Penetration Testing
Red Team Assessments and Red Teaming Services
Our red teaming services run objective-led attack simulations that test whether your organisation can detect and respond to a determined adversary. Rather than listing every vulnerability, a red team assessment pursues an agreed goal across technical, human and physical routes. We are a PCI SSC-approved QSA company, and every exercise runs under written rules of engagement.
Prefer to talk? Call +44 161 523 5276
- Technical, human and physical routes
- Tests detection and response
- Objective-led adversary simulation
Trusted by banks, payment providers and global brands
On this page
- Red teaming services: what's included
- Red team testing: what an exercise covers
- Adversary simulation and assumed breach options
- What are the pros and cons of red team testing?
- Are you ready for a red team assessment?
- How long does a red team engagement take, and what drives the cost?
- What does a red team report include?
- Red teaming, CBEST and DORA TLPT
- What happens in a red team exercise?
- Why choose Sovereign Secure for red team assessments?
- Frequently asked questions
Overview
What is a red team assessment?
The short answer
A red team assessment is an objective-led adversary simulation that tests whether your organisation can detect and respond to a determined attacker. Over several weeks, testers pursue an agreed goal, such as reaching critical data, using technical, human and, where agreed, physical routes, then report what they achieved and what your defenders saw.
A red team assessment is a goal-driven attack simulation that pursues an agreed objective, such as reaching a critical system or specific data, across technical, human and physical routes to test whether your team detects and responds. Our red teaming services run as a red team exercise against your live organisation, not a lab. Our guide to red teaming explains the wider practice, from objectives and phases to red, blue and purple teams.
Red teaming is best suited to organisations with an established security programme. If you are earlier in your journey, a scoped external penetration test, internal penetration test or web application test usually delivers more value first. Our guide to the types of penetration testing compares this test with the others.
What's included
Red teaming services: what's included
A red team engagement blends technical, human and physical attack paths towards an agreed objective.
- 01
Objective-based scoping
Clear goals agreed with a small trusted group, so the exercise tests what matters most to you.
- 02
Reconnaissance
Open-source intelligence gathering to build a realistic picture of your attack surface and people.
- 03
Initial access
Attempts to gain a foothold through phishing, exposed services or other realistic vectors.
- 04
Post-exploitation and movement
Escalation, lateral movement and persistence pursued towards the agreed objective.
- 05
Detection and response evaluation
Assessment of whether and when your defenders detect and respond to the activity.
- 06
Multi-vector approach
Technical, social engineering and, where in scope, physical vectors combined. Our guide to physical penetration testing explains how on-site entry is scoped and authorised.
What we test for
Red team testing: what an exercise covers
A red team engagement moves through the phases of a realistic intrusion.
Reconnaissance and targeting
Building a realistic picture of the organisation before any attack.
- OSINT gathering
- Attack-surface mapping
- Identification of key people and systems
- Supplier and third-party exposure
- Selection of realistic attack paths
Initial access
Gaining a first foothold the way a real attacker would.
- Targeted phishing and social engineering
- Exploitation of exposed services
- Credential attacks against the perimeter
- Physical access where in scope
- Abuse of exposed remote access
Escalation and movement
Expanding access towards the objective while staying undetected.
- Privilege escalation
- Lateral movement across the network
- Active Directory abuse
- Credential harvesting and reuse
- Persistence and evasion techniques
Objective and impact
Demonstrating what an attacker could ultimately achieve.
- Reaching agreed critical systems
- Access to sensitive or regulated data
- Demonstration of business impact
- Exfiltration simulation under agreed limits
- Evidence captured throughout
Detection and response
Measuring how your defenders performed against the activity.
- Whether activity was detected
- Time to detection and response
- Effectiveness of monitoring and alerting
- Escalation and containment behaviour
- Blind spots in coverage
Adversary simulation and assumed breach options
A red team can start from outside, like a real attacker, or from a foothold you hand over, which saves weeks of initial access and spends the time on what happens next. Both are forms of adversary simulation: the red team copies how a realistic threat actor behaves rather than working through a checklist.
| Option | Where the red team starts | Best for |
|---|---|---|
| Full adversary simulation | Outside your organisation, with only public information, then phishing, exposed services or physical entry to get in | Testing prevention, detection and response end to end, including your perimeter and your people |
| Assumed breach | Inside, with a standard user account and laptop, as if a phish had already worked | Testing detection of lateral movement and privilege escalation when time or budget is limited |
| Objective-focused scenario | Wherever a named threat is most likely to begin, such as a supplier connection or a stolen remote access account | Checking one specific risk the board is worried about |
Automated breach and attack simulation (BAS) tools replay known attack techniques continuously to check that controls still fire. They are useful between exercises, but they do not adapt, chain weaknesses or make the judgement calls a human red team makes.
What are the pros and cons of red team testing?
Red team testing gives the most realistic measure of whether a capable attacker would be caught, but it costs more, takes longer and covers less ground than a penetration test. It pays off once the basics are in place.
| Consideration | Pros | Cons |
|---|---|---|
| Realism | Copies how real attackers combine technical, human and physical routes | Simulated impact stays within agreed limits, so some real-world effects are only described |
| Detection and response | Measures whether, and how fast, your defenders notice and contain an attack | Gives little value if there is no monitoring or response process to test |
| Coverage | Shows how several modest weaknesses chain into a serious attack path | Follows the routes that reach the objective, so it does not list every vulnerability |
| Time and cost | One exercise tests people, process and technology together | Runs for weeks rather than days, so it costs more than a scoped penetration test |
| Learning | The attack narrative and timeline show defenders exactly what they missed | Lessons depend on a thorough debrief and on fixing what was found |
If you want to rehearse decisions rather than test technical detection, a cyber tabletop exercise is a cheaper place to start. For a collaborative exercise in which attackers and defenders work side by side, see our guide to purple teaming.
Are you ready for a red team assessment?
A red team gives most value once the basics are in place, because its job is to test detection and response rather than to find missing patches. Use this checklist before you commission one. If several answers are no, a scoped penetration test will usually teach you more for the money.
| Readiness check | Why it matters |
|---|---|
| You run regular penetration tests and fix what they find | Otherwise the red team spends its time rediscovering weaknesses you already know about |
| Security monitoring is in place, in house or through a managed service | Without alerts to trigger, the exercise cannot measure detection |
| An incident response process exists and people know their roles | The exercise tests whether that process works under pressure |
| A senior sponsor can agree the objectives and approve the scope in writing | Someone with authority has to sign off what the red team may do and accept the residual risk |
| A small trusted group can be kept informed without alerting the defenders | Detection is only measured fairly if the security team does not know the exercise is coming |
| You know which systems and data matter most | Objectives come from your critical assets and the threats you worry about most |
Not there yet? Our comparison of red teaming vs penetration testing shows which suits your stage, and why most organisations start with targeted tests.
How long does a red team engagement take, and what drives the cost?
Most red team engagements run for several weeks, because patient reconnaissance, initial access and evasion take time. Like other testing, the price is set by tester-days, so anything that lengthens the exercise raises the cost.
| Driver | Effect on duration and cost |
|---|---|
| Starting point | Full adversary simulation takes longer than an assumed breach start, because initial access has to be earned |
| Number of objectives | Each extra objective adds planning, execution and reporting time |
| Vectors in scope | Adding social engineering or physical entry adds preparation and, for physical work, travel and site time |
| Size of the estate | More sites, cloud tenants and business units mean more ground to research and cross |
| Detection maturity | A strong security team forces slower, quieter techniques, which take longer |
| Reporting and debrief | A detailed timeline matched against your logs, and workshops with your defenders, add days after testing |
Our penetration testing cost guide shows the published UK day rates we reviewed and how tester-days turn into a price.
What does a red team report include?
A red team report tells the story of the attack and measures your defence against it. It is written for two audiences: the board, who need to know whether a capable attacker would be caught, and the defenders, who need to know exactly what they missed and when.
| Report section | What it contains | Who uses it |
|---|---|---|
| Executive summary | Whether the objectives were reached, the overall risk and the most important improvements, in plain language | Board and senior management |
| Attack narrative | Each step from reconnaissance and first access to the objective, with the weaknesses that made it possible | Security leads and engineers |
| Detection timeline | What the red team did and when, set against what your monitoring raised and how your team responded | Security operations and incident response |
| Findings and evidence | Each weakness used in the attack, with evidence, a risk rating and its place in the attack path | Engineers and system owners |
| Recommendations | Prioritised improvements to prevention, detection and response, from quick wins to longer-term changes | Security leads and budget holders |
| Debrief | A walkthrough of the attack path and what your defenders saw, so the findings become lessons | Everyone involved in the defence |
Red teaming, CBEST and DORA TLPT
Some financial firms are required to run regulated red team tests. In the UK, CBEST is the intelligence-led testing framework the Bank of England, the PRA and the FCA use for the firms they select. In the EU, the Digital Operational Resilience Act (DORA) requires selected financial entities to carry out threat-led penetration testing (TLPT) of critical or important functions on live systems at least every three years, following a method built on the ECB’s TIBER-EU framework.
Both schemes set their own rules for threat intelligence, testers and supervision, so a commercial red team assessment is not a substitute for them. Our DORA TLPT guide explains who is in scope and how the schemes compare.
How it works
What happens in a red team exercise?
- 1
Scoping
We agree the objectives, in-scope vectors, rules of engagement and a small trusted-contact group, then fix the price.
- 2
Reconnaissance
We gather intelligence and plan realistic attack paths towards the objective.
- 3
Execution
We pursue the objective across agreed vectors, adapting as a real adversary would while staying within the rules of engagement.
- 4
Reporting
A report covering the attack narrative, what was achieved, and how detection and response performed.
- 5
Debrief
A walkthrough with your team of the attack path, what your defenders saw and when, and what to improve.
- 6
Retest
A follow-up engagement to confirm that improvements have closed the gaps found.
A red team exercise covers the same five stages of penetration testing as a pen test: planning and reconnaissance, scanning, gaining access, maintaining access, and analysis and reporting. The difference is that it pursues one objective covertly rather than listing every weakness.
Why Sovereign Secure
Why choose Sovereign Secure for red team assessments?
Established in 2012, we deliver PCI, ISO and Cyber Essentials work for banks, payment processors, card manufacturers and fast-growing companies.
Read client testimonials →- Objective-led testing that measures detection and response, not just a vulnerability list.
- Realistic, multi-vector engagements planned and executed to agreed rules.
- A debrief that walks your defenders through what happened and when, so they learn directly from the exercise.
- Reports that set each step of the attack against what your monitoring saw, so fixes target the real gaps.
FAQ
Frequently asked questions
Can't find your answer? Call us on +44 161 523 5276 or send us a message.
What is a red team exercise?
A red team exercise is an authorised simulation of a real attack on your organisation, in which a small team of testers tries to reach an agreed goal, such as sensitive data or a critical system, without being caught. It tests how well your people, processes and technology prevent, detect and respond to a determined attacker, and only a few trusted staff know it is happening.
How is a red team assessment different from a penetration test?
A penetration test looks for as many weaknesses as possible in a defined scope, while a red team pursues one objective quietly to test detection and response; our guide to red teaming vs pentesting compares the two in detail.
Will our security team know it is happening?
No. Only a small trusted group is aware, so the exercise gives a genuine measure of how your defenders respond. We agree that group and clear escalation rules during scoping.
Is red teaming right for us?
It is most valuable if you already run regular penetration testing and have monitoring and response in place. If you are earlier in your programme, we will usually recommend starting with targeted penetration tests, which give more immediate value.
What is a purple team exercise?
An exercise in which attackers and defenders work together to test and tune detection; our purple teaming guide explains how one runs.
Do you cause any real damage or disruption?
No. We simulate impact within agreed limits, avoid destructive actions and denial-of-service, and follow strict rules of engagement with immediate escalation of anything critical.
How much does a red team assessment cost?
Red team engagements run for longer than a standard penetration test, so the price is driven by the objectives, the vectors in scope (technical, social engineering, physical) and the duration. Our penetration testing cost guide explains how tester-days set the price, and our red team quote request returns a fixed proposal.
Last reviewed October 2026 by the Sovereign Secure assessment team.
Related services
- Social engineering & phishingSocial engineering testing services: phishing, vishing and pretext tests that measure how staff respond, reported by team rather than by name. Get a quote.
- Internal Penetration TestingInternal penetration testing by a PCI QSA company: Active Directory attack paths, lateral movement and PCI 11.4.5 segmentation, remote or on-site. Get a quote.
- External Penetration TestingExternal penetration testing of your internet-facing perimeter by a PCI QSA company: VPN, email, web and cloud, mapped to PCI DSS 11.4.3. Get a fixed quote.
- Penetration testing costPen test cost in the UK for 2026: published day rates and penetration testing price ranges by test type, what drives cost, and how to get a fixed quote.
- Penetration testing quoteScope your test types and asset counts and get a fixed-price penetration testing proposal.
Free consultation
Talk to an assessor
We aim to reply within one working day, and send a fixed quote once your scope is confirmed.
- PCI SSC-approved QSA, QPA, CPSA, P2PE and 3DS assessors
- IASME-licensed Cyber Essentials certification body
- Clients across the UK, US, Europe, Middle East and Asia since 2012
“The Cyber Security Services were delivered on time and price was competitive.”
Call +44 161 523 5276
Email [email protected]