Redguard AG - Red Teaming

Your ICT infrastructure is under attack. Let us be the first and only ones to succeed in this.

Red Teaming simulates the approach of real-world attackers and specifically tests your established detection and response capabilities. By carefully weighing and selecting attack techniques, our security testers operate covertly to uncover vulnerabilities before they can be exploited by malicious actors. The focus is not only on technical security flaws, but on the resilience of your entire security organization.

Request offer

Selected references on the subject

Why Red Teaming?

Red Teaming is the ultimate stress test for your cyber security. While traditional assessments search for technical vulnerabilities, a Red Team simulates a targeted, covert attack by highly motivated threat actors. The goal: to put not only your systems, but especially the detection and response capabilities of your defenders to the test.

Focus on Detection and Response

A professional cyber attack is rarely loud and obvious. During a Red Teaming engagement, our security experts operate as inconspicuously as possible to challenge your monitoring systems and internal defense team (Blue Team or SOC) under real-world conditions. We not only evaluate whether a breach is possible, but above all when and how your internal mechanisms trigger alerts and how effectively your countermeasures perform.

Simulation of Sophisticated Adversaries (APTs)

Our Red Teaming engagements are modeled on the specific tactics, techniques, and procedures (TTPs) of real hacker groups relevant to your industry. Operating in an assessment that often spans several weeks, we emulate an Advanced Persistent Threat (APT). We aim to penetrate deep into your networks unnoticed, escalate privileges, and compromise predefined critical objectives—such as accessing highly confidential business data or obtaining complete domain control.

Targeting the Entire Attack Surface

To accomplish our objectives, we think and act like real adversaries, leveraging all available attack vectors across the entire "Kill Chain". In addition to technology, this encompasses social engineering (such as targeted spear-phishing) and the exploitation of physical vulnerabilities. As a result, you gain a comprehensive understanding of your current resilience: we show you precisely where along the attack chain your defense succeeded and where your processes, technologies, or people need targeted reinforcement.

Difference between Red Teaming, Attack Simulation and Purple Teaming

In contrast, red teaming takes existing detection and response processes into account by carefully weighing up and selecting the chosen attack techniques before execution in order to remain undetected as an attacker for as long as possible. This also uncovers and exploits vulnerabilities and security gaps, but the main focus is on testing your company's existing detection and response capabilities.

The aim of an attack simulation is to uncover security gaps and vulnerabilities that are particularly relevant for you and your company. As with red teaming, a real attacker is simulated, but for reasons of efficiency, no consideration is given to any detection and response capabilities.

Purple Teaming, on the other hand, involves collaborative testing between the attacker and defender of a predefined series of attack techniques with the aim of uncovering any gaps and weaknesses in your company's detection capabilities as efficiently and comprehensively as possible.

Possible scenarios of a Red Teaming

An effective security assessment is tailored to your individual risk profile and specific threat model. Our Red Teaming has a modular structure, offering maximum flexibility in choosing your starting scenario. Whether you want to challenge your perimeter defenses (Initial Access), evaluate the detection of insider threats or already established intruders (Assumed Breach), or conduct an end-to-end full simulation with an optional fallback (Full Assessment): we tailor the engagement precisely to your objectives.

Full Assessment

The Full Assessment represents the most comprehensive and realistic form of Red Teaming, mapping the complete end-to-end attack lifecycle along the Unified Kill Chain. Our team initiates the engagement as an external adversary seeking Initial Access. Once access is established, the assessment transitions seamlessly into the internal phases of an Assumed Breach scenario to penetrate deeper into your organization and challenge predefined core objectives. To guarantee maximum project value and ensure that internal detection and response mechanisms are thoroughly evaluated regardless of perimeter resistance, a structured fallback scenario is defined in advance.

Initial Access

In this scenario, our Red Team acts like an external threat actor without prior knowledge or established access. The objective is to breach your IT infrastructure via exposed perimeter systems, vulnerabilities in publicly accessible services, cloud environments, or targeted social engineering attacks (e.g., spear-phishing). This approach primarily validates your perimeter defenses and the resilience of your frontline controls.

Assumed Breach

This scenario assumes that an attacker has already gained access to your internal network—for instance, through compromised credentials, an infected endpoint, a third-party partner, or a malicious insider. Our team starts directly within the internal environment to escalate privileges, move laterally, and reach critical business assets, focusing entirely on internal detection and response capabilities.

Objectives of a Red Teaming

The following objectives represent typical examples within a Red Teaming engagement:

Initial Access: Gaining technical access to a system within the perimeter.
Malware Infection: Establishing a Command-and-Control (C2) connection from the internet with an arbitrary internal system.
Privilege Escalation: Escalating standard user privileges to a domain administrator.
Exfiltration: Exfiltrating a defined flag or a specified set of data.
Impact: Performing effective encryption based on a designated set of test data.

The scope and specific formulation of concrete objectives for the Red Teaming assessment are defined jointly with you as part of the Rules of Engagement during project initiation.

Flow

Our red teaming assessments are closely aligned with the Unified Kill Chain, spanning the IN, THROUGH, and OUT phases:

Source: https://www.unifiedkillchain.com/

Red Teaming under DORA and TIBER-EU

The Digital Operational Resilience Act (DORA) requires financial institutions to conduct regular Threat-Led Penetration Tests (TLPT), which are closely aligned with the TIBER framework. Our specialists guide you through this complex process, both during the Threat Intelligence (TI) and Red Teaming (RT) phases, as well as serving as part of your White Team to expertly manage the exercise.

Whether you are planning a TLPT strictly according to the TIBER model or require a custom-tailored simulation: We strengthen your resilience with years of experience and bespoke scenarios designed to meet your exact requirements.

Results

As a result of a Red Teaming assessment, you will receive a comprehensive and actionable evaluation of your organization's security and response posture. We provide solid decision-making foundations and concrete recommendations for improvement:

Management Summary & Detailed Report: An executive summary tailored for decision-makers alongside an in-depth technical report detailing all findings, proven attack paths, and prioritized remediation guidance.
Chronological Action Log: A complete timeline documenting every executed attack technique (aligned with MITRE ATT&CK) and all relevant artifacts.
Detection and Response Alignment: A thorough comparison between our attack activities and the actual detections/alerts generated by your Blue Team or SOC (including metrics such as Time-to-Detect and Time-to-Respond).
Structured Risk Breakdown: Individual findings and risk ratings for easy triage, tracking, and integration into your internal risk management workflows.
Final Presentation & Debriefing: A collaborative debriefing workshop with key stakeholders and technical teams to discuss lessons learned and define sustainable security enhancements.

To maximize value, a transparent debriefing is conducted with your Blue Team following the covert assessment phase, allowing detected events, alert triggers, and executed (or missed) countermeasures to be jointly analyzed.