Blind spots in monitoring
Missing log sources, servers that aren’t connected, or unmonitored cloud services – attackers move where no one is looking.
Security Services
Red Teaming & APT Simulation
A real-world attack – rehearsed under controlled conditions.
In red teaming, we attack your organization the way a professional threat actor would: targeted, covert, and through every channel – technology, people, and buildings. This shows you whether your protective measures, your monitoring, and your incident response team can withstand a real attack.
- Fixed price after scoping
- Free retest
- Quote within 24 hours
Definition
What is red teaming?
Red teaming – also known as a red team assessment – is a goal-oriented attack simulation. Instead of looking for as many vulnerabilities as possible in a clearly defined system, the red team pursues a specific objective – such as access to financial accounting, design data, or the production network. The path there is open: a phishing email, a vulnerable server on the perimeter, or an unnoticed walk through the front door.
To do this, we use the tactics, techniques, and procedures (TTPs) of real threat actors as documented in the MITRE ATT&CK framework. Because a red teaming engagement is conducted covertly, it tests not only your technology but your entire defense: Does your EDR detect the activity? Does the SIEM raise an alert? And do your team or your service provider respond in time and correctly?
A special form is the APT simulation. Advanced persistent threats are well-resourced attackers who move through networks undetected for long periods in order to exfiltrate data or prepare sabotage. In an APT test, we replicate exactly this approach: quiet, persistent, and focused on long-term access.
Red teaming is worthwhile above all for organizations that have already invested in security – with regular penetration tests, EDR, SIEM, or a SOC. For financial entities, the topic carries additional regulatory weight: DORA (the EU Digital Operational Resilience Act) requires entities selected by the supervisory authorities to carry out threat-led penetration testing (TLPT), whose methodology is based on the European TIBER-EU framework. The EU NIS2 Directive also requires organizations to assess the effectiveness of their security measures.
Our approach
How we simulate a real attack
Every red teaming engagement starts with clear rules of engagement. Together with a small, informed group in your organization – the white team – we define objectives, permitted attack paths, off-limits areas, and abort criteria. Your blue team – that is, IT operations, the SOC, or your managed security service provider – is usually not informed.
We derive the attack scenarios from a threat analysis: Which threat actors are relevant for your industry? What information about your company is publicly available? And which techniques do these groups typically use? The result is a realistic attack plan based on MITRE ATT&CK.
During the operation, we control compromised systems via controlled command-and-control (C2) channels, and every action is logged with a timestamp. Destructive actions are ruled out, and we simulate data exfiltration with test data. This makes it possible to trace exactly which steps your defenses detected – and which they didn’t.
Common vulnerabilities
Where attackers get through in a real attack
Alerts without response
The EDR fires, but the alert is closed as a false positive or sits untouched over the weekend. Technology alone doesn’t stop an attack.
Bypassable MFA and phishing
Adversary-in-the-middle phishing steals session tokens despite MFA, push requests are approved out of habit, and the help desk resets passwords on a caller’s say-so.
Attack paths in Active Directory
Nested groups, risky permissions, and cached admin credentials often lead from a standard account to domain admin in just a few steps.
Flat networks
Missing segmentation opens a direct path from an office client into server, backup, or production networks.
Physical access weaknesses
Tailgating, cloneable access cards, or live network ports in meeting rooms bring attackers straight into the internal network.
Exposed systems and leaked credentials
Unpatched VPN gateways, forgotten subdomains, and passwords from third-party data breaches are common entry points.
Unclear procedures in an emergency
Who is allowed to isolate a system, and who informs senior management? Missing playbooks and escalation paths cost valuable time during an incident – learn more under Incident Response Planning.
Options
The right format for your maturity level
Maximum realism
Full-scope red teaming
We start with no prior knowledge and no access – like an external attacker. We test the entire chain from reconnaissance to achieving the objective.
- Initial access via phishing, the perimeter, or physical entry
- Covert – only the white team is informed
- Tests prevention, detection, and response
Efficient
Assumed breach
We start with a compromised client or user account, as after a successful phishing attack. The time goes into lateral movement, detection, and response.
- No effort spent on initial access
- Start on site or remotely via VPN or a provided test system
- Focus on internal attack paths
- Ideal entry point into red teaming
Collaborative
Purple teaming
As a variant of or addition to red teaming, the red and blue teams work together openly. We execute attack techniques step by step while your team checks detection and alerting in parallel.
- Test and fine-tune detection rules directly
- Knowledge transfer for the SOC and IT operations
- Ideal as a follow-up to red teaming
Process
How a red teaming engagement works
Like all our security services, a red teaming engagement follows a clear structure – from defining objectives to the follow-up with your blue team.
-
01
Objectives & rules of engagement
With the white team, we define objectives, scenarios, off-limits areas, and abort criteria and document everything in a written authorization. After scoping, you receive a fixed-price quote within 24 hours (on business days).
-
02
Reconnaissance & threat analysis
Within the agreed framework, we gather publicly available information about your company and your technology and select the techniques of relevant threat actors.
-
03
Initial access
Depending on the scenario, we gain access via phishing, through vulnerabilities on the perimeter, or by physical entry.
-
04
Lateral movement & objectives
We escalate privileges, move laterally through the network, maintain access via controlled C2 channels, and work our way toward the agreed objectives. Every action is logged with a timestamp.
-
05
Report & debrief
We present the attack narrative in a debrief meeting. If you wish, we then replay critical steps together with your blue team (purple teaming) to close detection gaps in a targeted way.
-
06
Remediation & retest
You receive a prioritized remediation plan. We check fixed vulnerabilities in a free retest, and you then receive a test certificate.
Reporting
From attack narrative to remediation plan
Our report traces the attack step by step – from first contact to achieving the objective. For each phase, we show which protective measures worked, where your defenses had a chance to detect the attack, and which improvements will have the greatest effect.
- Executive summary for senior management and supervisory boards
- Chronological attack narrative with timestamps
- Mapping of all techniques to MITRE ATT&CK
- Overview: detected, reported, stopped, or unnoticed
- Technical findings with CVSS ratings and evidence
- Prioritized measures for prevention, detection, and response
- Test certificate to present to customers, partners, insurers, and auditors
How good are your defenses really?
Let’s define objectives and scenarios together. After scoping, you receive a fixed-price quote for your red teaming engagement within 24 hours (on business days).
FAQ
Frequently asked questions about red teaming
Didn’t find your question? Call us at +49 2932 465265-0 or email info@rootsektor.de.
What is the difference between red teaming and a penetration test?
A penetration test looks for as many vulnerabilities as possible within a clearly defined scope – announced in advance and with the goal of securing the tested systems. Red teaming pursues a specific objective, uses every permitted path to get there, and is conducted covertly. As a result, it tests not only the technology but also detection, response, and processes. In short: a pentest asks “Where are we vulnerable?” – red teaming asks “Would we notice and stop an attack?”
Which organizations is red teaming suitable for?
Red teaming delivers its full value when the fundamentals are in place: regular penetration tests, working patch management, and detection mechanisms such as EDR, SIEM, or a SOC. Organizations that are still at the beginning usually benefit more from a penetration test or an Active Directory assessment. In the initial consultation, we give you an honest recommendation for the right starting point.
Who in our organization knows about the red teaming engagement?
Only a small white team – typically members of senior management, those responsible for information security, and a trusted person from IT operations. The white team knows the objectives and time frame, can intervene at any time, and decides whether an incident discovered by the blue team is part of the exercise. This keeps the exercise realistic and controllable at the same time.
How do you protect our day-to-day operations?
The rules of engagement specify which systems are off-limits and when we stop. We don’t carry out destructive actions, we simulate data exfiltration with test data, and we coordinate risky steps with the white team in advance. Because all actions are logged, every activity can be clearly attributed to the exercise.
How long does a red teaming engagement take?
That depends on objectives, scope, and format. A full-scope red teaming engagement, including preparation, reconnaissance, and follow-up, usually extends over several weeks, because covert operations take time. An assumed breach scenario or a purple teaming workshop can be carried out much more compactly.
What does red teaming have to do with DORA and TIBER-EU?
DORA requires financial entities selected by the supervisory authorities to carry out threat-led penetration testing (TLPT) at least every three years. Methodologically, these tests are based on the TIBER-EU framework, which is implemented in Germany as TIBER-DE. A red teaming engagement using a comparable methodology tests detection and response capabilities realistically and prepares you specifically for such tests. We’re happy to discuss how it fits into your DORA testing plan in the initial consultation.
Are social engineering and physical tests allowed?
With proper authorization and clear boundaries, they are an established part of red teaming engagements. The basis is a written mandate from senior management; for physical tests, our team also carries an authorization letter as standard. In coordination with you, we involve your data protection officer and, if applicable, the works council at an early stage. We don’t expose individual employees in the report – by default, our analysis is anonymized and highlights weaknesses in processes and procedures.
What is purple teaming?
In purple teaming, attackers (red team) and defenders (blue team) work together openly. We execute selected attack techniques one after another, your team checks in real time whether and how they are detected, and adjusts detection rules immediately. We offer purple teaming as a variant of or addition to red teaming – for example, as the conclusion of a red teaming engagement to close detection gaps together with your SOC.
Related pages
Plan your red teaming engagement
Tell us which assets you want to protect and which defensive measures are already in place. We’ll discuss possible scenarios confidentially and send you a fixed-price quote within 24 hours of scoping (on business days).