Expert service
Test the defence, not one system.
A red team pursues a goal, such as reaching customer data, the way a real attacker would, and shows whether your team notices.
Why teams book this test
- You have defences.Find out whether your team notices a real attacker, and how fast.
- The board asks if you are ready.Answer with a timeline of what we did and what you caught.
- Your last pentest was clean.A red team tests people, process and technology together.
What we test
- External reconnaissance and initial access
- Phishing and social engineering, on agreement
- Active Directory and identity attacks
- Lateral movement and privilege escalation
- Detection and response testing with your team
- Security awareness sessions afterwards
How an engagement runs
- ScopeObjectives, rules and named contacts.
- AttackPursue the goal like a real adversary.
- DetectRecord what your team saw, and when.
- ReportTimeline, gaps and fixes.
- DebriefWalk your teams through it.
Repeat each year, and compare the results.
Why experts
What you receive
Real people run the exercise, measure how your team responds and sign the report as an independent third party.
- An attack timeline, from first access to the objective
- What your team detected, and what it missed
- Every finding with evidence, impact and a fix
- An independent third-party report. Reports your ISO 27001 or SOC 2 auditor can use as evidence.
- A debrief with your security and IT teams
The usual exercise, minus the usual pain.
Typical provider
- PriceDay rates that grow with the job
- GoalA list of scanner findings
- DetectionNot measured
- HandoverA PDF in your inbox
- Next timeStart again from zero
Cerberon experts
- PriceA fixed quote after a 30-minute call
- GoalOne objective, pursued like a real attacker
- DetectionWhat your team saw, and how fast
- HandoverA debrief with your security and IT teams
- Next timeYour detection gaps carried into the next exercise
Questions about this service
How is red teaming different from a penetration test?
A penetration test finds as many issues as possible in a defined scope. A red team pursues one objective across your whole organisation and tests whether you detect and respond.
Is social engineering included?
Only when you agree to it in the rules of engagement, and always with named contacts who can stop the exercise.
Tell us what you need tested.
A 30-minute scoping call, then a fixed quote.