Threat-Led Scenarios
Campaigns modelled on the groups that actually target your sector, with tooling and techniques mapped to MITRE ATT&CK.
Red Teaming Services
A red team assessment answers the question a penetration test cannot: if a capable adversary targeted this business tomorrow, would anyone notice in time? Veiliux emulates real threat actors against your people, process and technology, then converts every successful move into a working detection.
What the engagement covers
Full Kill Chain Operations
Initial access, persistence, privilege escalation, lateral movement and objective pursuit using living-off-the-land tradecraft.
Social and Physical Vectors
Phishing, pretexting and physical intrusion where rules of engagement allow, because real attackers ignore scope boundaries.
Purple Team Debrief
Joint replay with your SOC, detection gap report, tuned detection logic and a re-run that proves the new detections fire.
How the engagement runs
- 1
Threat modelling
Objectives, threat actors and rules of engagement agreed with a small informed group.
- 2
Initial access
External exploitation, phishing or physical entry using emulated adversary tradecraft.
- 3
Objective pursuit
Stealthy movement toward the agreed crown jewels under realistic constraints.
- 4
Purple team debrief
Every step replayed with your defenders and converted into validated detections.
- 5
Re-run
Selected techniques repeated to confirm your detection and response improvements hold.
Frequently asked questions
How is red teaming different from penetration testing?
A penetration test maximises vulnerability coverage within a defined scope. A red team assessment maximises realism, pursuing a business objective by any agreed vector while measuring whether your defences detect and respond. A penetration test asks whether your systems have weaknesses; a red team asks whether anyone would notice in time if a capable adversary set out to hurt the business.
What is included in a red team engagement?
Threat-led scenarios modelled on the groups that target your sector and mapped to MITRE ATT&CK; full kill chain operations covering initial access, persistence, privilege escalation, lateral movement and objective pursuit; phishing, pretexting and physical intrusion where rules of engagement allow; and a purple team debrief with a detection gap report and tuned detection logic.
Who inside our company knows the red team assessment is running?
Only a small white cell you nominate. Wider knowledge would distort the measurement of your detection and response capability. The white cell agrees objectives, threat actors and rules of engagement during threat modelling, so the engagement stays controlled while the rest of the organisation responds exactly as it would to a real attack.
How long does a red team engagement last?
Typically four to twelve weeks of operations, reflecting the patience of the adversaries being emulated. Operators work low and slow, using living-off-the-land tradecraft and deliberately trying to stay under your alerting thresholds. The engagement then closes with a purple team debrief and a re-run of selected techniques to confirm your detection improvements hold.
What do we receive at the end of a red team assessment?
You receive an attack narrative, a detection gap report and a prioritised hardening plan. In the purple team debrief, operators replay each successful step alongside your SOC, confirm whether it was detected, and tune the detection logic until it fires reliably. Selected techniques are then re-run to prove the new detections work.
Know exactly what your security testing should cost
Build your scope in two minutes. We send a detailed estimate and a proposed test plan to your inbox.