The attack chain
Every step from first foothold to trophy, with the evidence.
Expert services · red team
Could a real attacker reach what matters? Would you even know?
A real attacker doesn’t work down a checklist. They pick one thing worth taking and use everything to reach it: a flaw in the code, a propped-open door, a phone call.
Not ready to scope it? Find your fix →Proof, not theory
12 days
To full global data access, and not a single alert.
A $100B+ retailer asked if a cyberattack could destroy them. Four operators chained physical and digital past $329M of security spend to total compromise. Nobody noticed.
Read “Death by 1,000 Cuts” →Why a red team
A pen test checks the locks. A red team comes for the vault.
A pen test answers “where am I vulnerable?”, surface by surface, against a scope. Useful, and necessary. But a determined attacker doesn’t work surface by surface. They pick a goal and use anything that gets them closer:
- A flaw in the app
- A door held open
- A phone call
- A signal in the air
A red team is goal-driven, undetected, and judged on one thing: could we reach what matters — and would you have caught us?
One engagement, every domain
Your silos are somebody’s shortcut.
Most testing is siloed: network here, app there, nobody on the building or the people. A real adversary exploits exactly that gap, so we combine every domain in one engagement, chained the way an attacker operates.
The point isn’t any one domain. It’s the chain across all of them: the multi-stage attack a siloed test can never see.
What makes it count
We go for a trophy. With your controls left on.
We go for a trophy
We agree the prize up front (Domain Admin, payments, the customer database) and go take it. Risk in terms a board understands, not a list of severity scores.
We leave your controls on
No whitelisting us, no EDR switched off, no tipping the SOC. Defences off is theatre. We run against the real thing.
Sample trophies — the kind of prize we go for
BankDeal-book access
RetailerThe customer database
HospitalPatient records
ManufacturerPlant-floor control
SaaS providerThe source repository
EnergyGrid / SCADA control
How it runs
Three ways to point it.
01Objective-based02Assumed-breach03Full-scope
Starts fromOutside, coldA foothold insideOutside — everything
What it answers“Could they reach what matters?”“Would we detect and respond?”The full determined adversary
ScopeOne crown jewelDetection & responseCyber + physical + social
Best forA clean yes/no on the crown jewelsPressure-testing the blue teamMaximum realism, over weeks
01Objective-based
Starts fromOutside, cold
What it answers“Could they reach what matters?”
ScopeOne crown jewel
Best forA clean yes/no on the crown jewels
02Assumed-breach
Starts fromA foothold inside
What it answers“Would we detect and respond?”
ScopeDetection & response
Best forPressure-testing the blue team
03Full-scope
Starts fromOutside — everything
What it answersThe full determined adversary
ScopeCyber + physical + social
Best forMaximum realism, over weeks
What you walk away with
What held, what didn’t
The exact controls that stopped us, and the ones that did not.
The detection timeline
What your team saw, and when. Or where it stayed silent.
The fix, prioritised
A ranked path from this engagement to a closed gap.
The engagement ends; the support doesn’t. You get hands-on remediation help and a free re-test to confirm the gaps are closed. Scoped per objective and environment.
For regulated finance
Threat-led testing, by the book.
Red teaming is the engine behind threat-led penetration testing: the intelligence-led, production-grade testing that the FFIEC and financial regulators increasingly point to. We run it to the framework, end to end.
Threat-led testing & DORA →