All services Red Team

We attack you before someone else does.

We pursue a real objective with attacker tradecraft across email, phone, cloud and your network, then replay in full what your team saw and missed.

Plan a red team engagement
op-payroll · day 3LIVE
  1. [*] OP-PAYROLL · scope signed · rules of engagement loaded
  2. [*] recon: 214 staff profiles, 3 office entrances, 41 external hosts
  3. [+] phish delivered → [email protected] (invoice_Q3.html)
  4. [+] credentials captured: j.tremblay · MFA not enforced on VPN
  5. [+] VPN session opened as j.tremblay · 09:41
  6. [+] implant online: 10.20.4.17 (FIN-LT-042)
  7. [!] blue team alert: unknown device · 14 min
  8. [+] local admin reuse → 37 workstations
  9. [+] domain admin: CORP\svc_backup
  10. [+] objective reached: \\fs01\payroll (read access)
  11. [*] detected in time: 1 of 6 steps

Penetration test or red team?

Find the holesPenetration test

Finds as many weaknesses as possible in a defined scope. Your team usually knows it’s happening.

Details
Test the defenceRed team

Goes after one real objective using any realistic path, quietly. It tests your people, processes and detection as well as your systems.

Mapped to how real attackers work

Every engagement is mapped to MITRE ATT&CK, the industry catalogue of attacker techniques. Highlighted: what we used in this example operation.

ReconnaissanceT1593Search open websitesT1589Gather staff identitiesT1595Active scanning
Initial accessT1566PhishingT1200Hardware additionsT1133External remote services
Credential accessT1056Input captureT1003Credential dumpingT1110Brute force
Lateral movementT1021Remote servicesT1550Alternate auth materialT1570Lateral tool transfer
CollectionT1039Data from network shareT1005Data from local systemT1114Email collection
ImpactT1486Ransomware (simulated)T1490Inhibit recoveryT1485Data destruction

Used in this operation

We test your whole defence, from prevention to people

  • PreventionEmail filtering, EDR, MFA, network controls. Do they block what they should?EDR missed a renamed admin tool
  • DetectionYour SOC, MDR or SIEM. Does anyone get an alert, and is it the right one?Alert fired, closed as a false positive
  • ResponseTriage, escalation, containment. How fast does an alert become action?3 hours from alert to first call
  • PeopleHelp desk, reception, staff, managers. Do they verify, question, report?Password reset given over the phone

Social engineering is part of the attack

Most real intrusions involve a person being convinced to help. We test that too, carefully and with leadership’s approval.

  • Phone Pretext calls“Hi, it’s IT, I need to reset your MFA.” Help desk, finance and reception.
  • Email · SMS Targeted phishingMessages written for specific people, roles and suppliers.
  • On site In-person impersonationDelivery person, technician, new employee. Does anyone ask?
  • Physical BaitingBranded USB keys and QR codes left where staff will find them.

Attacker vs defender, minute by minute

We timestamp every move on both sides. You see exactly where your defence held, hesitated or never noticed.

Red teamYour defenders
  1. Day 1 · 09:12Phishing email delivered—
  2. Day 1 · 09:41VPN login with stolen credentials—
  3. Day 1 · 10:03Implant plugged in, meeting room BSOC alert: unknown device
  4. Day 1 · 13:10Alert escalated to IT
  5. Day 2 · 08:20Domain admin obtained—
  6. Day 3 · 11:05Payroll share copiedAlert 26 h later
  • 14 minTime to first alert
  • 3 hAlert to escalation
  • NeverAttacker contained

Choose how far we go

  1. 1Assumed breachWe start inside, as if a laptop was already compromised. Tests detection and response fast.
  2. 2External attackFrom the internet and your inboxes, like most real intrusions.
  3. 3Full scopeAdds cloud attacks and phone pretexts.
  4. 4Long-term covertWeeks of quiet operation to test your SOC under real conditions.
Then we switch sidesIn the purple-team replay, we sit with your SOC and IT, re-run each technique and help tune the detections that missed.

Real attacker, safe engagement

  • Written authorizationScope, objectives and rules signed by leadership before anything starts.
  • No damageNo real encryption, deletion or data leaving your control.
  • Emergency stopA named contact can pause everything at any time.
  • DiscreetOnly the people who need to know are told.

How it works

  1. PlanObjectives, scope and rules of engagement with leadership.
  2. ReconWhat an attacker can learn about your people and systems.
  3. AttackWe go after the objective, quietly, over days or weeks.
  4. ReplayWe walk your team through every step and what to tune.
Not ready for a full red team?Start with a penetration test to find and fix the obvious holes first.Penetration testing

Examples on this page are illustrative.

Plan a red team engagement

Tell us what's going on. The expert who would lead the work replies within 1–2 business days, in English or French.

Book a Free Consultation