The engagement
Built for the reason you are testing.
Some organisations want an honest test, with no framework attached. Others need the exercise to stand up under TIBER-EU, DORA, or the duty NIS2 places on essential and important entities. The adversary behaviour is the same. The wrapper changes.
Freestyle
One objective and a set of rules. No prescribed playbook. The path is the one an attacker would actually take.
TIBER-EU
Intelligence-led and controlled, with a white team overseeing the exercise. For financial entities that need that pattern.
DORA
Threat-led testing where a financial entity is in scope of the regulation’s testing duty.
NIS2
Not a red-team standard by itself. An engagement can still show that an essential or important entity can withstand an attack.
Red teaming
An independent, covert engagement.
Red teaming is done without the defenders in the room. Only a white team knows it is underway. Everyone else meets it the way they would meet an attacker. The scenario changes with the organisation: a person, an exposed service, a credential, then the path toward something you cannot afford to lose.
Outside in
No pre-arranged foothold, unless the objective requires one. Entry is the way an attacker would enter.
A real objective
The work follows the path through movement and privilege to a specific outcome. It is not a scanner report.
Your scenario
Freestyle, or shaped to the regulation. The tactics are chosen for the environment, not lifted from a generic catalogue.
Purple teaming
A collaborative test of your SOC.
Purple teaming is the engagement you book when the defenders should be in the room. Operators and the blue team look at the same actions while they happen. You see whether the security stack detects them, and whether your people can decide in time. It is the direct, cost-effective way to improve a SOC: the lesson is learned during the exercise, not in a report weeks later.
Booked, and bounded
A defined engagement. Scope, dates, and who must attend are agreed before it starts. To be added: the usual length.
Your people, your tools
The SOC works beside the operators, in the controls you already run. Detections are tuned while the activity is still on the screen.
Cost, spent on the lesson
Assumed breach, unless the scope says otherwise. Time goes into detection and decision, not into a long covert approach.
What clients say
Testimonials
To be added: a client comment on a red team engagement, with name, role, and organisation.
To be added: a client comment on a purple team engagement with their SOC, with name, role, and organisation.