Overview
Red teaming is one of the audit types named in CERT-In's 2025 audit guidelines, and boards of Indian banks and listed companies increasingly want to know whether their SOC would spot a real intrusion. A red team answers that with agreed objectives, such as reaching a payment switch or a customer database, and a small group of insiders who know the exercise is live. Every step runs under written authorisation, with escalation contacts on call in IST.
A red team assessment is an exercise in realism. Rather than enumerating weaknesses, a small team agrees an objective with your leadership, reaching a critical system, accessing a sensitive dataset, demonstrating fraud, and then pursues it the way a determined adversary would, choosing whichever combination of phishing, external exposure, physical access or network movement gets there with the least noise. The breadth of a standard pentest is traded for the depth and stealth of a real intrusion.
What the exercise measures is your defence as a whole. A vulnerability only matters here if it advances the objective, so the findings are not a list of issues but a story: how initial access was gained, how it was expanded, and crucially, where your monitoring saw it, where it did not, and how your responders reacted to what they did see. That makes the assessment as much a test of your detection and response capability as of your controls.
We run these engagements under strict rules of engagement agreed in writing, with named safety contacts and clear boundaries, because the activity is deliberately realistic. Throughout, we work defensively and record our actions so the exercise can be replayed. The debrief maps every step to MITRE ATT&CK and compares it against what your defenders logged, turning the result into concrete improvements for both your controls and your response.
How we work with Indian clients
- Fixed-price proposals in INR, with 18% GST shown separately on every invoice
- Remote-first delivery from Ahmedabad in IST working hours; on-site work can be discussed at scoping
- Signed authorisation, an NDA on request and agreed testing windows before any activity begins
- Reports and closure evidence shaped for RBI, SEBI CSCRF, IRDAI, DPDP, ISO 27001 and PCI DSS reviews
What's included
Our approach
- Scoping & rulesWe agree objectives, boundaries and safety contacts in writing before starting.
- ReconnaissanceWe gather intelligence to plan the quietest realistic path to the objective.
- ExecutionWe pursue the objective across vectors, recording every action as we go.
- Detection analysisWe compare our activity against what your defenders logged and acted on.
- Debrief & replayWe walk your blue team through the full timeline mapped to MITRE ATT&CK.
What you receive
- Narrative of the full attack from access to objective
- Detection and response gap analysis
- Timeline mapped to MITRE ATT&CK
- Prioritised improvements for controls and response
- Replay walkthrough with your defensive team
Standards & frameworks
- MITRE ATT&CK
- TIBER-style intelligence-led testing
- PTES
- NIST SP 800-115
- CVSS v4.0
- CERT-In Audit Guidelines 2025
Frequently asked questions
How is a red team different from a penetration test?
A pentest aims for broad coverage of a defined scope and lists every flaw it finds. A red team pursues a specific objective across any available path, stealthily, to measure detection and response. One tells you what is weak; the other tells you whether you would catch a real attacker.
Should our defenders know it is happening?
Usually only a small, named group knows, so the response you observe is genuine. We always agree safety contacts who can confirm the exercise if real alarm is raised, which keeps the test realistic without risking a real incident response being triggered unnecessarily.
Is a red team right for us yet?
It gives most value once you already have monitoring and a response capability to measure. If those are still maturing, a series of penetration tests usually delivers more, and we will say so honestly during scoping rather than sell an exercise you are not ready for.
When do red team and phishing activities run?
During Indian business hours (IST) by default. Any evening, weekend or holiday activity is agreed in writing first, and your named escalation contact can pause the exercise at any point.
Can a red team exercise count towards a CERT-In audit?
Red teaming is listed as an audit type in CERT-In's 2025 guidelines, but those audits are meant to be done by empanelled auditors, and we do not claim empanelment. Tell us at scoping what the exercise is for and we will say clearly whether our work can serve that purpose.