Red Team Exercises

Red Team vs Penetration Test: What's the Difference?

A penetration test is a scoped technical assessment of a defined target — a web application, an external perimeter, a corporate network — that produces a list of findings, ranked by severity, with reproduction steps. It answers the question: are these systems vulnerable?

A red team exercise is an objective-driven adversarial engagement against your organisation as a whole. There is no narrow technical scope — only an objective and a set of rules of engagement. We choose how to achieve the objective: phishing, social engineering, physical entry, network exploitation, supply chain compromise, or any combination. The engagement answers a different question: can your blue team see and stop a determined attacker?

Most organisations need both. A red team without prior pen testing usually finds the same easy wins an attacker would — and burns budget on already-known weaknesses. We routinely sequence the work: harden the perimeter via targeted pen tests, then prove the broader security posture under realistic adversarial pressure.

Methodology: MITRE ATT&CK End-to-End

Every CDSEC red team engagement is mapped to the MITRE ATT&CK Enterprise framework. Each action our operators take is tagged with its corresponding Technique ID, which lets your detection team replay the engagement against their SIEM, EDR and SOC playbooks in concrete terms. The final deliverable includes an ATT&CK heatmap showing which techniques succeeded, which were detected, which were blocked, and which fired alerts that nobody actioned.

Engagement Phases

1. Threat intelligence & scenario design. We profile the threat actors most likely to target your sector and select the TTPs to emulate. For regulated engagements we align with TIBER-EU, CBEST or iCAST scenario requirements.
2. Rules of engagement & legal framework. Signed authorisation, white-cell contacts, prohibited targets, escalation procedures, and out-of-hours coverage. We never operate without explicit written authority.
3. Execution. Typically four to twelve weeks of operator time, paced to mimic a real adversary rather than a sprint. Periodic touch-points with the white cell keep the engagement on track without leaking to the blue team.
4. Replay & purple team. Once the engagement concludes we walk your defenders through every action chronologically, with logs, screenshots and ATT&CK tags, so they can validate detections and rebuild missed ones.
5. Reporting. Executive narrative for the board, technical timeline for SOC and IR teams, ATT&CK heatmap, prioritised remediation plan, and a re-test offer at no additional cost within 90 days.

Who Commissions Red Team Exercises

Most red team engagements we run fall into three categories. Regulated financial services firms run them to satisfy CBEST, TIBER-EU or DORA threat-led testing obligations. Critical national infrastructure operators run them to validate the detection and response capabilities they've invested in over the previous three to five years. And mature security organisations — typically those who've already extracted the value from regular pen testing — run them annually as a board-level KPI for the CISO function.

If you've never had a pen test or your last external perimeter assessment was more than a year ago, a red team is almost always premature. Talk to us about structured penetration testing or threat-led penetration testing first.

Related Services

• Purple Team Exercises — collaborative attack and defence rather than full adversarial blackout.
• Threat-Led Penetration Testing — TIBER-EU and CBEST-aligned regulated engagements.
• MDR / SOC / XDR Validation — focused detection-and-response testing against named tooling.
• Social Engineering Assessment — phishing and human-layer testing as a standalone engagement.