Vorpsel / Services / Offensive security
Red team operations
A red team exercise answers one question: if a determined attacker went after what matters most to you, would your team notice and stop them in time? We agree on an objective with you, run an authorized exercise against it and show where detection and response worked and where they did not.
At a glance
- For companies with a security team that want to test it as a whole
- Objective chosen by you, such as customer data or a payment system
- Authorization written rules of engagement signed before anything starts
- You receive a timeline of the exercise next to what your team saw
A test of the defense, not only of the systems
A vulnerability assessment lists weaknesses. A red team exercise goes further: it checks whether the alerts fire, whether someone reads them, whether the right people are called and whether the response is fast enough to protect the objective.
The result is not a longer list of findings. It is a clear picture of how your company behaves under a realistic attack, and a short list of changes that make the biggest difference.
Examples of objectives
Customer data
Reach the database or the system where your customers' personal data is kept.
Payments
Get to the system that approves payments or holds card data.
Email of leadership
Gain access to the mailbox of an executive.
Source code
Reach the repositories and the pipeline that ship your product.
Administrator access
Obtain administrator rights over the main company directory.
Cloud account
Take control of the cloud account that runs production.
How an exercise works
Each exercise is planned with a small group on your side who know it is happening, so it stays safe and can be stopped at any moment.
Objective and rules
We agree on the objective, what is in and out of scope, the dates, the contacts and what is never touched. Everything is written and signed.
Exercise
Our team works toward the objective within the agreed rules, keeping a detailed log of every action and its time.
Joint review
We sit with your security team and compare our log with what they saw, step by step, to find where detection could have happened.
Report and retest
You receive the report and the recommendations. After the changes, we can repeat the key steps to confirm they now work.
What the exercise measures
Detection
Which steps produced an alert, which were recorded in the logs without an alert and which left no trace at all.
Response
How long it took from the first alert to someone acting on it, and whether the action would have stopped a real attacker.
Process
Whether escalation, communication and decisions followed your plan, and where the plan was missing or unclear.
What you receive
Side-by-side timeline
Every step of the exercise next to what your tools and people saw at that moment.
Prioritized recommendations
The changes in detection, response and configuration that would have stopped the exercise earliest, in order.
Summary for leadership
One page on whether the objective was reached, how close the defense came and what the investment should focus on.
Ways to work with us
The format depends on how mature your defense is and what you want to learn.
| Option | Best for | What it includes |
|---|---|---|
| Full exercise | Mature teams that want the most realistic test | Objective reached from the outside, over several weeks, with the joint review and report |
| Assumed breach | Testing what happens after someone is already inside | The exercise starts from a regular employee machine or account agreed with you |
| Purple team | Teams that want to learn and improve during the exercise | Our team and yours work side by side, testing detections step by step |
Questions
Is it safe for production?
The rules of engagement list what is never touched and what actions are not allowed. A contact on your side can pause or stop the exercise at any time, and every action is logged so it can be reviewed.
Who on our side knows about it?
Only a small group you choose, usually a sponsor in leadership and one person in security. The rest of the team responds as they would to a real event, which is what makes the result meaningful.
How is this different from a penetration test?
A penetration test looks for as many weaknesses as possible in a defined scope. A red team exercise follows one objective over a longer period and measures how your defense detects and responds.
Are we ready for a red team exercise?
It is most useful when you already have logging, alerting and someone responsible for responding. If those are still being built, a blue team engagement or a vulnerability assessment is usually the better first step.
Can the exercise include phishing our employees?
Only if you want it and it is written in the rules of engagement, with the limits agreed in advance. Many exercises start from an assumed breach instead.
Other services
Tell us what you need.
We reply with a few questions about scope, then send a proposal with dates and price.