What this is
A penetration test answers "what vulnerabilities exist in these systems?" A red team exercise answers a different question: "can a determined adversary reach our crown jewels, and would we notice?" Our operators pursue agreed objectives over weeks, chaining access the way a real attacker would and working around your monitoring, while a small control group (the white cell) oversees the exercise. The full distinction, including a maturity model for deciding between the two, is in our guide to red team vs penetration testing.
Our red team work is led by an OSCP-credentialled practitioner whose engagement history includes red-team operations inside a Tier-1 Nordic bank, alongside penetration testing for a pan-African banking group, a top-5 South African bank, and a securities-trading firm. That is the operating context your exercise is modelled on: a regulated bank with a real SOC, not a lab.
Methodology
Scenario design
We agree objectives, the threat model, rules of engagement, and the white cell. Scenarios run external-first or assumed-breach, where we start from an agreed foothold so the exercise measures detection and response rather than perimeter luck.
Execution
Manual, covert operation toward the objectives: initial access, privilege escalation, lateral movement, and staged exfiltration tests, with every action logged and critical exposures escalated to the white cell immediately.
Reporting
A full attack narrative mapped to MITRE ATT&CK techniques, a detection timeline of what your team saw versus what they missed, and prioritised fixes for both vulnerabilities and monitoring gaps.
Debrief
A joint walkthrough with your defenders, technique by technique. Where it adds value, we replay key techniques as a purple-team session so your SOC builds detections on the spot.
Who this is for
Red teaming is for mature security teams: institutions that already test regularly, have remediated the major findings, and now need to know whether their detection and response hold up against a live adversary.
- Banks and payment providers: exercises modelled on the threats that matter, payment-system access, core-banking compromise, large-scale data theft
- Telecoms and mobile-money operators: subscriber data, mobile-money rails, and the internal paths between corporate IT and service platforms
- Government agencies and ministries: continuity of critical services and protection of citizen data against targeted intrusion
If you have not yet built that baseline, start with our penetration testing service and an incident response plan, then come back to red teaming when there is a detection capability worth measuring. That sequencing advice is free and we give it on the first call.
Deliverables
- Attack narrative: the full path from initial access to objective, with proof-of-concept evidence at each step
- MITRE ATT&CK mapping: every technique used, so your SOC can build detections against a recognised framework
- Detection timeline: what your team detected, when, and what passed unnoticed, the honest measure of your monitoring
- Prioritised remediation: fixes for the exploited weaknesses and for the monitoring and process gaps the exercise exposed
- Executive and technical debriefs: a board-ready summary of business impact, and a hands-on session with your defenders
Frequently asked questions
What is the difference between a red team exercise and a penetration test?
Is our organisation ready for a red team exercise?
How long does a red team engagement take?
Will our security team know the exercise is happening?
Does a red team exercise satisfy the BNR annual penetration testing requirement?
How much does a red team exercise cost?
Can we run a purple team exercise instead?
Not sure which engagement your institution needs? Start with the maturity model in our red team vs penetration testing guide, or see the full scope of our manual testing on the penetration testing service page.
Ready to test your defences, not just your systems?
Tell us your objectives and your current testing history. We reply within 24 hours with an honest recommendation, and a scoped proposal follows within 48 hours of the scoping call.