Red Teaming

Give our hackers an objective and see if they can reach it. A red team operation simulates a realistic attack across your people, processes and technology. It reveals whether your organisation can detect and stop an attacker before they reach your crown jewels.

Schedule a call
Request a quote

When security meets a real attacker

Every day, security decisions are made, but what they mean in practice only becomes clear when an attacker tries to move through your organisation undetected and reach their objective.

Individual risks can become critical

Individual weaknesses may not appear critical on their own. But when an attacker combines them, they can create an unexpected path towards systems, data or processes that matter most to your organisation.

Not every attack triggers detection

Monitoring and detection cover known patterns and behaviours, but a real attacker may take a different route. That can make malicious activity harder to recognise as an attack unfolds.

Your defences aren’t tested together

Your security depends on people, processes and technology working together when an attack happens. Testing them separately does not show whether they will hold up as one defence under pressure.

Critical processes must keep running

Critical systems and data support the processes your organisation depends on. An attack that reaches them can turn a security issue into a business continuity problem.

Our Red Team approach

Our Red Teaming approach is modular. You select and combine the modules that align with your objectives and information needs. Not every module is mandatory. Together, we determine which components are relevant to your Red Teaming engagement. The modules are divided into four phases and based on the TIBER-NL and ART frameworks.

Scoping

We identify the critical functions and systems to focus on and define the objective our Red Team will try to achieve. We translate this objective into a clear flag that demonstrates the potential impact of a successful attack.

Briefing

We start with a briefing to introduce the team and align on the planning, communication, escalation paths and operational agreements. This gives everyone a clear understanding of what to expect during the Red Teaming operation.

Digital footprint

We map the information available about your organisation and assess how an attacker could use it. This includes domains and IP addresses, as well as information about employees and physical locations.

Threat actors

We identify the threat actors relevant to your organisation and examine how they operate. Their tactics, techniques and procedures (TTPs) help determine which attack techniques we use during the Red Teaming operation.

TTI report

We bring the results of the scoping and Threat Intelligence together in an interim report. It covers your critical functions and systems, digital footprint, relevant threat actors and potential attack scenarios.

Test plan

We turn the attack scenario into a test plan that defines the objective, threat actor and relevant attack techniques. These techniques guide the operation, but our Red Team can adapt its approach when needed to reach the objective.

Reconnaissance

We gather the information needed to carry out the attack. What we look for, and the techniques we use, depend on the selected attack scenario.

In

We prepare the attack and attempt to gain initial access to your organisation. Depending on the scenario, this can involve digital or physical attack techniques.

Through

Once inside, we try to maintain access, escalate privileges and move through the environment without being detected. Our Red Team gathers the technical and process-related information needed to reach the objective.

Out

We attempt to capture the agreed flag and demonstrate the impact of the attack. Once the flag is captured, the attack scenario is complete.

Red Team test report

After the operation, you receive a report detailing all attack scenarios carried out, including what worked, what did not and the decisions our Red Team made along the way. We also highlight the key detection points, giving your Blue Team actionable insights to improve detection and response.

Purple Teaming

In an interactive Purple Teaming workshop, our Red Team works with your Blue Team to improve detection and response. We replay relevant actions from the attack to strengthen detection rules, tooling and processes.

Gold Teaming / crisis simulations

Simulate a realistic cyber crisis and practise how your organisation responds when an attack escalates into a crisis. Find out whether existing processes and procedures provide enough guidance and whether everyone involved knows what is expected of them.

What you get

After the Red Teaming operation, you receive a presentation and a comprehensive report that shows how the attack unfolded, what the Red Team achieved and where your organisation can improve its resilience.

Management summary

A clear overview of the operation, its key outcomes and the most important findings for management.

Scope & Threat Intelligence

The agreed scope, including critical functions and systems, together with a summary of the Threat Intelligence where applicable.

Attack scenarios & timeline

The test plans and a chronological overview of the attack, showing the steps our Red Team took and the decisions made along the way.

Technical attack details

A detailed breakdown of the attacks, techniques and procedures used, including supporting evidence for the findings

Objectives & findings

An overview of the objectives achieved, successful breakthroughs and other relevant findings uncovered during the operation.

Detection points

The key moments where Red Team activity could have been detected, giving your Blue Team concrete input to improve detection and response.

Recommendations & lessons learned

Concrete recommendations to strengthen your resilience, together with lessons learned from the Red Team’s perspective.

Primary point of contact

“The real value of Red Teaming is seeing how small gaps across people, processes and technology can come together to create an attack path no one expected.”

Kevin van Straten

Red Team Lead

Ask a question

FAQ

How is Red Teaming different from a pentest?
A pentest aims to identify as many vulnerabilities as possible within an agreed scope. With Red Teaming, we try to gain access to the organisation undetected and move through it by combining attack techniques targeting people, processes and technology.
Together, we define what your organisation wants to achieve with Red Teaming. Based on these objectives, we determine the scope and approach.
Yes. Our approach is modular, so you can select and combine modules based on your requirements and information needs. The modules are divided into four phases and based on the TIBER-NL and ART frameworks.
That’s up to you! In general, we recommend keeping the Control Team, the team involved in coordinating the Red Teaming engagement, as small as possible.
You receive a detailed report covering the attack scenarios, successful and unsuccessful attack steps, findings and detection points. An optional Purple Teaming workshop can then bring our Red Team and your Blue Team together to improve detection and response based on what happened during the operation. Gold Teaming provides your organisation with a realistic cyber crisis simulation.
Not every healthcare organisation is required to conduct a ZORRO test. ZORRO is Z-CERT’s sector-specific Red Teaming framework, designed to help healthcare organisations test their prevention, detection and response capabilities against realistic attacks. Whether the framework is required or appropriate for your organisation depends on applicable regulations, sector agreements and the maturity level of your security.
Only financial entities designated for Threat-Led Penetration Testing (TLPT) under DORA are required to conduct a formal TLPT. The supervisory authority informs organisations that have been selected. The test is conducted in accordance with the TIBER-EU framework. For other organisations, a TIBER, ART or Red Team test is a voluntary choice based on their risk profile and the desired level of depth.

Combine with

Scenario Based Pentesting

Test a specific attack scenario or predefined attack path without conducting a full Red Team operation. Ideal when you primarily need to determine whether a specific critical scenario could succeed.
Learn more

Purple Teaming

Bring our red teamers and your security team together in a hands-on workshop to turn Red Teaming insights into stronger detection and response capabilities.

Gold Teaming / Crisissimulation

Put your team through a simulated cyber crisis to practise how they make critical decisions, coordinate their response and manage the situation under pressure.

Assumed Breach

Give our hackers a foothold inside your environment and see whether they can escalate privileges, move laterally and reach critical systems.
“The S-Unit combines in-depth expertise with a pragmatic approach. They think along critically, communicate clearly and translate their findings into concrete improvements we can act on straight away. It’s a pleasant way of working that helps us strengthen our information security further. And just as important: thanks to them, I sleep a lot better”
Firas Daoud
TAF – CTO
“The S-Unit understood from the start what we wanted to achieve, even though the path to get there wasn’t entirely clear yet. They took us along in their approach, thought ahead and switched gears quickly when needed. We could trust that it would work out, without having to keep steering. It’s a really pleasant way of working together.”
Martijn Korevaar
Gemeente Rotterdam – IT Risk & Compliance Manager
“We didn’t want to be told that we’re vulnerable. We wanted to see how far a real attacker would get. Instead of a standard report, we got insight into exactly the risks that matter most to us.”
Anonymous
Manager Tech Security
“We received professional help with a pentest of a broad application landscape. Despite the many different functionalities in our landscape, the test was fast and thorough.”
Daan van der Ham
Lead techniek - PO-VO Raad

Ready for a realistic attack
on your organisation?

We help you define the right Red Teaming approach.
Schedule a call