A penetration test asks which vulnerabilities exist. A red team operation asks a different question: if a capable adversary decided to reach a specific objective in your organisation, would anyone notice, and how fast would they be stopped?
The operation is planned around objectives you define, such as access to the payment system or to the source code, and around the adversaries who would realistically pursue them. Only a small control group in your organisation knows. The defenders face the operation as they would face a real attack.
01Scope
What we test
Threat intelligence: who would attack you, why and how
Reconnaissance of the organisation, its people and its suppliers
Initial access: phishing, exposed services, supplier and partner channels
Social engineering by email, phone and messaging, within agreed limits
Assumed breach: starting from a compromised workstation or account
Planning, rules of engagement and conduct of technical testing.
NIST
06Questions
Questions about this service
Is this a threat-led penetration test under DORA?
The method follows the TIBER-EU framework that the DORA testing standards build on: threat intelligence, a red team phase and a closure phase with replay. A formal test under DORA is supervised by your authority and sets requirements for the providers, including references and insurance. Whether we qualify for your test is established against those requirements during scoping, before any commitment.
We have never had a penetration test. Should we start with a red team?
No. A red team operation tests detection and response. If basic vulnerabilities have not been found and fixed, a penetration test gives far more for the same effort.
What are the limits of social engineering?
They are set in writing before the operation. No pretext uses threats, personal hardship or health, no private accounts or devices of employees are targeted, and no employee is named in the report as having failed.
What happens if you find traces of a real attacker?
The operation stops and the control group is informed immediately. Everything we observed is handed over to support your incident response.