We structure red team engagements as multi-stage exercises in which offensive and defensive teams work together, stage by stage, to validate and improve detection and response. This produces more useful outcomes for organisations that have already invested in baseline security controls.
years testing for government and enterprise
CREST-accredited through CREST ANZ
We avoid off-the-shelf red team tools, which EDR and SIEM engines know well, and use our own custom tooling to test whether your defences detect adversary behaviour at a deeper level.
Our offensive specialists also work in our managed SIEM blue team, so findings arrive as detection logic your team can use.
Our red and purple team engagements are multi-stage exercises with defined objectives at each stage. Each stage is scoped against your environment and objectives, and not all stages apply to every engagement.
Traditional red team engagements often end with a report confirming a breach was possible, with little on what the defenders detected along the way. We invert this: each stage produces a documented record of what was detected, what was missed and where the detection threshold sits. The result is a set of prioritised improvements rather than a pass or fail.
Scanning of internet-exposed assets to map external systems and perimeter boundaries. This informs later stages such as social engineering or data exfiltration.
Iterative delivery testing, first without payloads to map content filter boundaries, then with progressively modified custom payloads to find what your email and network gateways will and will not catch.
Tests whether passwordless authentication tokens can be intercepted through adversary-in-the-middle phishing and replayed from another host, and whether conditional access and identity protection detect the anomalous use.
Progressive payload capability testing that calibrates SOC detection thresholds under controlled conditions. Each iteration maps where endpoint detection starts and stops, so your blue team knows which behaviours trigger alerts.
Certificate template and identity trust assessment for exploitable misconfigurations, aligned to the SpecterOps Certified Pre-Owned research.
Targeted, throttled enumeration of Active Directory and Microsoft Entra ID, testing whether identity protection detects measured reconnaissance, not just noisy automated tools.
Post-compromise discovery of file shares, web applications, Microsoft 365 services and other data sources from an assumed-breach position: what an attacker with unprivileged access could find, reach and use.
Trusted path abuse, script interpreter gaps and DLL loading weaknesses. Tests whether your application control policies hold up against techniques that use legitimate system binaries and trusted execution paths.
Social engineering from legitimate account positions, simulating insider threat and post-compromise lateral movement. It complements our social engineering and phishing exercises.
Direct and indirect prompt injection, aligned to the OWASP LLM Top 10 and MITRE ATLAS, testing whether internal AI systems can surface data beyond an account’s access or manipulate downstream actions.
Exfiltration across email, cloud storage, DNS and HTTP, testing whether your DLP controls and egress filtering detect data leaving through both common and less obvious paths.
Our red team model operates as a purple team exercise. Activities are planned in advance and the blue team is briefed before each stage, so defenders can focus on whether their detection and response identify the activity. Every action is logged with its technique, time, duration and outcome.
The goal is calibration, not a surprise reveal.
what was detected
what was missed
how long detection took
where the detection threshold sits
This suits organisations that have been through conventional red teaming and found the outcomes limited. It supports blue team improvement with measurable evidence of which controls work. Findings are classified with MITRE ATT&CK technique references and rated with CVSS v4.0.
As part of a maturity programme, our Essential Eight assessments and CIS 18 assessments measure control effectiveness before and after red team exercises.
A common frustration with traditional red teaming is the gap between attackers and defenders: many offensive teams know how to break in but lack the operational context to help you secure the network. Our offensive specialists also spend dedicated time defending, in our managed SIEM blue team.
Because they understand alert fatigue, detection thresholds and real-world SIEM tuning, they speak your defenders’ language, and turn attack paths into detection logic your team can implement.
We develop our own payloads, proof-of-concept malware and EDR evasion techniques. Modern EDR uses behavioural analysis and machine learning as well as signatures, and knows commodity tools well, so custom tooling shows whether your controls catch novel techniques or only what they have seen before.
The value is not proving a bypass exists but producing a record the blue team can act on. We keep detailed, timestamped logs of every action, so each stage ends with a precise, evidence-based view of detection effectiveness.
A single misconfigured certificate template can let an authenticated user request a certificate as any account in the domain, without the alerts of a conventional privilege escalation. We assess templates, enrolment agent permissions, trust relationships and hybrid-cloud access, with remediation that keeps legitimate certificate use working.
For Microsoft Copilot or other internal AI systems, we test whether prompt injection can make an assistant with access to SharePoint, email or databases retrieve content the user should not reach, or act on behalf of other users. It complements our AI penetration testing service.
A penetration test targets a defined scope and seeks to identify and exploit vulnerabilities within it. Red teaming is broader: it simulates a motivated attacker operating across the whole environment, using multiple attack vectors, to test detection and response. Our red team engagements are collaborative, to get the most value from each stage.
Red teaming is most valuable for organisations that already have mature security controls and want to validate them under adversarial conditions. If you have not yet had a penetration test or addressed basic hygiene (patching, MFA, endpoint protection), a penetration test is the better starting point. We can advise which approach suits your maturity.
Scope determines duration. A typical multi-stage collaborative exercise runs over several weeks to months, with stages run in sequence, or in parallel where dependencies allow. Each stage ends with a findings review before the next begins, and we scope the engagement to your objectives and budget.
MITRE ATT&CK for technique classification, SpecterOps Certified Pre-Owned research for ADCS testing, the OWASP LLM Top 10 and MITRE ATLAS for AI-related testing, and CISA red team advisories for scenario design. Findings are rated with CVSS v4.0.
If your organisation has mature security controls and wants to validate them under adversarial conditions, or has been through conventional red teaming and found the outcomes limited, dotSec can design an engagement that produces practical results.
Not sure whether you are ready for red teaming? A penetration test may be the better starting point. We can advise based on your maturity.
