CREST-Certified Red Teaming & Adversary Simulation for UK Businesses

A focused red team services engagement (1-2 attack vectors) typically takes 2-3 weeks. A full adversary simulation (multi-vector, threat-intel-led) takes 3-5 weeks. STAR-aligned and TIBER-UK structured delivery takes 5-6 weeks including the threat intelligence phase. Test duration is determined during scoping.

Focused red team engagements range £15,000-£35,000. Full adversary simulation (most commonly commissioned) £35,000-£75,000. STAR-aligned / TIBER-UK structured delivery £75,000+. UK day rates for red team operators are £1,100–£1,400 per day.

A pen test stops when one finding is proven. A red team assessment chains findings end-to-end (phishing, credential reuse, privilege escalation, lateral movement, exfiltration) to test whether your detection and response works against a goal-driven attacker. Pen testing tests vulnerabilities. Red teaming tests resilience.

Adversary simulation is the modern term for goal-driven red teaming where each test emulates the specific TTPs of real-world threat actors. Unlike a generic red team, adversary simulation profiles a known threat group (e.g., FIN7 for fintech) and emulates their actual playbook end-to-end.

We are not directly accredited under TIBER-UK or CBEST. We deliver under TIBER-UK methodology, meaning our engagement structure, threat intelligence integration, and reporting align with TIBER-UK requirements. For TIBER-UK regulated tests where the regulator requires an accredited provider, we recommend partnering with a CBEST / TIBER-UK accredited firm; we frequently support these as the threat intelligence cell or red team cell.

Yes. Every TTP we use is mapped to a specific MITRE ATT&CK technique ID (e.g., T1078 Valid Accounts, T1003 OS Credential Dumping, T1486 Data Encrypted for Impact). The final report includes a MITRE ATT&CK heatmap showing coverage and detection gaps across all 14 Enterprise tactics.

Yes. Initial access via phishing (T1566) and social engineering is part of most red team engagements. We design custom phishing campaigns, pretext call scenarios, and where authorised, physical access attempts. All social-engineering activity is pre-approved in writing during scoping.

Physical red team engagements are offered as an extension to digital red team. This includes RFID badge cloning, tailgating, dropbox deployment, USB drops, and visitor-pretext access attempts. Requires explicit written authorisation including specific buildings and time windows. Always paired with a ‘get-out-of-jail’ letter.

No. We use safe-by-default exploits and explicit damage-prevention controls. Ransomware deployment is simulated in no-impact mode (encryption deferred to a sandbox; we never encrypt customer data). Data exfiltration is to controlled test endpoints. Any potentially disruptive technique is paused for explicit white-team approval before execution.

Regulated TLPT cycles (DORA, TIBER-UK, CBEST, GBEST) require structured threat intelligence, stealth red team execution, and detection review. A focused red team engagement is excellent preparation; it identifies detection gaps and TTP coverage holes before the regulated test begins. Many of our regulated-sector clients run a focused red team 3-6 months before their CBEST / TIBER-UK cycle.

All red team operators are vetted UK or international engineers. Relevant certifications across the team include CREST CRT and CCT INF, OSCP, OSEP (Offensive Security Experienced Penetration Tester), CRTO (Certified Red Team Operator), and platform-specific specialisms. SC-cleared operators are available for regulated and public-sector engagements.

Yes. Standard NDA before any technical detail is shared. We operate under a project-specific master agreement that includes data handling, deliverable IP, and breach notification clauses. Custom MSAs and AUP terms are accepted for enterprise and public-sector clients. White-team contact list and escalation paths are agreed in writing before engagement starts.