Security services · Testing

Red team operations.

A penetration test asks “what is broken?”. A red team asks “would we notice a real attacker, and stop them in time?”. We run a quiet, goal-based campaign against your organisation and show you exactly where detection and response fell short.

Get a fixed-price quote
Goal-based, like a real attackerMapped to MITRE ATT&CKPurple-team debrief with your SOC
campaign · sample● demo
  1. FOUND Phishing email reached 14 inboxes
  2. FLAGGED Foothold on a laptop for 3 days unnoticed
  3. FOUND Domain admin rights in 26 hours
  4. BLOCKED Data exfiltration attempt blocked
  5. FIXED New alert rule for this technique
In plain words

A red team exercise is a realistic, goal-based attack campaign against your organisation. Instead of finding as many weaknesses as possible, we pursue one objective, such as reaching the payment system, as quietly as a real attacker would. It tests your people, processes and security tools together, and ends with a joint debrief where your defenders learn exactly what they missed.

Duration
4–10 weeks
Framework
MITRE ATT&CK, threat-led
Includes
Purple-team debrief
Pricing
Fixed fee
A campaign, step by step

What a red team campaign looks like.

  1. AttackerThreat profile

    We study who would really attack you, and how, then agree the objective: for example, “approve a payment” or “read the customer database”.

  2. AttackerInitial access

    A targeted phishing email, an exposed service or, if agreed, a visit to the building.

  3. Your systemsQuiet movement

    From one foothold we move carefully, collecting passwords and access, avoiding your alarms where we can.

  4. Your dataThe objective

    We reach the agreed target and stop there, with proof, without harming any data or system.

  5. Your teamDetection review

    Side by side with your SOC we replay every step: what was logged, what alerted, what nobody saw.

  6. The fixThe fix

    New detections, tightened access and a short plan the board can follow. Often we rerun key steps to prove the new alerts fire.

Safety first

A small “white team” on your side knows the campaign is running and can stop it at any time. Rules of engagement are agreed in writing: what is off limits, how we handle real data we come across, and who to call if a real attacker turns up during the test.

Pentest or red team?

Different questions, different tests.

Penetration test

Breadth: find as many weaknesses as possible.

  • Defined systems, tested thoroughly
  • Your team usually knows it is happening
  • Does not test detection and response
  • Rarely includes people and physical access

Red team

Depth: reach a goal without being caught.

  • Whole organisation in scope, like a real attacker
  • Only a small white team knows
  • Tests your SOC, tools and processes end to end
  • Can include phishing and physical intrusion
How it works

Threat-led, step by step.

  1. Weeks 1–2

    Threat profiling

    Who would attack you and how, the objective, and the rules of engagement.

  2. Weeks 2–4

    Initial access

    Phishing, exposed services and, if agreed, physical entry.

  3. Weeks 3–8

    Objective pursuit

    Quiet movement towards the goal, every step logged and time-stamped.

  4. Weeks 8–9

    Detection review

    Replay with your SOC to see what was caught and what was missed.

  5. Week 10

    Debrief

    Purple-team session for defenders and a briefing for the board.

What you get

The story of the attack, and how to stop the next one.

HANULSECRed team campaign report CLIENTSample · regional bank SUMMARY FOR LEADERS FINDINGS BY SEVERITYCritical2High3Medium5Low2 MITRE ATT&CK · 18 TECHNIQUES DEBRIEF DONE Sample layout, not client data
  • 01
    Attack narrative and timeline

    Every step we took, when, and what it gave us.

  • 02
    Detection gap analysis

    What was logged, what alerted and what nobody saw.

  • 03
    MITRE ATT&CK coverage map

    Techniques used, mapped against your current detections.

  • 04
    Purple-team session

    Hands-on time with your defenders to build the missing alerts.

  • 05
    Board briefing

    A short, plain-language summary of risk and the plan.

Who it is for

For organisations ready to test their defenders.

  • Organisations with a SOC or MDR service that want to know it works
  • Banks, insurers and market entities under regulator pressure to prove resilience
  • Boards that have invested in security and want evidence of value
  • Companies that have done several pentests and want the next level

Not ready yet?

If you do not have monitoring in place, a red team will mostly confirm that nobody is watching. Start with a penetration test and a managed SOC, then red team.

Frameworks

Mapped to how real attackers work.

MITRE ATT&CKAdversary behaviour
PTESTesting method
NIST CSF 2.0Govern to recover
ISO/IEC 27001Information security

Emblems are HanulSec’s own artwork showing which frameworks our work maps to. They are not the owners’ logos and do not mean HanulSec is certified against them.

Questions

Questions buyers ask before they call us.

Q01What is the difference between red teaming and penetration testing?
A penetration test looks for as many weaknesses as possible in defined systems. A red team pursues one goal across the whole organisation, quietly, to test whether your people, processes and tools detect and stop it.
Q02Will our security team know about the test?
Only a small white team, usually two or three senior people, knows. That keeps the test realistic while giving you a way to pause or stop it.
Q03Do you include phishing and physical intrusion?
If you want them. Both are agreed in writing first, with clear limits, and staff are never named and shamed in the report.
Q04How long does a red team exercise take?
Usually four to ten weeks, depending on the objective, the size of the organisation and whether physical access is included.
Q05Is it safe?
Yes. Rules of engagement set what is off limits, we avoid any destructive action, we stop at the objective, and the white team can halt the campaign at any time.
Q06How is it priced?
A fixed fee after scoping. It depends on the objective, duration, whether phishing and physical testing are included, and the depth of the purple-team work.
Next hops

Related services

Request a quote

Scope it in two minutes.

Tell us what you need protected. A security engineer, not a salesperson, replies with a fixed-price proposal.

Start your quote hello@hanulsec.com
  • Reply within one business day
  • Free 30-minute scoping call
  • Mutual NDA before any detail is shared
  • Fixed price, free retest of fixed findings