A penetration test asks, “What vulnerabilities exist?” A red team engagement asks a harder question: “Could a determined attacker reach our most important assets, and would we notice?” PeakCyber’s red and purple team services test your whole security program, including technology, people and response, against realistic adversary behavior.
Red team: realistic adversary simulation
In a red team engagement, our consultants emulate a real threat actor pursuing agreed objectives, such as accessing sensitive data, reaching a critical system or demonstrating business impact. The exercise is goal-driven, stealthy and often conducted with only a small group in your organization aware of it.
Typical techniques include:
- Open-source intelligence and reconnaissance
- Phishing and other social engineering
- External and internal exploitation
- Credential theft, privilege escalation and lateral movement
- Persistence and evasion of security controls
- Physical access, where agreed
Purple team: attackers and defenders together
A purple team exercise is collaborative. We run specific attack techniques while your defenders watch, then work together to see what was detected, what was missed and how to improve. It is the fastest way to turn offensive findings into better detection and response.
Purple team work often includes:
- Emulating techniques mapped to the MITRE ATT&CK framework
- Testing SIEM, EDR and alerting coverage
- Tuning and writing detection rules
- Improving playbooks and response times
Red team or purple team?
- Red team suits mature organizations that want an unbiased test of detection and response end to end.
- Purple team suits teams building or improving detection, or wanting faster learning with direct knowledge transfer.
- Many clients start with purple team to build foundations, then run a red team to validate them.
What you receive
- Executive summary with objectives achieved and business impact
- Full attack narrative with timeline
- Detection and response assessment: what was seen, missed and how quickly
- Prioritized recommendations for controls, detection and process
- Debrief workshop with your security team
Frequently asked questions
Test your defenses against a real adversary
Talk to us about the right exercise for your maturity level.
