Red Team Engagements
Full-scope adversarial simulations testing your people, processes, and technology simultaneously.
Red Team Engagements
A red team engagement is not a penetration test. Where a pentest finds vulnerabilities, a red team operation tests your organisation's ability to detect, respond to, and contain a real adversary — across people, processes, and technology simultaneously. Intelliroot's red team operators bring genuine offensive security experience, using custom tooling and adversary tradecraft to simulate nation-state and advanced criminal threat actors.
Every engagement is goal-oriented: we define a specific objective (Crown Jewels access, data exfiltration, ransomware simulation) and work covertly to achieve it while your blue team attempts to detect and stop us. The result is an unfiltered picture of your true security posture — not just your theoretical controls.
Why a Red Team Is Different
Tests Your Detection & Response
A pentest tells you where vulnerabilities exist. A red team tells you whether your SOC, EDR, and incident response team can actually catch and stop an attacker in real time.
Full Kill Chain Simulation
We simulate the complete attack chain — initial access, lateral movement, privilege escalation, persistence, and objective completion — just like real adversaries operate.
Covert Operations
Unlike a pentest, only a small group in your organisation knows a red team exercise is underway. This tests your actual human and technical detection capabilities without the safety net of forewarning.
MITRE ATT&CK Mapped Findings
Every technique used is mapped to the MITRE ATT&CK framework, giving your blue team a precise understanding of detection gaps and enabling targeted SOC improvements.
Attack Vectors We Use
Initial Access
- Spear phishing and whaling campaigns
- Watering hole and supply chain simulation
- External service exploitation
- Physical access and USB drop scenarios
- VPN and remote access attacks
Post-Exploitation
- Lateral movement through AD and cloud
- Kerberoasting and credential dumping
- Living-off-the-land (LOLBin) techniques
- C2 infrastructure with custom implants
- Persistence through scheduled tasks, WMI
Privilege Escalation
- Active Directory privilege escalation paths
- Token impersonation and UAC bypass
- Unquoted service paths and DLL hijacking
- Azure AD / Entra ID escalation
- Cloud IAM privilege escalation
Objective Completion
- Crown Jewels data access and exfiltration
- Ransomware deployment simulation
- Financial system access scenarios
- Sabotage and availability impact simulation
- Regulatory data breach simulation
How We Run a Red Team Engagement
Objectives & Rules of Engagement
Define the Crown Jewels (target objectives), authorised attack vectors, out-of-scope systems, engagement duration, and emergency contact procedures. Agree on notification protocols (white cell).
Threat Intelligence & OSINT
Conduct comprehensive open-source intelligence gathering on your organisation — public infrastructure, employee data, technology stack, supply chain — to build a realistic adversary playbook.
Initial Access Operations
Execute initial access attempts using the agreed vectors — typically spear phishing, external exploitation, or physical scenarios — operating covertly to establish a foothold without triggering alerts.
Post-Exploitation & Objective Pursuit
From the initial foothold, conduct lateral movement, privilege escalation, and persistence operations — all mapped to MITRE ATT&CK — working toward the defined engagement objectives.
Detection Gap Analysis
Document each technique used, timestamp it, and correlate against your SOC's detection logs to identify precisely which ATT&CK techniques your defences missed, detected, or stopped.
Report & Debrief
Deliver the Red Team report with attack narrative, MITRE ATT&CK heat map, detection gap analysis, and Blue Team improvement recommendations. Conduct a joint red/blue debrief session.
Frequently Asked Questions
Deliverables
Red Team Narrative Report
Chronological attack story from initial access to objective completion — written to communicate real impact to both technical and executive audiences.
MITRE ATT&CK Heat Map
Visual mapping of all techniques used against the ATT&CK framework, showing detection coverage gaps and the techniques your SOC missed.
Detection Gap Analysis
Per-technique analysis of what your SOC detected, missed, and alerted on — with specific recommendations for improving detection engineering.
Executive Summary & Risk Briefing
Board-level summary of the engagement outcome, business risk impact, and strategic security investment recommendations.
Blue Team Improvement Roadmap
Actionable SOC and detection engineering recommendations, including specific use-case development priorities for your SIEM.
Request a Security Assessment
Tell us about your environment and security objectives. We'll design a bespoke assessment and deliver a detailed proposal within 48 hours.