How is red teaming different from a penetration test?

A penetration test aims for coverage: find as many weaknesses as possible in a defined scope, usually with the technical team aware. A red team exercise is objective-based and evaluates detection and response as much as technical weakness. They answer different questions and are often used together rather than as alternatives.

Does the security team know it is happening?

That is a scoping decision. Limiting awareness produces a more realistic view of detection and response; wider awareness makes the exercise safer and more collaborative. Either way a small set of authorizing stakeholders always knows, so activity can be stopped or attributed immediately. Purple Team Services are designed around this exact kind of real-time collaboration between attackers and defenders.

Is this safe to run against production?

Exercises operate under agreed rules of engagement with defined boundaries and stop conditions, and objectives are demonstrated rather than carried through to damage. Anything with genuine operational risk is either excluded or explicitly agreed in advance.

What if we are detected early?

That is a legitimate and useful outcome, not a failed exercise. Early detection is evidence the controls and the team worked. The exercise can then be adjusted — for example resuming from an agreed position — to keep evaluating the later stages.

How long does a red team exercise typically take?

Duration depends on scope: the complexity of the agreed objective, the breadth of systems and locations involved, and whether physical or social-engineering elements are included. Timelines are agreed as part of scoping.

OFFENSIVE SECURITY / ADVERSARY SIMULATION

Red Teaming & Adversary Simulation

Simulate realistic adversarial scenarios to evaluate how people, technology and security operations respond to an attack.

Talk to a Security Expert What we test ↓

A penetration test asks how many weaknesses exist in a defined scope. A red team exercise asks a different question: if a capable attacker pursued a specific objective against this organization, would anyone notice, and what would happen next. That makes the deliverable different too. The finding is often not a vulnerability — it is that an activity generated telemetry nobody alerted on, or that an alert fired and the response stalled.

An objective-based path

Each stage is an opportunity for detection. Where detection does not happen is the result.

ACCESSInitial accessEstablishing an authorized starting foothold
DISCOVERYDiscoveryUnderstanding the environment from the inside
LATERALLateral movementMoving toward the systems relevant to the objective
OBJECTIVEObjectiveReaching the agreed goal, demonstrated safely
Detection opportunity at every stage
DETECTIONDetectionWhat was observed, logged or alerted — and what was not
RESPONSEResponseHow the organization acted on what it saw

An authorized, scoped exercise. Rules of engagement, objectives and boundaries are agreed in writing beforehand.

// DEFINITION

What is red teaming?

Red teaming (adversary simulation) is a goal-oriented exercise that pursues realistic attack activity toward an agreed objective within scope, testing whether deployed security controls behave as expected, what gets logged and alerted, and how the team triages, escalates and responds once activity is seen. Rather than assuming detection coverage exists because tooling is deployed, the exercise produces a timeline of what happened, whether it was logged, whether it alerted, and what the team did about it.

Who needs it? Organizations with a SOC, mature security programs, regulated industries, businesses validating detection, teams conducting a post-incident review, and teams testing response readiness.

How TMG Security helps. TMG Security runs the exercise against an agreed objective, maps the attack paths taken and where they could have been interrupted, assesses business impact in operational terms, and closes with a joint lessons-learned review and a written report your team can act on.

// WHAT THE EXERCISE EXAMINES

What the exercise examines

// CONTEXT

What a red team exercise is for

Detection coverage is usually assumed rather than measured. Logs are collected, tooling is deployed, and the conclusion that activity would be caught follows from the presence of the tooling rather than from evidence. An exercise replaces the assumption with a timeline: this happened at this time, here is whether it was logged, here is whether it alerted, here is what the team did. That timeline is where the value is — and it is just as useful when detection works as when it does not.

// HOW TO CHOOSE

Red Teaming vs. Penetration Testing

Penetration testing is systematic: it works through a defined scope, such as an application or network, looking for as many exploitable weaknesses as it reasonably can, and reports every finding it validates. Red teaming is goal-oriented: it pursues a specific, agreed objective using realistic attack activity, and the value is in the timeline that produces, what happened, whether it was logged, whether it alerted, and how the team responded, rather than in a broad list of findings.

A penetration test asks what could go wrong in a given scope. A red team exercise asks whether the organization would notice and respond if it did. Many organizations use penetration testing on an ongoing basis to find and fix vulnerabilities, and add a red team exercise afterward to validate detection and response now that the underlying weaknesses are already being managed.

// METHODOLOGY

How an exercise runs

01OBJECTIVESAgree the goal, the scope, the boundaries and what is explicitly off limits.
02RULESDocument rules of engagement, escalation contacts and stop conditions.
03EXECUTEConduct the exercise within those constraints, recording activity and timings.
04OBSERVETrack what the environment and the security team detected at each stage.
05DEBRIEFWalk the timeline through with the defensive team side by side.
06IMPROVETranslate gaps into detection and response improvements.

// WHAT YOU RECEIVE

A report your team can actually act on.

Exact deliverables and their format are confirmed during scoping.

EXECUTIVE SUMMARY

What was assessed, what was found and what it means, written to be read by people who will not read the technical detail.

TECHNICAL FINDINGS

Each finding described with enough precision for an engineer to locate and understand it.

EVIDENCE

Reproduction detail and supporting evidence, so findings can be verified rather than taken on trust.

RISK CONTEXT

Severity considered against your environment, not only against a generic scoring table.

REMEDIATION GUIDANCE

Practical direction on addressing each finding, including where a change belongs architecturally.

RETEST / VALIDATION

Verification that addressed findings no longer reproduce, within the agreed retest scope.

// WHO THIS IS FOR

Organizations this typically applies to.

Organizations with a SOCMature security programsRegulated industriesBusinesses validating detectionPost-incident reviewTeams testing response readiness

Testing is scoped per engagement. Nothing here implies industry-specific certification or accreditation.

// WHEN THIS APPLIES

When Is an Adversary Simulation Worth Running?

01SITUATIONDetection coverage is assumedTooling is deployed and logs are collected, but nobody has tested whether an alert would fire.

02SITUATIONA SOC has been running a whileThe team is established and ready to be measured rather than trusted.

03SITUATIONPenetration tests keep passingFindings are minor, which raises the question of whether the right thing is being tested.

04SITUATIONBoard or regulator wants assuranceSomeone senior has asked how the organization would actually cope.

// RELATED SERVICES

Adjacent parts of the attack surface.

Network Penetration TestingIdentify weaknesses across authorized network infrastructure, exposed services and segmentation boundaries.VIEW SERVICE →Cloud Penetration TestingModern cloud environments introduce new identities, services and trust relationships. Assess them before those relationships become attack paths.VIEW SERVICE →AI & LLM SecurityAI systems are creating a new layer of application risk. Test models, prompts, agents, tools and data flows as part of the modern attack surface.VIEW SERVICE →Offensive Security OverviewHow the seven testing services fit together across the attack surface.VIEW OVERVIEW →

// PRICING & ENGAGEMENT

How pricing and scope are determined

There is no published fixed price for a red team exercise. Each engagement is scoped and priced individually based on factors such as the complexity of the agreed objective, the breadth of systems and locations in scope, the duration of the exercise, and whether physical or social-engineering elements are included. These factors are discussed during scoping before a quote is provided.

// FREQUENTLY ASKED

Questions we get asked before an engagement.

Discuss a Red Team Exercise

Red team engagements start with an objective and a conversation about what you actually want to learn. Tell us what you want to test, and we will shape the exercise around it.

Talk to a Security Expert Build Your Security Blueprint