Cyber Drill & Adversary Simulation
Incognito Lab will simulate the techniques, tactics and procedures (TTPs) used by the attackers to evaluate the security controls of the organisation. With this approach, it is a lot better than table top exercise and we could address both technical and procedural defense mechanism.
To rehearse your own team's response in a controlled lab, see CognitoRange.
Purple Teaming
This service will enumerate the attackers' techniques to test against the blue team and train them to regenerate the attack to continuously improve the security. Our approach could close the gap between red team and blue team with the simulation and introduce the concept of purple team to the organisation.
Hybrid Table Top Exercise (Hybrid HTTX)
This is an improved version of a classic TTX with real evidence and hands on simulated scenario based on the perspective of gamification style. Designed scenarios are ranging from typical cyber threats to the latest TTPs used by notorious hacker groups. The objective is to improve the incident response process and train participants to do execute the effective actions.
A smooth sea never made a skillful sailor.
Organizations can better prepare for the impact of current and future threats by simulating real-world cyber attacks and exercising Tactics, Techniques and Procedures (TTPs) that adversaries use during breaches. Organizations cannot thoroughly identify gaps in security controls by entirely focusing on breach prevention strategies. As a smooth sea never made a skillful sailor, Incognito Lab could be your simulated actors to improve the overall perspectives of your defensive security posture.
A red team engagement goes deeper than a conventional penetration test. Instead of enumerating vulnerabilities in a fixed scope, we mimic the tactics, techniques, and procedures that real adversaries use against organisations like yours, with a defined objective, a full attack chain, and your defenders left in the dark. It answers a harder question: would you notice an attacker at all, and how fast could you respond? This is the assessment we recommend once a client has already hardened their systems and wants to test the people and process wrapped around them.
Services
- Cyber Drill & Adversary Simulation: Simulate attacker TTPs to evaluate security controls. Goes beyond table-top exercises by addressing both technical and procedural defence mechanisms. To rehearse your own team's response in a controlled lab, see CognitoRange.
- Purple Teaming: Enumerate attacker techniques to test blue team capabilities. Train defenders to regenerate attacks for continuous improvement and close gaps between red and blue teams.
- Hybrid Table Top Exercise (Hybrid HTTX): Improved TTX with real evidence and hands-on simulated scenarios based on gamification. Covers typical cyber threats to latest TTPs and improves incident response.
How we work
Every red team engagement follows the same five-step process, so the objectives stay clear even when the operation itself is covert.
- Scoping & objectives: We agree on what "success" means for the exercise: reaching a specific critical system, exfiltrating a marked data set, or landing domain admin without triggering a response. The proposal states the objectives, a fixed duration, and the boundaries, so the engagement has a defined end.
- Rules of engagement: Before any activity begins, we agree on off-limits systems, testing windows, legal authorisation, safe words, and the small circle of "trusted agents" who know the operation is live. This protects your production environment and gives you a clean way to distinguish our activity from a genuine incident.
- Reconnaissance & execution: We build a picture of your organisation from the outside (people, exposed infrastructure, supply chain), then work through an attack chain toward the agreed objective: initial access, establishing a foothold, privilege escalation, lateral movement, and action on objectives. Techniques are chosen to look like a real adversary.
- Reporting: You receive an attack narrative that reads like a story of how the objective was reached, mapped to the detection and response gaps it exposed, with a timeline your SOC can compare against their own logs. It is written for two audiences: leadership who need the risk picture, and defenders who need to reproduce and fix each step.
- Retest & debrief: We walk your blue team through the full kill chain in a debrief, replay the techniques so they can validate their detection improvements, and confirm the gaps are closed.
Pentest vs Red Team vs Purple Team
Choosing between these three is the first conversation we have with most clients. The right one depends on what you already know about your defences.
| Penetration Test | Red Team | Purple Team | |
|---|---|---|---|
| Objective | Find and validate as many vulnerabilities as possible in a defined scope | Test detection and response against a realistic, goal-driven attack | Improve detection by running attack techniques side by side with your defenders |
| Scope | Agreed list of applications, hosts, or networks | The organisation (people, process, and technology) | Selected techniques mapped to your monitoring coverage |
| Duration | Days to a few weeks | Weeks to months | Workshop-style, days per iteration |
| Deliverable | Findings with severity, reproduction steps, and remediation guidance | Attack narrative, detection gaps, response timeline | Tuned detection rules and a coverage matrix |
| Who it's for | Teams that need assurance on specific systems, or compliance evidence | Organisations with a SOC that want to measure real readiness | Blue teams that want to level up detection quickly |
If you still need assurance on specific systems, or compliance evidence for an auditor, start with a conventional penetration test. A red team is the right call once those systems are hardened and you want to know whether your defenders would catch a real intrusion.
What you get
Every engagement is documented for two audiences at once:
- Executive summary: a business-level account of whether the objective was reached, what it would have meant, and where the organisation is exposed.
- Attack narrative: the full kill chain, step by step, with evidence and screenshots, so there is no ambiguity about how the objective was achieved.
- Detection & response timeline: a side-by-side comparison of what we did and what your monitoring saw (or missed), so the SOC can measure real dwell time.
- Findings with severity ratings: technical issues surfaced along the way are scored with CVSS and given practical remediation guidance.
- Retest verification: after your team tunes detections and closes gaps, we replay the techniques and confirm the improvements hold.
Every engagement to date has produced validated findings.
Team credentials
Engagements are run by our in-house team holding industry certifications including OSCP, OSCE, CREST CRT, CREST CPSA, and GIAC GREM, each earned through hands-on practical examination. The same team presents its research at international venues and has served 180+ clients across finance, enterprise, and critical sectors. See the full list of certifications the team holds.
Standards & compliance
Our testing services follow NIST SP800-115 (Technical Guide to Information Security Testing and Assessment), and our adversary-emulation work uses the same methodology. Red team techniques are mapped to MITRE ATT&CK so your defenders can align detections to real-world TTPs. If your engagement needs to produce evidence in a specific format (for an internal audit or a board report), tell us during scoping, and we will structure the deliverables to match.
Last reviewed: 12 Oct 2026
Book a scoping callFrequently asked questions
What is red teaming, and how is it different from a penetration test?
A penetration test enumerates and validates vulnerabilities in a defined scope. A red team engagement goes deeper: we mimic the tactics, techniques, and procedures of real adversaries, working a full attack chain toward a defined objective with your defenders left in the dark. A pentest asks 'what can be broken here?'; a red team asks 'would you notice an attacker at all, and how fast could you respond?'
When should we choose a red team instead of a pentest?
A red team is the right call once your systems are already hardened and you want to test the people and process wrapped around them, specifically your detection and response. If you still need assurance on specific systems, or compliance evidence for an auditor, start with a conventional penetration test first.
What do you need from us to scope a red team engagement?
The objective you want tested, such as the critical system or data set an attacker would go after; any systems or locations that are off-limits; acceptable testing windows; the people who can authorise the work and act as trusted agents; and an escalation contact. From that we propose a realistic scenario and agree the rules of engagement before any activity begins.
Will a red team engagement disrupt our production environment?
We engineer the engagement so it doesn't. Before any activity begins we agree the rules of engagement: off-limits systems, testing windows, legal authorisation, safe words, and a small circle of 'trusted agents' who know the operation is live. This protects your production environment and gives you a clean way to distinguish our activity from a genuine incident.
What is purple teaming?
Purple teaming runs attack techniques side by side with your defenders to improve detection quickly. We enumerate attacker techniques, test your blue team's ability to catch them, and close the gaps between red and blue (delivered workshop-style, with tuned detection rules and a coverage matrix as the output).
What do we receive at the end of the engagement?
An attack narrative documenting the full kill chain with evidence, a detection and response timeline comparing what we did against what your monitoring saw, an executive summary, technical findings rated with CVSS, and a retest where we replay the techniques after you tune detections. The engagement closes with a debrief with your blue team.
EVERY BUSINESS IS UNIQUE, EVERY ADVERSARY IS MOTIVATED, ARE YOU WELL-PREPARED?
Our team of experts is ready to help.
