Red & purple team exercises

• Security teams You want to know what you’d actually detect.
• CISOs You need to show management a realistic attack path.
• Regulated firms For TIBER-EU and DORA TLPT, I work as a red team operator within a qualifying provider’s team.
• Consultancies You need an operator for a client engagement. I work as a subcontractor.

The exercise starts from one of these positions, or several. We agree which at scoping.

• External initial access I look for a way in from the internet.
• Phishing Social engineering by email, only when we’ve agreed it.
• Assumed breach I start from a workstation or an account you provide, and see how far I get.
• Active Directory and Entra ID Privilege escalation and lateral movement until the agreed objective.
• EDR evasion Working around the detection tools you have in place.

I don’t do physical intrusion.

In a purple team exercise, I replay the techniques with your SOC watching. For each step we note whether it was detected, alerted or missed, and why. I then suggest new detection rules or logging where there’s a gap.

Frameworks: MITRE ATT&CK · Unified Kill Chain · TIBER-EU (as a team member only)

1. Scoping & authorization

   The objective, the starting position, dates and limits, and who on your side knows about the exercise. If the exercise includes phishing, we agree that here. We also agree whether AI tools may be used on your data: local models by default, cloud models only with your written agreement. You get signed rules of engagement and a quote before testing starts.

2. Testing

   Manual, with tooling as support. I keep a timestamped log of my actions. If I find something critical, I tell you as soon as I find it, not at the end.

3. Report & debrief

   The attack path, step by step, with proof, impact and concrete fixes ranked by risk. Then a debrief with your security team. In a purple team exercise, this is where we review the detection gaps together.

4. Retest

   Once the fixes and the new detections are in place, I verify them and update the report. Evidence stays encrypted and is deleted 90 days after the final report.

• An attack path narrative How I got from the starting position to the objective, step by step.
• A timestamped action log Your SOC can match it against its own logs.
• An ATT&CK mapping Each step of the attack is mapped to a MITRE ATT&CK technique.
• A detection gap review For each step: detected, alerted or missed, and why. With suggestions for new detection rules or logging.
• A debrief with your security team In French or English, as you prefer.

Red team / Private sector Full Active Directory forest compromise I went from an exposed website to control of every domain in the forest, without social engineering and without being detected. Read the case study

Who knows it’s happening?

A small white team on your side. The SOC isn’t told, because the point is to see how it reacts. In a purple team exercise, the SOC knows and watches.

What if you get caught?

That’s a result too, and it goes in the report. What was detected, when, and what your team did about it is part of what you get.

Is it safe for production?

Testing on production happens only within limits we agree beforehand: no destructive tests, and agreed time windows. They’re written into the rules of engagement.

Red team or pentest — which do we need?

A pentest looks for vulnerabilities in a defined scope so you can fix them. A red team exercise tests whether you’d notice an attacker reaching a goal. Before a release, you need a pentest. To find out how your detection holds up, you need a red team exercise.