Services
Cyber Drill & Adversary Simulation
Simulate attacker TTPs to evaluate security controls. Goes beyond table-top exercises by addressing both technical and procedural defence mechanisms.
To rehearse your own team's response in a controlled lab, see CognitoRange.
Purple Teaming
Enumerate attacker techniques to test blue team capabilities. Train defenders to regenerate attacks for continuous improvement and close gaps between red and blue teams.
Hybrid Table Top Exercise (Hybrid HTTX)
Improved TTX with real evidence and hands-on simulated scenarios based on gamification. Covers typical cyber threats to latest TTPs and improves incident response.
Who it's for
- Organisations with a SOC that want to measure real readiness
- A red team is the right call once your systems are already hardened and you want to test the people and process wrapped around them, specifically your detection and response.
Penetration Test
A red team engagement goes deeper than a conventional penetration test. Instead of enumerating vulnerabilities in a fixed scope, we mimic the tactics, techniques, and procedures that real adversaries use against organisations like yours, with a defined objective, a full attack chain, and your defenders left in the dark. It answers a harder question: would you notice an attacker at all, and how fast could you respond?
How we work
Scoping & objectives
We agree on what "success" means for the exercise: reaching a specific critical system, exfiltrating a marked data set, or landing domain admin without triggering a response.
Proposal with objectives, a fixed duration and boundaries
Rules of engagement
Before any activity begins, we agree on off-limits systems, testing windows, legal authorisation, safe words, and the small circle of "trusted agents" who know the operation is live.
Agreed before any activity
Reconnaissance & execution
We build a picture of your organisation from the outside (people, exposed infrastructure, supply chain), then work through an attack chain toward the agreed objective.
Techniques are chosen to look like a real adversary
Reporting
You receive an attack narrative that reads like a story of how the objective was reached, mapped to the detection and response gaps it exposed, with a timeline your SOC can compare against their own logs.
Written for leadership and for defenders
Retest & debrief
We walk your blue team through the full kill chain in a debrief, and replay the techniques so they can validate their detection improvements.
Confirm the gaps are closed
Detection & response timeline
| Attack stage | Initial access | Foothold | Privilege escalation | Lateral movement | Action on objectives |
|---|---|---|---|---|---|
| Your SOC | Seen | Missed | Missed | Seen | Not reached |
Illustration of the report format, not results from a real engagement.
A side-by-side comparison of what we did and what your monitoring saw (or missed), so the SOC can measure real dwell time.
Pentest vs Red Team vs Purple Team
Penetration Test
- Objective
Find and validate as many vulnerabilities as possible in a defined scope
- Scope
Agreed list of applications, hosts, or networks
- Duration
Days to a few weeks
- Deliverable
Findings with severity, reproduction steps, and remediation guidance
- Who it's for
Teams that need assurance on specific systems, or compliance evidence
Red Team
- Objective
Test detection and response against a realistic, goal-driven attack
- Scope
The organisation (people, process, and technology)
- Duration
Weeks to months
- Deliverable
Attack narrative, detection gaps, response timeline
- Who it's for
Organisations with a SOC that want to measure real readiness
Purple Team
- Objective
Improve detection by running attack techniques side by side with your defenders
- Scope
Selected techniques mapped to your monitoring coverage
- Duration
Workshop-style, days per iteration
- Deliverable
Tuned detection rules and a coverage matrix
- Who it's for
Blue teams that want to level up detection quickly
If you still need assurance on specific systems, or compliance evidence for an auditor, start with a conventional penetration test.
What you get
Executive summary
Whether the objective was reached, what it would have meant for the business, and where the organisation is exposed.
Attack narrative
The full kill chain, step by step, with evidence and screenshots.
Detection & response timeline
What we did beside what your monitoring saw or missed.
Findings with severity ratings
Technical issues found along the way, scored with CVSS and given practical remediation guidance.
Retest verification
We replay the techniques after your team tunes detections.
Every engagement to date has produced validated findings.
Team credentials
180+
clients served across finance, enterprise, and critical sectors
- OSCP
- OSCE
- CREST CRT
- CREST CPSA
- GIAC GREM
Engagements are run by our in-house team holding these industry certifications, each earned through hands-on practical examination. The same team presents its research at international venues. See the full list of certifications the team holds.
Our testing services follow NIST SP800-115 (Technical Guide to Information Security Testing and Assessment), and our adversary-emulation work uses the same methodology. Red team techniques are mapped to MITRE ATT&CK so your defenders can align detections to real-world TTPs. If your engagement needs to produce evidence in a specific format (for an internal audit or a board report), tell us during scoping, and we will structure the deliverables to match.
Last reviewed: 12 Oct 2026
RED TEAMING
We propose a realistic scenario and agree the rules of engagement before any activity begins.
Frequently asked questions
What is red teaming, and how is it different from a penetration test?
A penetration test enumerates and validates vulnerabilities in a defined scope. A red team engagement goes deeper: we mimic the tactics, techniques, and procedures of real adversaries, working a full attack chain toward a defined objective with your defenders left in the dark. A pentest asks 'what can be broken here?'; a red team asks 'would you notice an attacker at all, and how fast could you respond?'
What do you need from us to scope a red team engagement?
The objective you want tested, such as the critical system or data set an attacker would go after; any systems or locations that are off-limits; acceptable testing windows; the people who can authorise the work and act as trusted agents; and an escalation contact. From that we propose a realistic scenario and agree the rules of engagement before any activity begins.
Will a red team engagement disrupt our production environment?
We engineer the engagement so it doesn't. Before any activity begins we agree the rules of engagement: off-limits systems, testing windows, legal authorisation, safe words, and a small circle of 'trusted agents' who know the operation is live. This protects your production environment and gives you a clean way to distinguish our activity from a genuine incident.
What is purple teaming?
Purple teaming runs attack techniques side by side with your defenders to improve detection quickly. We enumerate attacker techniques, test your blue team's ability to catch them, and close the gaps between red and blue (delivered workshop-style, with tuned detection rules and a coverage matrix as the output).
From our red team
ARTICLES/15 Jan 2026
Persistence with Active Directory Certificate Services (AD CS)
AD CS ไม่ได้เป็นแค่ระบบออกใบรับรอง แต่ผู้โจมตีใช้เป็นจุดฝังตัวเพื่อคงสิทธิ์ในระบบได้ บทความไล่เทคนิค persistence ผ่าน AD CS ทีละขั้น
ARTICLES/19 May 2023
SSH Tunnel สำหรับงาน Pentest: Local, Remote และ Dynamic Port Forwarding
SSH Tunnel คือการส่งข้อมูลของ protocol อื่นผ่านการเชื่อมต่อ SSH ที่เข้ารหัส บทความอธิบาย Local, Remote, Dynamic และ Reverse Dynamic Port Forwarding พร้อมตัวอย่างคำสั่งและการใช้ร่วมกับ proxychains ในงานทดสอบเจาะระบบ
ARTICLES/27 Aug 2021
Pave the way to Domain Admins with BloodHound
ก่อนมี BloodHound การไล่หาเส้นทางสู่ Domain Admins กินเวลามาก บทความแสดงว่าเครื่องมือนี้ย่นขั้นตอนให้ pentester ได้อย่างไร
Book a scoping call
The proposal states the objectives, a fixed duration, and the boundaries, so the engagement has a defined end.
