Overview
A red team answers a board-level question: if a capable group targeted us, would we notice and respond in time? For UK firms working on FCA and PRA operational resilience, the exercise can also feed scenario testing for important business services. We agree objectives, limits and a control group in writing, then report what was achieved, what was seen and when.
A red team assessment is an exercise in realism. Rather than enumerating weaknesses, a small team agrees an objective with your leadership, reaching a critical system, accessing a sensitive dataset, demonstrating fraud, and then pursues it the way a determined adversary would, choosing whichever combination of phishing, external exposure, physical access or network movement gets there with the least noise. The breadth of a standard pentest is traded for the depth and stealth of a real intrusion.
What the exercise measures is your defence as a whole. A vulnerability only matters here if it advances the objective, so the findings are not a list of issues but a story: how initial access was gained, how it was expanded, and crucially, where your monitoring saw it, where it did not, and how your responders reacted to what they did see. That makes the assessment as much a test of your detection and response capability as of your controls.
We run these engagements under strict rules of engagement agreed in writing, with named safety contacts and clear boundaries, because the activity is deliberately realistic. Throughout, we work defensively and record our actions so the exercise can be replayed. The debrief maps every step to MITRE ATT&CK and compares it against what your defenders logged, turning the result into concrete improvements for both your controls and your response.
How we work with UK clients
- Testing windows set in UK time at scoping. India runs 4.5 hours ahead during British Summer Time and 5.5 hours ahead in winter, so our days overlap.
- Fixed proposals in GBP, excluding VAT; the reverse charge usually applies to UK business buyers.
- No traffic leaves our hands until written authorisation is signed by someone entitled to give it, as the Computer Misuse Act 1990 requires.
- Findings labelled for the evidence you file: ISO 27001 Annex A, UK GDPR Article 32, PCI DSS or a supplier questionnaire.
What's included
Our approach
- Scoping & rulesWe agree objectives, boundaries and safety contacts in writing before starting.
- ReconnaissanceWe gather intelligence to plan the quietest realistic path to the objective.
- ExecutionWe pursue the objective across vectors, recording every action as we go.
- Detection analysisWe compare our activity against what your defenders logged and acted on.
- Debrief & replayWe walk your blue team through the full timeline mapped to MITRE ATT&CK.
What you receive
- Narrative of the full attack from access to objective
- Detection and response gap analysis
- Timeline mapped to MITRE ATT&CK
- Prioritised improvements for controls and response
- Replay walkthrough with your defensive team
Standards & frameworks
- MITRE ATT&CK
- TIBER-style intelligence-led testing
- PTES
- NIST SP 800-115
- CVSS v4.0
- FCA/PRA operational resilience (SYSC 15A)
Frequently asked questions
How is a red team different from a penetration test?
A pentest aims for broad coverage of a defined scope and lists every flaw it finds. A red team pursues a specific objective across any available path, stealthily, to measure detection and response. One tells you what is weak; the other tells you whether you would catch a real attacker.
Should our defenders know it is happening?
Usually only a small, named group knows, so the response you observe is genuine. We always agree safety contacts who can confirm the exercise if real alarm is raised, which keeps the test realistic without risking a real incident response being triggered unnecessarily.
Is a red team right for us yet?
It gives most value once you already have monitoring and a response capability to measure. If those are still maturing, a series of penetration tests usually delivers more, and we will say so plainly during scoping rather than sell an exercise you are not ready for.
Is your red teaming a CBEST engagement?
No. CBEST is the Bank of England's intelligence-led testing framework and has its own provider requirements. We don't claim to meet them. If a regulator has asked for CBEST, tell us at scoping and we'll say plainly whether we can help with any related work.
Can these exercises support FCA and PRA operational resilience work?
They can feed it. Firms under SYSC 15A identify important business services, set impact tolerances and run scenario testing. A red or purple team exercise aimed at one of those services gives realistic evidence about detection and recovery.