Who in the organisation may know about it?

As few as possible, but at least two: someone with authority to decide and someone who can confirm, if needed, that the incident is a test. Three to five is usual. The security team is expressly not among them — otherwise you are testing their preparation rather than their reaction.

What happens if your team is detected?

That is a good result, not a cancellation. We record where and how quickly, and agree with the informed circle: either we continue with a changed approach, or the operation ends there with a clear finding.

Do you also target our staff directly?

Yes, that is part of it — but within the agreed limits and without exposing anyone. Nobody who falls for a message is named in any report. Evaluation is by area and type of attack, not by person.

Can you guarantee nothing will go down?

Nobody using real techniques can guarantee that. We contain it: methods carrying an availability risk are excluded in advance, critical systems are either off limits or touched only at agreed times, and there is a number throughout on which we stop immediately.

What does an operation cost?

Considerably more than a penetration test, because it runs over weeks and involves several disciplines. The figure only becomes reliable after the initial conversation, once objective, scope and limits are settled. We name it beforehand, not afterwards.

Offensive Services

Red Team Operations

A penetration test asks: which vulnerabilities exist? A red team operation asks something different: can we reach the design data? The payroll? The plant controls? And above all — does anybody notice while it happens?