Red Teaming
Realistic attacks on your organisation, your people and your processes, tailored to the threat actors that actually target you
Red Teaming
Red teaming is a full-spectrum security test in which a team of offensive specialists attacks your organisation the way a real adversary would. The goal is not a list of vulnerabilities. It is to find out whether your defences, your detection and your people hold up under a genuine, sustained attack, before someone finds out for you.
What we test
No two red team tests are the same
A red team test is only as valuable as its realism. That means it has to be built around your organisation, not around a template.
Every CREDS engagement starts from three inputs: your risk profile, your crown jewels, and the threat actors that are genuinely active against organisations like yours. A regional hospital faces different adversaries, different motives and different techniques than a payment institution or a logistics operator. We build the scenarios around that reality.
In practice this means we determine together which business processes and assets actually matter, we select the threat actors worth emulating, and we reconstruct their tactics, techniques and procedures rather than running a standard attack chain. Your scope, your risk tolerance and your stop conditions are agreed before anything starts.
Your risk profile
We scope around the processes and assets whose compromise would actually hurt, not around what is easiest to test.
Your threat actors
Scenarios emulate adversaries genuinely active against your sector, using their real tactics, techniques and procedures.
Your crown jewels
We agree the objectives up front, so the outcome answers a question you actually care about.
A Holistic Security Assessment
Red teaming differs significantly from traditional penetration testing in its scope and execution, encompassing technical, human, and organisational aspects. While penetration testing typically focuses on identifying vulnerabilities in specific systems, red teaming offers a more holistic view, testing how well an organisation's human elements, processes, and physical security controls can withstand an attack.
The outcome of a red team engagement extends beyond a standard report; it includes a detailed roadmap for remediation, prioritising identified vulnerabilities and suggesting actionable steps for improvement. This ensures that organisations don't just understand their weaknesses but also have clear, strategic directions for enhancing their security posture.
Your defences are part of the test, not an exception to it
Some providers scope around your security controls. We scope through them.
In every CREDS red team engagement, circumventing your defensive stack is in scope by default. That means bypassing endpoint detection and response, evading network and perimeter controls, and, where you have one, operating beneath the detection threshold of your SOC.
This matters because a test that avoids your controls tells you nothing about whether they work. Real adversaries do not request an exemption. If our operators can develop tooling that your EDR does not catch, move laterally without your monitoring raising an alert, or reach your crown jewels while your SOC stays quiet, that is a finding you need, and one you cannot get from a scan or a scoped penetration test.
Where your controls do stop us, that is equally valuable: it is validated proof that the investment is working, which is a far stronger statement than a vendor datasheet.
How a red team engagement runs
Our process is collaborative and structured, mapped to recognised frameworks including the DNB frameworks, MITRE ATT&CK and the Kill Chain. Every engagement runs in four phases.
- 01
Preparation and scoping
We start with a joint session with your team. Together we establish the crown jewels, the business processes in scope, the threat actors worth emulating, the rules of engagement and the stop conditions. Where a regulatory framework applies, the relevant managing authority is involved from this point.
- 02
Threat intelligence and scenario design
We gather intelligence on the adversaries relevant to your sector and reconstruct their tactics, techniques and procedures. From this we build the attack scenarios, tailored to your environment and your risk profile.
- 03
Execution
Our operators attempt initial access, escalate privileges, move laterally toward your crown jewels and act on objectives, all while evading your EDR, your network controls and your SOC. Every action is logged in the platform in real time, mapped to MITRE ATT&CK.
- 04
Purple teaming and closure
We sit down with your blue team and replay the attack step by step: what we did, when, what you saw, and what you missed. You receive the full report, the remediation roadmap, the attack path analysis and the clean-up list. Where useful, we support the remediation work that follows.
Who does what during the engagement
A red team engagement involves four groups. Knowing which is which, and who has the authority to stop the test, matters before you start.
Red Team
The attacking team. CREDS operators, led by a red team lead with at least ten years of red teaming experience. They work toward the agreed objectives using the scenarios built in the threat intelligence phase.
Blue Team
Your defenders. Responsible for detection and response across your networks, systems and applications. The blue team is not informed about the exercise, which is what makes the test of your detection capability real.
White Team
The link between red and blue. It consists of a small number of people from your organisation together with CREDS, and it is informed about every action the red team takes. The white team is mandated to start, pause, approve and stop the exercise at any moment. Where a regulatory framework applies, a representative of the managing authority attends these meetings.
Purple Team
Red and blue together, after the exercise. The red team replays the attack while your defenders reconstruct what they saw, so that every scenario turns into concrete improvements to detection and response.
Secrecy is what makes the exercise realistic, and control is what makes it safe. Only the white team knows the test is running, and the white team can stop it at any point.
A red team engagement, with a platform behind it
Most red team engagements are a black box. You commission the test, wait several weeks, and receive a report at the end.
Our operators work with the CREDS ART platform supporting the engagement. Everything the red team does is captured as it happens, which changes what you get, both during the test and afterwards.
Real-time findings
Your white team sees what we find as we find it, rather than in a document weeks later. Serious exposure can be acted on immediately instead of sitting undisclosed until the closing meeting.
MITRE ATT&CK mapping
Every technique we use is recorded and mapped to the ATT&CK framework, so your blue team can compare our activity directly against their detection coverage.
Attack path visualisation
The full route from initial access to crown jewels, reconstructed step by step, which makes the root cause visible rather than just the endpoint.
Clean-up list
Every artefact we place in your environment is logged as it is created: accounts, implants, persistence, files, configuration changes. At closure you receive a complete, verifiable list, so nothing of ours is left behind.
Compliance mapping
Findings are mapped to the control frameworks you report against, namely NEN 7510, ISO 27001 and NIS2, so the outcome feeds your audit and reporting obligations directly rather than needing translation.
Continuous validation afterwards
A framework test proves your resilience at a point in time. ART can keep testing between engagements, so you know whether remediation held and whether the next change reopened the path we used.
A framework test proves where you stood on the day. The platform tells you where you stand the rest of the year.
Findings map to NEN 7510, ISO 27001 and NIS2 controls, so a red team engagement produces evidence your auditors and your regulator can use, not just a technical report that someone then has to translate.
Who runs your engagement
Every CREDS red team engagement is led by a red team lead with a minimum of ten years of hands-on red teaming experience. Not ten years in security, but ten years running offensive operations.
That lead runs the engagement end to end: scenario design, operational decisions during the test, white team communication, and the debrief with your blue team and your board.
Behind the lead sits a multidisciplinary team assembled for your scenario:
Reconnaissance specialist
OSINT and deep web research to build the picture an adversary would have of you.
Exploit developer
Builds the tooling the scenario requires, including payloads engineered to evade your specific defensive stack.
Ethical hacker
Executes the intrusion and the movement through your environment.
Reverse engineer
Analyses your controls and the malware techniques relevant to your threat actors.
Social engineer
Tests the human layer where the scenario calls for it.
Certifications
Between them the team holds OSCP, OSEP and CRTE.
Engagements a year
CREDS delivers 10 to 25 red team engagements annually.
Fair play
Winning the exercise is not our objective. Producing the maximum amount of usable insight is.
That shapes how we operate. We keep your white team informed from the moment the attack begins and support your decision-making throughout. We calibrate as we go: once it is clear that your team prevents, detects and responds to a given level of attack, we raise our sophistication and keep going, because the most valuable learning happens just beyond the edge of what you can currently handle.
We will not take a shortcut that produces a dramatic finding but teaches you nothing. And if we get in, our job is not to celebrate it, it is to show you exactly how, so that the path is closed.
Choose Your Framework
Which framework applies depends on your sector and your regulator. If you are not sure which one fits, or whether you need a formal framework at all, that is the first conversation to have.
Advanced Red Teaming Framework
A Red Teaming test according to DNB's Advanced Red Teaming framework
TIBER
A Red Teaming test according to the TIBER-NL/EU Framework
ZORRO
A Red Teaming test according to the ZORRO framework
DORA TLPT
Threat Lead Penetration Testing
CREDS Red Team
A tailored red team engagement outside any formal framework, for organisations that want the exercise without the regulatory process. Scope, duration and intensity built around your maturity.
Gold Teaming
The crisis management module within the ART framework. It extends an ART or TIBER engagement to your crisis management team, so the people who decide during an incident are tested alongside the people who detect it.
What you receive
- A full report of the engagement: what we did, when, how far we got, and what stopped us
- Attack path analysis from initial access through to objective
- Every technique mapped to MITRE ATT&CK, for direct comparison against your detection coverage
- A prioritised remediation roadmap, ordered by impact rather than by severity score
- Findings mapped to NEN 7510, ISO 27001 and NIS2 controls
- A complete clean-up list of every artefact placed in your environment
- A purple teaming session with your blue team
- A findings presentation pitched at both your technical team and your board
Questions about red teaming
How is red teaming different from a penetration test?
Is our organisation ready for a red team test?
Which framework do we need: ART, TIBER, ZORRO or DORA TLPT?
Do you really try to bypass our EDR and our SOC?
Is it safe to run this against production?
Who inside our organisation will know about the test?
What is purple teaming?
How long does an engagement take?
What does this give us for NIS2, NEN 7510 or ISO 27001?
Can we stop the test once it has started?
Who leads the engagement?
Considering a red team test?
Whether you need a formal framework engagement or a tailored exercise, the first step is a conversation about your risk profile and what you actually want to find out.
Already tested? The ART platform keeps validating your defences between engagements.