Engagement Process
From Briefing to Boardroom
Our engagements are designed to produce maximum intelligence with minimum disruption — structured to protect production environments while delivering findings that change how your organization thinks about risk.
Threat Intelligence & Scoping
We build a threat intelligence profile specific to your organization — the adversary groups actually targeting your sector, the TTPs they use, and the assets they most commonly pursue. This determines the attack scenarios, objectives, and rules of engagement for your specific engagement. No two red team exercises are the same.
Rules of Engagement & Authorization
Every engagement is governed by a written Rules of Engagement document that defines in-scope systems, prohibited techniques, emergency pause conditions, and the notification chain for unintended impact. All participants sign off before any technical activity begins. Legal authorization documentation is produced in the format required by your jurisdiction.
Covert Engagement Execution
The red team operates with only a small number of people within your organization aware of the engagement — typically the CISO and one or two senior stakeholders. The SOC, IT teams, and most security personnel operate with no advance knowledge, ensuring authentic detection and response measurement. The engagement runs over weeks, not days.
Objective Completion or Engagement Close
The engagement concludes when the red team achieves the defined objective, when the blue team detects and contains the engagement, or when the agreed engagement period ends. In all three cases, a thorough debrief documents everything that happened and why it matters.
Debrief & Knowledge Transfer
Our debrief happens immediately after engagement close: the red team walks your blue team through every technique used, every detection missed, and every detection that did fire — so that your team gains operational knowledge while the engagement is fresh. This session is as valuable as the written report that follows.
Report Delivery & Remediation Planning
The full deliverable package — executive briefing, technical narrative, detection timeline, attack path maps, and remediation roadmap — is delivered within 10 business days of engagement close. A dedicated session with your leadership team translates findings into prioritized investment decisions.
Re-test & Validation
Following remediation of critical and high-severity findings, we conduct a targeted re-test to validate that the attack paths identified are genuinely closed — not just documented as closed. This produces the evidence your regulators, insurers, and board need to confirm that findings were addressed operationally, not just on paper.
What You Receive
Deliverables Built for Every Audience
A red team engagement produces evidence and intelligence that serves your security team, your board, your regulators, and your cyber insurer — simultaneously.
01
Executive Briefing
02
Technical Attack Narrative
03
Detection & Response Timeline
04
Attack Path Maps
Visual diagrams of every attack path taken and every path available — showing the routes from initial access to objective achievement across your specific network topology. Used directly in board presentations and risk register updates.
05
Prioritized Remediation Roadmap
Every finding translated into a specific remediation action, sequenced by exploitation risk and implementation effort — with control recommendations that address root causes rather than symptoms.
06
MITRE ATT&CK Coverage Matrix
A complete mapping of your detection coverage across all tested ATT&CK techniques — showing exactly where your monitoring works, where it fails, and the specific detection improvements needed to close each gap.
07
Regulatory Evidence Package
For DORA TLPT, CBEST, TIBER-EU, and NIS2 Article 21 engagements: a structured evidence package in the format required by your competent authority — produced under GLI Secure’s ISO 17025 and ISO 17020 accreditations.
08
Re-test Validation
REGULATORY ALIGNMENT
Frequently Asked Questions
How long does a red team exercise take?
Most engagements run between 4 and 12 weeks, depending on scope and objectives. The planning phase (threat profiling, scoping, rules of engagement) typically takes 2–4 weeks. The covert engagement phase runs 4–8 weeks. Report delivery and debrief follow within 10 business days of engagement close. We do not compress timelines — a red team exercise that mirrors the operational tempo of real adversaries cannot be executed in a week.
What is included in scope?
Scope is defined collaboratively before the engagement begins and documented in the Rules of Engagement. Typical scope includes: corporate network infrastructure, internet-facing applications, email and identity systems, cloud environments, physical facilities (optional), and staff social engineering. Critical production systems, OT environments with safety implications, and specific high-risk systems can be excluded with equivalent simulated testing conducted against isolated replicas.
What happens if the red team causes unintended damage?
Every engagement includes emergency pause conditions documented in the Rules of Engagement. If any technique risks production impact, the red team pauses and notifies the white cell immediately. Our operators are experienced in distinguishing between demonstrating capability and causing operational harm — we never cross into irreversible actions without explicit authorization. GLI Secure carries appropriate professional indemnity and cyber liability insurance for all engagements.
Explore Red Team Exercises
Go Deeper
How a Red Team Exercise Works
- Learn More
01
Red Team Exercises
The overview — what a red team exercise is, how it differs from penetration testing, and the full regulatory alignment.
- Learn More
02
Book a 30-minute red team briefing. We’ll walk through your specific threat profile, the objectives most relevant to your organization, and exactly how we’d structure an engagement — before you commit to anything.
No generic templates. No off-the-shelf playbooks.
