and open-source intelligence (OSINT) gathering, to obtain credentials, gain a foothold on your network and manoeuvre towards their goal.
Physical Security
Our team are experienced in conducting physical red team operations and, if instructed, can look to manipulate their way into premises. Once inside they will attempt to gain access to sensitive areas or confidential information unchallenged.
Processes & Controls
Once inside your organisational network, our security consultants will look to expose and exploit any poor security practices and controls. This will allow them to further their attack and work towards their overall goal.
Our red team engagement process
Our red team process will be unique to your organisation, security posture, digital estate and the goals set. Broadly speaking, each assessment will go through the following stages:
1. Understanding your test requirements
No two organisations, or projects, are the same. We work closely with you to gain an in-depth knowledge of your needs and a detailed understanding of the objectives under consideration, before putting forward a bespoke proposal of work.
2. Expert led, manual testing
Our red team service is conducted manually by our expert consultants and is designed to fully challenge your current cybersecurity measures. All our consultants are directly employed by us, meaning we ensure the highest quality of service.
3. Reporting, tailored to your needs
Reporting isn’t just a piece of paper, it’s a process. Our reporting process can be tailored to suit your needs, providing you with timely, relevant, and detailed information, not just on our findings but also our expert remediation advice.
4. Post-test support & documentation
Our job doesn't finish on the delivery of a test report. We make our security consultants available after the test to provide remediation support and can provide fix checks, as well as additional documentation where necessary.
Like the sound of our red team approach?
You can find out more about our test process and why it sets us apart.
Find out more about our red team service
Want to find out more about our red team engagements? Our team are on hand to provide you with the information you need. Please fill out the form below and one of our team will be in touch shortly.
