Red teaming & assumed breach

Red teaming is an objective-based attack simulation over several weeks that tests whether your organisation detects and stops a determined attacker. Mr Cyber agrees goals, scope and rules of engagement with you in writing, then works towards them like a real adversary, following MITRE ATT&CK, with agreed limits and a stop at any time to keep the impact on operations minimal.

Fixed price from €9,500 · 10 test days · retest included

See my fixed price

Prefer to talk first? Book a call

One phishing email, one login, then the finance share, and not a single alert.

10–25 test days10 test days in the starting price
MITRE ATT&CK+ 3 more standards
Report + debriefwithin 5 business days
Free retestwithin 60 days

Who it’s for

Organisations that already run regular pentests and fix their findings
Companies with a security team, SOC or managed detection service to test
Management that wants evidence of how well detection and response work
Organisations under NIS2 or DORA that want a realistic exercise (not a TLPT)

What we test

Objectives you choose

Access to a defined crown jewel, for example customer data or payment systems
Control over a critical business process
Reaching a defined system without being detected

Entry points agreed in the rules

Internet-facing systems
Phishing of agreed staff groups, if approved
An assumed-breach start on a prepared workstation

Detection & response

Which actions your monitoring detects
How fast alerts reach the right people
How your team responds and contains

Lessons for the organisation

Gaps between policy and practice
Joint review with your defenders, on request
Priorities for the next twelve months

See my fixed price

Prefer to talk first? Book a call

Also covered. In the same test, or as an engagement of its own.

Assumed breach & purple team

A shorter, focused variant. The test starts on a prepared workstation or with a normal user account, as if an attacker were already inside, and works towards an agreed objective. A joint purple-team session with your defenders shows what was detected and what to tune. Offered as a separate engagement.

Separate engagement, from €5,700 · 6 test days Add to my request

Phishing

Phishing of agreed staff groups, as an entry point into the exercise. It only starts with written approval from management, follows GDPR and, in Germany, involves the works council (Betriebsrat) from the start. Results are reported in aggregate, never to shame individuals.

No surcharge Add to my request

No extra fee for the topic itself. If it needs more test days, the quote shows them upfront.

How we test your defences. Five phases, one tester.

The same senior tester from first scope to retest.

test days in the starting price: 10
business days to the report: 5
days for the free retest: 60

Typically 10–25 testing days spread over 3–6 weeks, set by the objectives and rules of engagement.

Phase 1

Scope & start date

Price and start date online, or a call. NDA, signed scope and written authorisation come before any testing.

You pick the date
Phase 2

Objectives & rules

Goals, rules of engagement and emergency contacts agreed.

Before testing
Phase 3

Attack campaign

Agreed objectives pursued the way a real attacker would.

From test day 1
Phase 4

Report & debrief

Audit-ready report and ticket file, then a call.

Within 5 business days
Phase 5

Free retest

Your fixes tested again and confirmed in writing.

Within 60 days

Methodology & standards

MITRE ATT&CK
TIBER-EU (methodology reference, not a TIBER test)
PTES
CVSS 3.1

How a red team engagement runs

Red teaming starts on paper. Together with a small group from your management we agree the objectives, the entry points that are allowed, the systems that are off-limits and how to stop the exercise. Nothing starts before the written authorisation and rules of engagement are signed.

Safety first

During the exercise we work towards the objectives quietly and carefully. Actions that could affect operations need approval first. Your named contact gets regular updates and can pause or stop at any time.

What you learn

The report tells the story of the attack step by step, mapped to MITRE ATT&CK, and shows for each step whether your defences detected it. Your team sees what worked, what was missed and what to improve first.

For organisations with a baseline

Red teaming is the next step after regular pentests. If you are not there yet, we will say so in the scoping call and suggest a test that fits.

What you get

Signed rules of engagement and scope before any activity
Executive summary for management and the board
Attack narrative with timeline, mapped to MITRE ATT&CK
Detection results for each step, detected or missed
Findings with evidence, fix guidance and priorities
Debrief with management and a technical session with your defenders
Free retest of fixed findings and updated report

Always included

Free retest within 60 days
Debrief call with your team
NDA, DPA and testing authorisation with the offer
Critical findings reported the same day
Testing stops at any time on your call
Audit-ready report (PDF)
Ready-to-import tickets for Jira, ServiceNow, GitLab, Azure DevOps and GitHub
Email import for helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42

See my fixed price See the report

Pentest report · Admin & Söhne GmbH · MC-2026-025

Risk: High CVSS 3.1 · 8.1 Open · retest included

Accounting mailbox taken over, no alert raised

Microsoft 365 tenant admin-soehne.example · accounting mailbox · monitoring service

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Description

In the agreed phishing exercise, one of twelve volunteer staff signed in on a fake login page and approved the sign-in prompt that followed. The tester then had the accounting mailbox for five days: reading, sending and setting forwarding rules. The monitoring service raised no alert.

Steps to reproduce

Send the agreed exercise email to the twelve target accounts from the rules of engagement.
One target signs in on the exercise page and approves the sign-in prompt.
The tester works in the accounting mailbox for five days; the monitoring service raises no alert.

Exercise emails: 12
Sign-ins on the exercise page: 1
Reported to IT: 2
Access to the accounting mailbox: 5 days
  (read, send, forwarding rules)
Alerts from the monitoring service: 0

Business impact

Exactly the setup for CEO and invoice fraud: real invoices, real threads, changed bank details sent from your own accounting address. Five days without an alert show that detection, not just MFA, needs work.

Remediation

Use phishing-resistant sign-in (security keys or passkeys) for finance and management. Alert on new forwarding rules and sign-ins from unknown devices, and test that the monitoring service reacts. Confirm every change of bank details by phone, using a number you already know.

MITRE ATT&CK T1566 (Phishing), T1114.003 (Email Forwarding Rule), T1078 (Valid Accounts) · NIST SP 800-63B (phishing-resistant authenticators)

Fixed price from

€9,500

10 test days · report in 5 business days · retest included

Services exclusively for businesses. · What drives the price

See my fixed price

Prefer to talk first? Book a call

Frequently asked questions

How much does a red team engagement cost?

It depends on the objectives, the entry points and the length. After a scoping call you get your binding fixed price and the written offer by email. Prices start at €9,500.

Are we ready for red teaming?

Red teaming makes sense once you test regularly, fix findings and run some form of monitoring. If you have not had a pentest yet, an internal or Active Directory pentest gives more value for the budget first.

Can a red team exercise disrupt our business?

The rules of engagement define what is off-limits, which actions need approval and how to stop at once. We avoid destructive actions and stay in contact with a named person on your side, who can pause the exercise at any time.

Who in our company knows about the test?

A small, named group, usually management and one technical contact. They sign the authorisation, receive updates and can stop the exercise. The rest of the organisation is tested as it works every day.

Is this a TLPT under DORA or a TIBER-EU test?

No. A TLPT follows a formal process with a regulator and accredited providers. Our red teaming uses similar methods and is suited as preparation or as a regular exercise outside that process.

NIS2 & Compliance