Red Team · Adversary simulation
A Hard2bit Red Team exercise simulates a real adversary against your organisation —with agreed objectives, stealth and techniques documented in MITRE ATT&CK— to measure what a pentest does not: whether your SOC detects the intrusion, how long it takes to respond and how far an attacker would get before anyone stops them.
No obligation · Confidential from the first conversation.
Definition
A Red Team exercise is a targeted, covert attack simulation in which an offensive team emulates the tactics, techniques and procedures of a real adversary to try to reach agreed business objectives, without the defence team being warned.
Unlike a technical audit, it does not aim to list every vulnerability: it only needs the ones required to move forward. What it assesses is the whole —people, processes and technology— against an attacker with time, method and motivation. That is why it is also known as adversary simulation or adversary emulation.
The techniques we use are catalogued against MITRE ATT&CK, which makes it possible to compare the outcome with your SOC's detection coverage and repeat the measurement over time.
Whether anyone sees it
Which attacker actions raise an alert in your SIEM, EDR or NDR, and which go by without leaving a useful trace.
How long the reaction takes
The real time between the first signal and containment: triage, escalation, decision and playbook execution.
How far an attacker gets
Which business objectives are reached —data, payment systems, Active Directory— before someone stops the intrusion.
Fit
A Red Team pays off when there is a defence to put to the test. If that is not your case, we would rather say so and propose the step that genuinely moves you forward.
There is no monitoring to measure
Without a SOC, EDR or centralised logging the outcome is already known: nobody will detect anything. Starting with a managed SOC pays off more.
A pentest has never been done
If basic vulnerabilities are still open, a pentest finds them sooner and with less effort.
There is no asset inventory or regular patching
The Red Team will walk in through the obvious and the exercise will add little. First, vulnerability management.
The defence team cannot absorb the outcome
If the Blue Team is very new, a collaborative Purple Team teaches more than a covert exercise.
Engagement types
The engagement type depends on what you want to measure and how mature your defence is. In the scoping session we recommend one, and explain why.
A covert exercise from start to finish: from external reconnaissance to action on the agreed objectives, combining the digital vector with social engineering.
We start from an already compromised workstation or set of credentials. Effort goes where detection is hardest: privilege escalation, lateral movement and access to critical assets.
Attack and defence work together, technique by technique: we execute each TTP, check whether it is detected and tune rules and playbooks on the spot.
Threat-led penetration testing of critical functions on live production systems, with the roles, phases and documentation required by DORA and the TIBER-EU framework.
Methodology
Six phases, from defining objectives to reconstructing the attack with your team. Each maps to MITRE ATT&CK tactics, so the outcome is comparable and repeatable.
Together we define the business objectives the exercise should try to reach, what is out of bounds, who sits in the control cell and how any contingency is handled. Everything is signed off before we start.
We identify which actors have a demonstrated interest in your sector and which techniques they use. That produces credible scenarios, not a generic catalogue of attacks.
OSINT on exposed assets, people and suppliers; leaked credentials; set-up of command-and-control infrastructure and social engineering pretexts.
We look for a way in just as the emulated adversary would: spear phishing, vishing, exposed services or valid credentials. Always within the agreed rules.
Privilege escalation, lateral movement and persistence using our own tooling and implants, adapted to evade the controls in your environment. This is where the Blue Team is really put to the test.
We demonstrate impact in a controlled way —without damaging or extracting real information—, remove every artefact and reconstruct the attack with your defence team.
A Red Team operates in production, and that demands strict safeguards. These are the ones we apply in every exercise and write into the rules of engagement.
Outcomes
The value of the exercise lies in turning a simulated attack into indicators your SOC, your CISO and your management can track over time.
| Metric | Question it answers | What it is used for |
|---|---|---|
| Time to first detection (MTTD) | How long does it take someone to see the intrusion? | Baseline for tuning SIEM/EDR use cases and thresholds. |
| Time to containment (MTTR) | How long between the alert and evicting the attacker? | Measures triage, escalation and playbooks, not just technology. |
| Detection coverage by ATT&CK tactic | Which attack stages are visible and which are blind spots? | Heat map that prioritises where to invest in telemetry. |
| Objectives achieved | How far does an adversary with this capability get? | Translates technical risk into business impact for management. |
| Quality of escalation and communication | Does information reach decision-makers on time and complete? | Improves the response plan and coordination with third parties. |
Deliverables
What was attempted, what was achieved and what it means for the business, in board-level language.
Every step with date and time, the associated ATT&CK technique and evidence, ready to compare against SOC logs.
For each technique executed: detected, logged without an alert, or invisible. The document the Blue Team uses most.
Weaknesses exploited, with root cause and a realistic remediation recommendation.
We reconstruct the exercise alongside your defence team: what they saw, what they missed and why.
Use cases, rules, telemetry sources and playbook adjustments, ordered by impact.
After the exercise it is common to follow up with a Purple Team and Threat Hunting on the techniques used, to confirm the new detections work and no persistence remains.
Financial sector
The DORA Regulation (Articles 26 and 27) requires the financial entities designated by their competent authority to carry out, at least every three years, threat-led penetration testing (TLPT) on their critical or important functions, on live production systems.
Commission Delegated Regulation (EU) 2025/1190 sets out the methodology, aligned with the ECB's TIBER-EU framework, implemented in Spain as TIBER-ES. Hard2bit takes part in these exercises as an external Red Team provider.
Planning
Preparation —scope, threat intelligence and rules of engagement— and closure with report and replay come on top of these timeframes.
Comparison
| Pentesting | Red Team | Purple Team | BAS | |
|---|---|---|---|---|
| Question it answers | Which vulnerabilities do I have? | Do we detect and stop a real attack? | How do we improve detection, technique by technique? | Are my controls still working? |
| Scope | Specific assets | The organisation, objective-driven | Selected TTPs | Automated scenarios |
| Stealth | Not required | Essential | No: it is collaborative | No |
| Does the Blue Team know? | Yes | No, only the control cell | Yes, it takes part | Yes |
| Typical duration | 1–3 weeks | 4–12 weeks | 1–3 weeks | Continuous |
Selection criteria, relative costs and use cases, in the full comparison: pentesting vs Red Team vs BAS.
Concepts from our cybersecurity glossary that connect directly with this service.
In a 45-minute scoping session we define objectives, engagement type and rules of engagement, and deliver a fixed proposal.
Written by Adrián González · Reviewed by Thilina Manana, service owner
Last reviewed:
Before you leave…
Quick 15-minute assessment and we'll tell you what to prioritise first: Microsoft 365, pentesting, vulnerability management, SOC, DORA, NIS2, ENS or ISO 27001.
No spam. Reply within 24h.
