What is red teaming?
Red teaming
Red teaming, also known as a red team assessment, simulates realistic cyberattacks on your company. The Blue Team refers to the defenders.
Through this simulation, you test your cyber resilience using customized attacks similar to those carried out by real attackers.
This process tests not only individual systems, networks, or applications, but also the associated processes and the employees involved.
To give you an insight into our successfully completed projects and our expertise, we have compiled a selection of anonymized client testimonials for you.
Red Teaming Reference Projects
Industry:
Banking / Finance
Position:
Project Manager
Areas of Responsibility:
- Planning, execution, and highly successful completion of a TIBER-DE test
- White Team Lead
- Extensive selection of external providers for threat intelligence and red teaming
- Primary responsibility for the bank’s IT security
- Monitoring and managing the external red team
- Daily collaboration with the external red team, threat intelligence team, and the Bundesbank
- Continuous monitoring and management of risks to the production environment during red teaming
- Preparation and implementation of so-called “leg-ups”
- Creation of stories & cover stories (e.g., fake identities) and processes to keep the Blue Team in the dark about the TIBER-DE test without increasing the bank’s risk
- Coordination with all internal stakeholders (CRO, COO, CIO, DSB, Compliance, etc.)
- Scenario selection
- Preparation and review of test reports for the Red Team, Threat Intel, Blue Team, and BaFin
Industry:
Banking / Finance
Position:
Employee
Areas of Responsibility:
- Participation in Red & Blue Team Assessments as part of TIBER-DE in the Blue and Purple Teams
- Risk analysis and assessment of the current security situation regarding published vulnerabilities, taking into account attack scenarios, threat activity, and available malicious code
- In-depth analysis of cybersecurity incidents and investigation of IT security events
- Coordinating and implementing measures to contain identified security incidents as part of incident response procedures and in collaboration with relevant departments
- Collection and analysis of evidence, such as logs and data, during IT security events, in accordance with forensic best practices
- Conducting root cause analyses and “lessons learned” to continuously improve incident response processes and the monitoring and evaluation methods used
- Further development of playbooks for analyzing IT security incidents and standard operating procedures
- Improvement and further development of SIEM use cases to reduce false-positive events
- Onboarding and integrating log sources from the information system landscape into a centralized SIEM solution (Splunk / QRadar) and performing regular “health checks”
- Analysis (target vs. actual comparison) of existing security signatures and activation of new ones for the central NIPS solution, as well as assessment of protection requirements for network zones
- Risk assessment of new firewall requests in the context of network security
Our experts are fully certified
Red Teaming Attack Vectors
During the Recon/Threat Intelligence phase, an external assessment is conducted to determine how vulnerable your attack surface is.
The weaknesses uncovered during the analysis phase are “exploited,” and the so-called information gathering phase begins within the internal network, during which all information that can be used for further propagation is collected.
If higher privileges are required, a so-called “privilege escalation” is performed to gain, for example, administrative privileges.
Once this is achieved, the attacker moves “laterally” within the network to target additional systems.
The attacker’s primary goal is to establish a “persistent” presence in your network without causing any negative impact on your network and while remaining undetected.
The Champions League of Red Team Tests
TIBER-DE - TLPT Red Teaming
Let external professional hackers (in a controlled environment) test your company’s defenses. This is the only way to ensure that the security measures you’ve implemented are truly effective. Pay very close attention to their experience and professionalism, because even the smallest mistake can seriously jeopardize your company’s operations.
We have extensive experience in this area and can assess your security, particularly using the TIBER-DE framework (the “Champions League” of red team testing frameworks).
During a TIBER-DE test, comprehensive attacks on your production environment—tailored specifically to your company in collaboration with the Bundesbank—are coordinated and executed.
The added value you’ll gain from this test is greater than that of any other method.
Contact Us
Frequently Asked Questions About Red Teaming
Red Teaming is a realistic, targeted attack simulation that covers all levels—technology, people, and physical access. A specialized team acts like real attackers, usually covertly, to test whether your organization can detect and defend against targeted attacks.
A penetration test examines a defined system as thoroughly as possible for vulnerabilities. Red teaming is broader in scope and more covert: It measures your Blue Team’s actual detection and response capabilities against a targeted attack. A penetration test evaluates security, while red teaming evaluates defensive capabilities.
TIBER-DE is the German framework for threat-led red team testing, primarily in the financial sector. The tests are based on real-world threat intelligence and evaluate critical functions under realistic attack scenarios—and are compatible with DORA.
Red Teaming is suitable for organizations with established security measures and a Blue Team or SOC—such as banks, insurance companies, KRITIS, and large enterprises. For an initial maturity level, a penetration test is often the better starting point.
A red-teaming project includes defining targets and gathering threat intelligence, conducting covert attacks through multiple channels, coordination by a white team, and an evaluation that incorporates blue-team feedback and specific improvement measures.
Look for experienced, certified experts (e.g., OSCP, OSEP, CRTP) with verifiable project experience—ideally with knowledge of frameworks such as TIBER-DE. Our team is appropriately qualified, and our qualifications are clearly documented.
Red teaming is more complex than a traditional penetration test; the price depends on the objectives, scope, and duration. After the scoping phase, you’ll receive a firm quote. Get in touch, and we’ll discuss your scenario.