Red teaming
A goal driven simulation that tests your people, your process and your technology at the same time.
What is red teaming?
A penetration test asks what weaknesses a system has. A red team asks a harder question: could a real attacker reach what matters most to you, and would your team notice?
We agree a goal with you, such as access to a payment system or a set of sensitive data. Then we try to get there by any realistic route, quietly, the way a real attacker would.
Red team or penetration test?
A penetration test covers as many weaknesses as possible in a defined scope. A red team follows one realistic attack path to a goal and measures your detection and response along the way. Most organisations start with penetration testing and add red teaming once monitoring is in place.
What a red team covers
-
Full scope
Any realistic route is in play, as agreed with you: internet facing systems, people through phishing and social engineering, and the internal network.
-
Stealth
We move quietly and avoid noisy tools, like a real attacker would, so the test shows what your defenders actually see.
-
Detection and response check
We record what we did and when. Then we compare it with what your monitoring caught and how your team responded.
How we test. Every step we take is mapped to MITRE ATT&CK, so your defenders can see exactly which techniques they caught and which ones they missed.
What you get
- The full attack path, step by step, with timestamps
- Each technique mapped to MITRE ATT&CK
- Detection gaps: what your monitoring saw and what it missed
- Findings ranked by real business risk, with clear fixes
- A walkthrough of the attack with your team
Why Mica Shield
Attackers by trade
CRTA, OSCP and Dante Pro on the team. We think like the people you are defending against.
Safe by design
Clear rules of engagement, an agreed goal and a named contact on your side for every exercise.
Useful for defenders
The report is written for your blue team as much as for management.
How an engagement works
-
Scope
We agree what to test, when, and what is off limits. You get a scope, a timeline and a fixed price before any work starts.
-
Test
We attack your systems the way a real attacker would, inside the rules we agreed. If we find something critical, we tell you then, not at the end.
-
Report
Every finding is ranked by real business risk, with evidence and a fix your engineers can follow without a translator.
-
Fix
Your team fixes the issues. We stay available to answer questions while you work through them.
-
Retest
We test the fixes and confirm what is closed. One retest is included in the price.
Questions buyers ask
What is the difference between red teaming and penetration testing?
A penetration test finds as many weaknesses as possible in a set scope. A red team pursues one goal by any realistic route and tests whether your team detects and stops it.
Who in our organisation knows about the exercise?
Usually a small group, often called the white team, who approve the plan and can stop the exercise at any time. Your defenders are normally not told, so the detection test is real.
Will a red team exercise disrupt the business?
It should not. We agree limits up front, avoid destructive actions and keep a direct line to your white team throughout.
How long does a red team engagement take?
Longer than a typical penetration test, because stealth takes time. The timeline depends on the goal and scope, and we set it out in the quote.
Do we need a SOC before doing a red team?
You get the most value when some monitoring is in place. If it is not, a penetration test is usually the better first step, and we will tell you so.
Related services
Tell us what you need tested
We will come back with a scope, a timeline and a fixed price.