Red Team and Purple Team Services

A penetration test asks whether a weakness exists. A red team engagement asks a harder question: if someone were already working against you, would you notice?

These are different buys, and the second one only makes sense once the first has stopped producing surprises. If your last pentest returned a long list, start there.

How an engagement runs

We agree an objective with you. Reach a specific dataset, gain domain administrator, get access to the production environment, prove you could move money. Then we work toward it the way an intruder would, quietly, over weeks rather than days.

What comes back is not a vulnerability list. It is a narrative: how far we got, what we touched, what fired, what did not, and where the gap between your detection coverage and your actual exposure sits.

Purple team

Sometimes the useful version is not adversarial at all.

In a purple team exercise your defenders know what is coming and watch it happen. We run a technique, you check whether it produced an alert, and if it did not, the detection gets written and tested before we move on.

This tends to produce more improvement per day than a covert engagement, because nothing has to wait for a report. It is the better choice when you already suspect where the gaps are and want them closed rather than proven.

Which one you want

	Red team	Purple team
Defenders know	No	Yes
Best for	Testing the whole response chain	Building detection coverage fast
Output	A narrative and a gap analysis	Tuned, tested detections
Prerequisite	Mature-ish detection already in place	A team willing to iterate live

If you are not sure which, that is a normal place to be and a short conversation sorts it.

What you get

A narrative you can hand to an executive. The timeline of what we did, in order, with the moment each control did or did not catch it. This is the artifact that gets budget approved, because it describes an event rather than a score.

A detection gap analysis. Every technique we used, mapped to whether it produced telemetry, whether that telemetry reached anyone, and whether anyone acted. Those are three separate failures and they get fixed three different ways.

The evidence, kept. Screenshots, timestamps, command history, and the artifacts we left behind so your team can hunt for them afterwards. A red team that cannot be retraced is a story rather than a test.

A retest on the objectives that mattered. Closing a path is only proven when the same route stops working.

What we will not do

We will not run an engagement against an organization that has never had a penetration test. It produces a report full of findings you could have had for less money, and it teaches your defenders that the exercise is unwinnable. Start with testing instead.

We will not treat your staff as the target. Social engineering is in scope when you ask for it and when there is a plan for what happens to the person who clicks. Without that plan, the finding is that humans are human, and the cost is paid by someone who did not choose to be tested.

We will not keep going once the objective is met and the gap is obvious. Continuing past that point bills time for evidence you already have.