Vorpcel / Services / Offensive security
A red team exercise answers one question: if a determined attacker went after what matters most to you, would your team notice and stop them in time? We agree on an objective with you, run an authorized exercise against it and show where detection and response worked and where they did not.
At a glance
A vulnerability assessment lists weaknesses. A red team exercise goes further: it checks whether the alerts fire, whether someone reads them, whether the right people are called and whether the response is fast enough to protect the objective.
The result is not a longer list of findings. It is a clear picture of how your company behaves under a realistic attack, and a short list of changes that make the biggest difference.
Reach the database or the system where your customers' personal data is kept.
Get to the system that approves payments or holds card data.
Gain access to the mailbox of an executive.
Reach the repositories and the pipeline that ship your product.
Obtain administrator rights over the main company directory.
Take control of the cloud account that runs production.
Each exercise is planned with a small group on your side who know it is happening, so it stays safe and can be stopped at any moment.
We agree on the objective, what is in and out of scope, the dates, the contacts and what is never touched. Everything is written and signed.
Our team works toward the objective within the agreed rules, keeping a detailed log of every action and its time.
We sit with your security team and compare our log with what they saw, step by step, to find where detection could have happened.
You receive the report and the recommendations. After the changes, we can repeat the key steps to confirm they now work.
Which steps produced an alert, which were recorded in the logs without an alert and which left no trace at all.
How long it took from the first alert to someone acting on it, and whether the action would have stopped a real attacker.
Whether escalation, communication and decisions followed your plan, and where the plan was missing or unclear.
Every step of the exercise next to what your tools and people saw at that moment.
The changes in detection, response and configuration that would have stopped the exercise earliest, in order.
One page on whether the objective was reached, how close the defense came and what the investment should focus on.
The format depends on how mature your defense is and what you want to learn.
| Option | Best for | What it includes |
|---|---|---|
| Full exercise | Mature teams that want the most realistic test | Objective reached from the outside, over several weeks, with the joint review and report |
| Assumed breach | Testing what happens after someone is already inside | The exercise starts from a regular employee machine or account agreed with you |
| Purple team | Teams that want to learn and improve during the exercise | Our team and yours work side by side, testing detections step by step |
The rules of engagement list what is never touched and what actions are not allowed. A contact on your side can pause or stop the exercise at any time, and every action is logged so it can be reviewed.
Only a small group you choose, usually a sponsor in leadership and one person in security. The rest of the team responds as they would to a real event, which is what makes the result meaningful.
A penetration test looks for as many weaknesses as possible in a defined scope. A red team exercise follows one objective over a longer period and measures how your defense detects and responds.
It is most useful when you already have logging, alerting and someone responsible for responding. If those are still being built, a blue team engagement or a vulnerability assessment is usually the better first step.
Only if you want it and it is written in the rules of engagement, with the limits agreed in advance. Many exercises start from an assumed breach instead.
We reply with a few questions about scope, then send a proposal with dates and price.