Advanced Testing

Red Teaming: A Realistic Attack Simulation

A red team assessment tests detection and response across the organisation against a realistic attack, performed by senior red team specialists.

What is tested and why it matters

Evaluating organisational resilience against a realistic, multi-stage attack campaign.

Penetration testing evaluates specific systems. Red teaming evaluates the organisation. A red team assessment simulates the tactics, techniques, and procedures of advanced persistent threats across every available vector: network intrusion, application exploitation, social engineering, and physical access. The objective is not to find every vulnerability, but to determine whether the organisation can detect and respond to a realistic, multi-stage attack campaign before the attacker achieves their goal.

Standards MITRE ATT&CK, PTES, NIST SP 800-115

Attack surface Network, application, social engineering, physical access

Approach Objective-based multi-vector adversary simulation

Who needs this assessment

Organisations that benefit most.

This assessment is designed for security-mature organisations that want to measure true organisational resilience under realistic attack conditions.

Large enterprises and critical infrastructure organisations that need to measure organisational resilience

Organisations with an established Security Operations Centre or incident response team

Security-mature companies that want to validate detection and response under realistic conditions

Organisations in regulated sectors subject to threat-led testing framework requirements

Companies that have completed standard penetration testing and want to understand what a motivated, persistent attacker could achieve

Government agencies and defence contractors required to validate resilience against advanced persistent threats

Where advanced testing is applicable

Financial services: adversary simulation testing detection and response across trading and banking platforms.
Critical infrastructure: scenario-based assessments validating incident response for essential entities.
Corporate environments: physical access testing and phishing simulations measuring employee awareness.
Organisations with a SOC or incident response team seeking realistic validation of detection capabilities.

What the assessment produces

The insight and evidence delivered at the conclusion of the assessment.

Every assessment concludes with a structured report covering kill chain evidence, detection gap analysis, strategic recommendations, and technical findings. Reports are delivered through the Pentrox Portal and are available for download at any time.

A clear picture of whether a sophisticated attacker can reach critical assets and what it takes to stop them
Detection and response evaluation showing where the blue team identified the attack and where it was missed
Documented attack paths across the full kill chain, from initial reconnaissance through objective completion
Strategic recommendations for improving detection capabilities, response procedures, and organisational resilience
Portal access with findings, report downloads, and project tracking for the lifetime of the client account

How an assessment runs

Scope and Intake
Planning
Assessment
Reporting
Findings & Retest

Retesting of remediated findings is included as standard with every assessment.

Red Team Kill Chain

A realistic adversary simulation following the phases of a targeted intrusion.

01 Reconnaissance
02 Initial Access
03 Persistence
04 Lateral Movement
05 Exfiltration
06 Impact

Assessment methodology

Five phases from objective definition through strategic debrief.

Each phase builds on the previous one. Threat intelligence shapes attack planning, multi-vector execution tests organisational resilience, and detection analysis drives the strategic recommendations.

Objective definition and rules of assessment

The objective is agreed with the client. Rules of assessment define permitted techniques and excluded systems. Only a minimal set of contacts is informed.

PTES (Pre-Engagement Interactions), NIST SP 800-115 Appendix E

Threat intelligence and reconnaissance

OSINT covers exposed services, employee data, technology indicators, and supply chain links. The threat actor profile is refined based on intelligence gathered.

MITRE ATT&CK (Reconnaissance TA0043, Resource Development TA0042), PTES (Intelligence Gathering)

Multi-vector attack execution

The campaign uses MITRE ATT&CK techniques. Vectors include network, application, phishing, and physical access. Evasion and persistence are tested.

MITRE ATT&CK (Initial Access through Impact), PTES (Exploitation)

Detection and response assessment

The red team timeline is compared against SOC detection events. The report documents which stages were detected, response speed, and containment effectiveness.

MITRE ATT&CK (Detection mapping per technique), NIST SP 800-115 (Assessment)

Reporting and strategic debrief

Findings are validated by a second reviewer. The report documents the attack campaign with kill chain evidence, detection gaps, and strategic recommendations.

PTES (Reporting), NIST SP 800-115 (Reporting)

Scope and deliverables

What is included, what is excluded, and what is delivered.

The rules of assessment define the exact objective, permitted vectors, and excluded systems before the assessment begins. The lists below reflect the standard scope for a red team assessment.

In scope

Full-scope adversary simulation across all agreed attack vectors
Network exploitation including perimeter bypass and internal lateral movement
Application exploitation targeting internet-facing and internal applications
Social engineering including targeted phishing, pretexting, and telephone-based attacks
Physical access attempts including tailgating and facility entry (when agreed)
Evasion and persistence techniques simulating advanced persistent threat behaviour
Detection and response evaluation of the Security Operations Centre and incident response team
Full kill chain execution from reconnaissance through objective completion

Out of scope

Denial-of-service testing (unless explicitly agreed in the rules of assessment)
Destructive actions or permanent system modification
Systems or locations explicitly excluded in the rules of assessment
Comprehensive vulnerability assessment of all systems (the objective is the attack path, not the vulnerability count)

What you receive

Executive summary Objective, outcome, and organisational resilience assessment written for leadership.
Kill chain documentation Evidence at each stage: reconnaissance, initial access, persistence, lateral movement, and objective completion.
Detection and response timeline Gap analysis per attack stage showing detection events, response speed, and containment effectiveness.
Technical findings Each finding documented with evidence, reproduction steps, OWASP risk rating, and remediation guidance.
Portal access Real-time findings, report downloads, and project tracking through a dedicated platform.
Strategic debrief A session bringing together the red team, blue team, and leadership to align on remediation priorities.
Management report Condensed report for board-level stakeholders covering attack outcome and strategic recommendations.

Pentrox Portal report library showing the four report types available for download

See what a Pentrox report looks like before you decide

How to choose your ethical hackers

Seven questions that reveal who will really test your systems.

AI versus human in penetration testing

Where AI helps and where senior judgment stays irreplaceable.

Red teaming versus penetration testing

A pentest proves what is vulnerable; a red team tests whether anyone notices. Which one you need.

When independent assessment is the right step

An independent assessment is required ahead of an audit, a product launch, or a funding round, and the organisation needs documented evidence from a third party.

Digital platforms handle revenue, customer data, or service delivery, and the security of those platforms has not been validated by an external party.

Existing security controls have been implemented but have not been tested from an attacker perspective to confirm they work as intended.

Request a scoping call

Timeline

Illustrative durations to support planning. Confirmed in the statement of work.

The duration of a red team assessment depends on the agreed objective, the number of permitted attack vectors, and the complexity of the organisation. Red team assessments require extended timelines for realistic reconnaissance, covert execution, and persistence simulation. The calibration bands below are indicative.

Small scope 15 to 20 testing days Defined objective with two attack vectors and a bounded target environment

Core scope 20 to 35 testing days Multi-vector campaign with social engineering, detection evaluation, and persistence testing

Complex scope 35+ testing days Full-scope adversary simulation across a large enterprise with extended persistence and evasion testing

Report delivery 5 business days Initial report and management report are delivered shortly after testing is completed.

Follow-up assessment Available separately A follow-up assessment to verify remediation effectiveness can be arranged. Scope and timeline are agreed separately.

What determines duration

Complexity of the agreed objective and the number of permitted attack vectors
Size and complexity of the target organisation and its infrastructure
Whether social engineering and physical access vectors are included
Maturity of the security operations and detection capabilities to be tested
Whether evasion and persistence simulation is required over an extended period

Actual duration is confirmed during scoping and depends on objective complexity and permitted vectors. A statement of work confirms the exact scope and timeline before the assessment begins. The final report is delivered within five business days after completion of testing.

Why Pentrox

The operational standards behind every red team assessment.

These operational standards apply to every red team assessment Pentrox delivers, regardless of scope or objective complexity.

Multi-vector attack simulation

Network, application, social engineering, physical. All vectors, one campaign.

The red team operates across every available attack vector rather than testing each in isolation. Advanced persistent threats combine technical exploitation with social engineering and physical access.

Objective-based, not scope-based

The goal is to reach a defined objective, not to enumerate every vulnerability.

The assessment pursues a specific objective agreed with the client. The red team selects the most realistic path and adapts as defences are encountered. Vulnerability count is not the objective.

Full kill chain execution

From reconnaissance through persistence, lateral movement, and objective completion.

The assessment follows the full attack lifecycle as defined by the MITRE ATT&CK framework. Each kill chain stage is documented with evidence for defence gap analysis.

Portal-delivered results

Findings visible as they are identified, not weeks later in a PDF.

The Pentrox Portal provides findings tracking, report downloads, and project status visibility. Published findings appear as the assessment progresses. Reports are available for download immediately.

Senior-led testing

Every assessment is performed or supervised by experienced ethical hackers.

Pentrox does not delegate assessments to junior testers. Team members hold industry-standard certifications (OSCP, OSCE, OSWE, eWPTX, eMAPT, CPTS, CWES, BSCP) and every report passes internal quality review.

Frequently asked questions

Practical answers for security teams and procurement officers.

How does red teaming differ from a penetration test?

A penetration test identifies technical vulnerabilities within a defined scope and system boundary. A red team assessment simulates a realistic, multi-stage attack campaign with a specific objective. The red team operates across all permitted vectors and evaluates detection and response capabilities alongside technical controls.

Is the methodology aligned with recognised frameworks?

The assessment follows the MITRE ATT&CK framework for technique classification and PTES for structured testing methodology. NIST SP 800-115 Appendix E is used as an additional reference for planning and execution. Standards references are documented in the report.

How is follow-up testing handled after remediation?

Red team assessments produce strategic findings (detection gaps, kill chain evidence, response blind spots) that do not map to per-finding retesting. A follow-up assessment to verify remediation effectiveness can be arranged. The scope and timeline are agreed separately.

What clearances do the testers hold?

All Pentrox employees undergo PES (Personnel Screening) background checks upon commencement of employment. Team members hold one or more industry-standard certifications such as OSCP, OSCE, OSWE, eWPTX, eMAPT, CPTS, CWES and BSCP. Every assessment is performed or supervised by senior penetration testers.

Does the assessment include social engineering and physical access?

Social engineering (phishing, pretexting, telephone-based attacks) and physical access attempts (tailgating, facility entry) can be included as part of the multi-vector campaign. The specific vectors are agreed in the rules of assessment before the assessment begins.

How is production impact managed during the assessment?

All testing is performed in a controlled, non-destructive manner. The rules of assessment define escalation contacts, excluded systems, and the conditions under which activities are paused. Critical findings are escalated immediately through the channel agreed at kickoff.

How is assessment data handled and who has access to findings?

Findings, reports, and project data are stored in the Pentrox Portal, hosted on a dedicated VPS in a datacenter in the European Union. Access is controlled through mandatory two-factor authentication and role-based permissions. The client manages team membership. Data remains accessible for the lifetime of the client account and is removed only on explicit request.

Is the report delivered in Dutch or English?

Reports are delivered in English by default. Dutch-language reporting can be arranged when required. The statement of work confirms the reporting language before the assessment begins.

What is red teaming?

Red teaming is a realistic attack simulation. A team of ethical hackers tries to reach a goal agreed in advance, for example access to customer data or the payment system. The team uses several routes at once: technical, by e-mail or through physical access. Only a small group inside your organisation knows about it. The result shows whether your detection and response work, not only whether a vulnerability exists.