Skip to content

Services · Red Team

Red Team assessments: test your defences against a realistic adversary

A Red Team exercise simulates a determined adversary pursuing a precise objective, across every vector: cyber, human, physical. Unlike a penetration test, which focuses on a technical scope, a Red Team tests your ability to detect and respond to a realistic attack. BEAROPS designs and runs these exercises with experts from the offensive security field.

Request a quote
  • Realistic scenario
  • Strict legal framework
  • Field experts
  • In French or English

To choose between the two, compare Red Team and penetration testing , or discover our penetration testing .

Which vectors does a Red Team exercise combine?

Red Team, Blue Team, Purple Team: who does what?

A Red Team exercise pits two teams against each other. The Red Team attacks, the Blue Team defends, and Purple Team describes the way they work together so that each attack technique improves detection.

  • Red Team

    The offensive team. It simulates the adversary and tries to reach the agreed objective without being detected.

  • Blue Team

    The defence team: the SOC and security staff. It detects, analyses and responds, usually without knowing that an exercise is under way.

  • Purple Team

    A way of working in which both teams collaborate, technique by technique, to improve detection in real time.

How does a Red Team exercise unfold?

A Red Team exercise generally lasts 1 to 6 months, depending on the objective, the vectors combined and the level of stealth sought: reconnaissance and covert progression take time. The duration is set during scoping, together with the rules of engagement.

  1. Define the objective

    What an attacker would really try to reach.

  2. Scope and authorise

    Rules of engagement, scope, written authorisation.

  3. Execute

    Reconnaissance, intrusion, stealthy progression towards the objective.

  4. Debrief

    Debriefing with the defence team, improvement plan.

A BEAROPS Red Team exercise follows four steps: define the objective, scope and authorise, execute, debrief.

The simulated techniques and detection findings are described using the vocabulary of the MITRE ATT&CK knowledge base, which catalogues the tactics and techniques observed among real attackers.

A high legal-risk exercise, strictly governed

What should you do between two Red Team exercises?

A Red Team exercise is one-off and in-depth. To keep up the pressure between two campaigns, Beareye’s automated Red Team continuously replays attack paths across your system. The human exercise and automated validation complement each other: one brings depth, the other permanence.

How does a Red Team most often get in?

In the Red Team exercises carried out by BEAROPS, initial access was gained through phishing in 57% of cases, by exploiting an exposed service in 17%, through physical intrusion in 9% and through other vectors in 17%. The human factor remains the main way in. No client can be identified from these figures.

Aggregated, anonymised data from 15 BEAROPS Red Team exercises over two years. Breakdown calculated on all initial accesses obtained.

Sources and references

  1. MITRE ATT&CK, MITRE

Sources consulted on . Report an error: contact+site@bearops.fr

Frequently asked questions

What is a Red Team exercise?

A Red Team simulates a realistic adversary pursuing a defined objective, combining cyber, physical and human vectors. It tests not only technologies but also the organisation’s ability to detect and respond to an attack.

How long does a Red Team exercise take?

Generally 1 to 6 months. An exercise focused on one vector and a narrow objective sits at the lower end; a multi-vector exercise, run covertly against a SOC, extends over several months. The duration is set during scoping, together with the rules of engagement.

What needs to be prepared before a Red Team exercise?

Three things determine the launch: a clear objective, meaning what an attacker would really try to reach in your organisation; a detailed written authorisation, with rules of engagement and an engagement letter; and a small circle of informed managers to oversee the exercise. The scenario and vectors are then defined with our experts during scoping.

Is a Red Team exercise legal?

Yes, provided it is strictly governed. Every exercise rests on a detailed written authorisation, rules of engagement and an engagement letter. Aspects involving people and premises are subject to specific legal precautions.

Do you need to be a large organisation to run a Red Team exercise?

A Red Team is best suited to organisations mature enough to justify testing detection and response, not just vulnerabilities. As a first step, a penetration test is often more appropriate. We advise you according to your context.

Let’s design your Red Team exercise

Describe the objective you want to put to the test. A BEAROPS expert will call you back to define the scenario, the legal framework and the quote.

Request a quote