Red team exercises
Authorised attack simulations under a signed scope, showing whether your people and tools detect and stop them.
01 · Deliverables
What you get
A penetration test asks what is vulnerable. A red team exercise asks whether your organisation notices and responds when someone pursues a goal across systems and people.
- Signed rules of engagement: targets, dates, contacts and stop conditions
- Scenarios mapped to MITRE ATT&CK, chosen from threats relevant to you
- An attack-path report with timeline, evidence and what was or was not detected
- Purple-team sessions that tune detections with your SOC
- A retest of the same attack paths once your fixes are in
02 · Process
How it works
- 01
Authorise
Objectives, scope, exclusions, dates, contacts and stop conditions are signed by the owner before any activity.
- 02
Emulate
Agreed scenarios run within the rules, step by step, with every action logged and timestamped for the report.
- 03
Review
Each step is compared with what your tools and team saw, in a report and a session with your defenders.
- 04
Retest
Once detections and fixes are in place, the same paths are run again and the results compared.
03 · Scope
Scope it now.
Answer a few questions, add your name and email, and press Send. A person at Clockborn has it at once, and you get a copy by email.
Prefer to write freely? hello@clockborn.com
04 · FAQ
Questions
How is this different from a penetration test?
A penetration test looks for as many weaknesses as possible in a defined system. A red team pursues one or a few goals, such as reaching a payroll system, across people, process and technology, and measures whether your detection and response work. Many clients do both, at different times.
What stops an exercise from causing harm?
The signed rules of engagement. They list what is in and out of scope, forbidden techniques, working hours, the contacts on each side and the conditions under which we stop at once. Nothing destructive is done, and every action is logged so it can be reviewed afterwards.
Who in our company knows it is happening?
A small control group named in the rules of engagement, usually including someone who can stop the exercise and someone who can confirm a detected event is the test. Everyone else works as normal, so the exercise measures your real response.
05 · Services
Related services
- ServicePenetration testingAuthorised testing of your applications and networks, under a signed scope, to find weaknesses before attackers do.
- ServiceManaged securityDefensive monitoring of your systems, with alerts triaged and incidents contained by people who know your setup.
- ServiceSecurity consultingAn independent view of your security weaknesses and a prioritised, practical plan to fix them.
- ServiceCompliance auditA readiness review against the data protection or security standard you must meet, with gaps and fixes listed.
06 · Software
Software it applies to
- SoftwareSIEM and SOC softwareOne place where security logs land, get correlated and turn into alerts your analysts can act on.
- SoftwareThreat intelligenceThreat feeds filtered down to what matters for your systems, then turned into detections and blocks.
- SoftwareEndpoint securityEvery laptop, server and phone accounted for, patched, encrypted and watched for signs of compromise.