Real adversary tradecraft, scoped for your business.
Objective-driven engagements that emulate specific threat actors against your environment — to validate detection, response, and resilience. Not a checklist of CVEs. A structured test of whether your defenders can find us, stop us, and learn from what happened.
The difference between a pen test and a red team engagement
A penetration test answers the question: "what vulnerabilities can we find?" It is scoped by system, constrained by time, and measured by CVE count. That is useful work. It is not what a red team engagement does.
A red team engagement answers a different question: "can an attacker reach objective X using the tradecraft of threat actor Y?" The objective might be "reach the production database," "obtain credentials for the CFO's email account," or "establish persistence for 30 days without being detected." We plan the engagement around that objective, emulate the tactics and tooling of a relevant threat actor, and measure success against whether your detection and response capability caught us. The finding is not a list of vulnerabilities. It is a full attack narrative, a MITRE ATT&CK mapping, and an honest analysis of where your defenses held and where they did not.
Signs you need this
- You have a SOC or MDR provider and you have never tested whether they can detect real attacker behavior
- You have passed annual pen tests for multiple years and you are not sure what you are actually validating
- Your CISO or board is asking for something beyond a compliance-driven assessment
- You are investing in detection and response capability and want to measure its effectiveness
- A threat intelligence briefing identified specific threat actors targeting your sector
- A merger, acquisition, or major infrastructure change has significantly altered your environment
What you get
Six deliverables that together give you a complete picture of how a motivated adversary would operate against your environment, and where your defenses stopped them or did not. Every deliverable is written for two audiences: the technical team that will action the findings, and the executives who need to understand the business risk.
Threat-modeled scenarios
- Objectives defined based on your business model and actual threat landscape
- Threat actor profile selected or custom-built to reflect who is realistically targeting your sector
- Rules of engagement agreed in writing before the engagement begins
MITRE ATT&CK mapping
- Every technique used during the engagement mapped to the ATT&CK framework
- Coverage analysis showing which techniques your detections caught and which they missed
- Prioritized detection improvement recommendations tied to technique gaps
Purple team collaboration
- Optional real-time collaboration with your blue team during execution
- Detection tuning sessions where your analysts and our operators work through alerts together
- Knowledge transfer so your team understands the technique, not just the signature
Detection gap analysis
- Full accounting of which attack stages generated alerts and which passed silently
- Root cause analysis for missed detections: missing log source, tuning gap, or coverage gap
- Concrete detection engineering recommendations with example logic where applicable
Executive debrief and tabletop integration
- Written executive summary suitable for board or leadership review
- Live debrief session walking through the attack narrative and key findings
- Optional tabletop exercise built around the red team scenario to stress-test your IR process
How it works
A standard red team engagement runs 4-6 weeks for most environments. Complex environments with multiple business units, geographies, or hybrid cloud footprints typically run longer. We do not compress timelines to fit a budget; a red team that rushes the planning phase produces a poor engagement.
The engagement begins with a planning phase where we scope the objectives, agree on rules of engagement, and select the threat model. Execution follows, with the red team operating under defined constraints. The debrief phase produces all deliverables and at least one live session with your team to walk through the full attack narrative.
Engagement structure
- Week 1-2 (Planning): objective definition, threat model selection, rules of engagement, environment briefing
- Weeks 2-5 (Execution): active red team operations under agreed constraints; daily operator logs maintained
- Week 5-6 (Debrief): report authoring, MITRE mapping, executive summary, live debrief session
- Optional: purple team sessions during execution; tabletop exercise post-debrief
- Complex environments: timelines extend to 8-12 weeks; scoped during discovery call
What we ask of you
- A named technical sponsor who can authorize scope changes and receive urgent notifications
- Written authorization and rules of engagement signed before work begins
- An emergency contact available during execution hours in case of accidental impact
- Notification of any scheduled maintenance or infrastructure changes during the engagement window
Why Red Hound for red teaming
Our operators come from Fortune 500 red team programs and government-adjacent offensive security work. We write our own tooling, which means we are not constrained to commercial frameworks that your defenses already have signatures for. The goal of every engagement is to make your blue team better, not to collect a trophy. That philosophy is reflected in how we report findings and how we run debriefs.
What makes us different
- Fortune 500 red team alumni. Our operators have run red team programs inside large enterprises, which means they know what sophisticated detection looks like and how to emulate realistic threat actor behavior rather than run automated scanners under a red team label.
- Custom tooling, not commodity frameworks. We develop our own implants and tooling for engagements where commodity C2 frameworks would be caught immediately. This reflects what advanced threat actors actually use.
- Defense-first philosophy. We are not interested in running up a score of findings. We are interested in whether your detection and response capability improves after working with us. Our debriefs are structured around that outcome.
- Purple team fluent. We are equally comfortable running a black-box adversarial engagement and running a collaborative purple team session. We design the approach around what your security program needs most.
- Clear rules, documented operations. Every operator action during the engagement is logged with timestamps and rationale. If something goes wrong, you have a full audit trail. No surprises at debrief.
Frequently asked
Common questions before engaging on a red team project. More specific questions about your environment are best handled on the discovery call.
What is the difference between a red team and a pen test?
A pen test finds vulnerabilities in defined systems within a defined scope. A red team engagement tests a specific objective — can an attacker reach the payroll system, exfiltrate customer data, or maintain persistence for 60 days — using realistic threat actor techniques. Pen tests are great for compliance. Red teams are for validating your detection and response program.
How do you avoid disrupting production systems?
Rules of engagement are agreed in writing before any work begins and cover what systems are in scope, what techniques are prohibited, and what the escalation path is if we encounter an unexpected production dependency. Our operators maintain a full activity log throughout the engagement. We take a conservative approach to any action that could cause data loss or service disruption; when in doubt, we stop and ask.
Can our team observe in real time, as a purple team?
Yes. Purple team operation is one of the most valuable formats for a security team that wants to improve detection coverage quickly. In a purple team engagement, your analysts observe operator actions in real time, tune detections between technique executions, and build institutional knowledge that persists after the engagement ends. We design the pacing to match what your team can absorb.
What threat actors do you emulate?
We select the threat profile based on your sector, data types, and any threat intelligence you share. Common profiles include financially motivated ransomware affiliates, nation-state groups targeting critical infrastructure, and business email compromise operators. We can also build a custom profile based on a specific group if you have intelligence suggesting you are a target.
How do you handle findings during the engagement, before the final report?
Critical findings — actively exploitable vulnerabilities that pose immediate risk — are reported to your technical sponsor within 24 hours of discovery, not held for the final report. All other findings are documented daily in operator logs and delivered in the final report. If you want an interim briefing mid-engagement, we can schedule one during the planning phase.
Pressure-test your detection and response with adversary-grade tradecraft.
A 30-minute discovery call, no obligation. We discuss your threat model, your current detection posture, and whether a red team or purple team engagement is the right next step.