Red Team Engagements

Test whether an attacker can reach your most sensitive systems and data

Objective-led adversary simulation across your technology, people and premises. We pursue an agreed objective using the attack paths in scope, then examine what your defenders detected, how they responded and where your defences need to improve.

Each engagement is scoped to your organisation, with a fixed price agreed before work begins.

Get a Quote Book a Scoping Call

Accreditations and memberships

CREST member company, accredited for penetration testing CREST-accredited penetration testing Cyber Essentials certified UK Cyber Security Council member

Red Team Engagements

What a red team engagement is

A penetration test assesses the security of defined systems, applications or environments. A red team engagement starts with an agreed objective, such as reaching a sensitive system or dataset, and attempts to achieve it through the attack paths included in the scope.

Those paths might involve external systems, phishing, physical access or an initial foothold provided at the start of the exercise. The emphasis is on how these routes can combine, whether the objective can be reached, and how effectively your security team detects and responds to the activity.

The result is a practical assessment of your organisation's ability to prevent, detect and respond to a realistic attack, together with evidence of the attack path and recommendations for improvement.

Routes an operation can take

  • External attack
  • Phishing
  • Physical access
  • Assumed-breach foothold
  • Detection & response

When to choose a red team engagement

When you already test individual systems and want to understand whether an attacker can combine weaknesses across your environment to reach a high-value objective, and whether your defenders would detect and contain the attack.

Who Needs This

Who needs a red team engagement?

Red team engagements suit organisations that already test their systems and want to know how a determined attacker would approach them.
Get a Red Team Quote

Organisations with established security practices

If you already run regular internal and external penetration testing, a red team engagement can be the next step in understanding how weaknesses across your environment could combine to expose sensitive systems or data.

Teams with monitoring and response in place

If you have people watching for attacks and a process for responding, a red team engagement shows how well that works against a realistic adversary.

Organisations following a major change or security incident

Significant infrastructure changes, security improvements or remediation following an incident can be good reasons to validate whether your defences are working as intended.

Not ready for a full red team yet?

If you haven't tested your networks recently, start there. Internal penetration testing run as an assumed breach scenario is a more contained step, and our article explains how it differs from a red team exercise.

What's Included

What a red team engagement includes

The scope is built around your objective, and we confirm it during scoping. These are the elements of a typical engagement.

  • An objective-led operation

    We agree an objective with you, such as reaching a particular system or dataset, and pursue it across the routes in scope.

  • Multiple routes in

    External attack, phishing and, where you agree it, physical intrusion within the scenario. Physical intrusion is described in more detail on our social engineering assessment page.

  • An optional assumed-breach start

    Where appropriate, we can begin from an agreed foothold rather than attempt initial access. This allows us to focus on the attack paths available from that position and how far an attacker could progress towards the objective. The duration depends on the agreed scope and complexity.

  • Evidence-led reporting

    The report documents the attack path, whether the objective was achieved, supporting evidence and the security weaknesses or control gaps encountered. It also records what could be established about detection and response during the exercise, with prioritised recommendations to help your team decide what to address first.

  • A debrief with your defenders

    A walkthrough of what we did, step by step, and what was and wasn't detected, so your team can improve.

Our Methodology

How we run a red team engagement

Every engagement is built around the objective and the rules of engagement we agree with you before any activity begins.
01

Scoping & Rules of Engagement

We agree the objective, permitted techniques, in-scope assets, exclusions, operating constraints and escalation arrangements in writing. Named contacts and an emergency stop procedure are established before testing begins.
02

Reconnaissance

We gather information on your organisation from the position of an outsider, including your external footprint and publicly available information, to choose the most promising routes.
03

Initial Access

We attempt to gain a foothold by the agreed routes, such as external attack, phishing or physical access. Where you prefer, we start from an agreed foothold instead.
04

Post-compromise Activity

From the initial foothold, we investigate the available attack paths and attempt the actions needed to progress towards the objective. This may include privilege escalation, movement between systems and access to sensitive resources, where authorised and relevant to the scenario.
05

Objective & Evidence

We establish whether the objective was reached, and by which route, and record the evidence along with what your defenders detected.
06

Reporting & Debrief

A report with the attack path, findings, remediation guidance and detection and response observations, followed by a debrief with your defenders.

Before We Start

What must be in place before a red team begins

A red team engagement is realistic by design, so it needs careful preparation on your side first.

  • Authorisation and rules of engagement

    Written authorisation to test, with agreed scope boundaries, exclusions, and permitted techniques.

  • A small group who know about the exercise

    A few trusted contacts who are aware of it, so that activity can be coordinated and stopped if needed.

  • An emergency stop contact

    Someone reachable throughout who can halt activity if something goes wrong.

  • Agreed objectives

    The systems, data or outcomes the operation is trying to reach.

Pricing

Red team engagements are scoped individually

The cost depends on the objective, the attack paths included, the complexity of your environment and the time needed to conduct the exercise and document the results.

A typical commercial engagement runs three to six weeks. A more focused engagement, including some assumed-breach scenarios, may take one to two weeks, depending on the agreed objective and scope.

We confirm the scope and agree a fixed price before work begins. Tell us your objective, the routes you want included and your preferred timing. We'll reply within one business day to clarify the requirements and prepare a fixed-price proposal.

See the pricing guide for the services we publish prices for.

Common Questions

Red team engagements: frequently asked questions

We scope red team engagements individually and agree a fixed price before work starts. The objective, the routes in scope and the length of the engagement drive the effort.

Our penetration testing pricing guide compares costs across the services we publish prices for.

A penetration test assesses the security of defined systems, applications or environments. A red team engagement starts with an agreed objective and attempts to reach it through the attack paths included in the scope. These may involve technical weaknesses, social engineering or physical access, and the exercise also examines how effectively your defenders detect and respond. See our article on what a red team engagement involves.

A typical commercial engagement runs three to six weeks. A more focused engagement may take one to two weeks. The actual duration depends on the objective, the complexity of your environment, the agreed attack paths and the time needed for reporting and debriefing. We confirm the expected duration during scoping.

A small, agreed group will know about the exercise and be available to coordinate or stop activity if needed. You can decide how widely the exercise is disclosed, subject to the agreed rules of engagement. Keeping the wider security team unaware can provide a more realistic test of detection and response, where appropriate.

Where you agree them, yes. External attack, phishing and physical intrusion can all be routes within the scenario. Physical intrusion is described in more detail on our social engineering assessment page.

Red team engagements are most useful once you have tested your internal and external networks and want to see how a determined attacker would approach you. If you haven't, external and internal testing, including an assumed breach scenario, are usually the better start.

Our CREST accreditation covers our penetration testing services; we do not claim that accreditation for our red team engagements. We also do not deliver CREST STAR or CBEST engagements. If you require a particular accreditation or recognised testing scheme, please raise it during scoping.

You can request a quote using the form on our quote page. Describe your objective, the routes you want in scope and your preferred timing.

We reply within one business day to confirm your scope, then send a fixed-price written proposal.

Ready to scope a red team engagement?

Tell us what you most want protected, and we'll agree an objective, the routes in scope and a fixed price.
Book a Scoping Call