Red teaming & TLPT: attack simulation for your IT security

A known threat actor has your organization in its sights. Will your security measures hold up? Red teaming is the most realistic and comprehensive test for your IT security.

Illustration: 3 Personen und Hund in relaxter Bürosituation, davor Ritter, der mit Schild einen Drachen abwehrt.

Why classic penetration tests often fall short

Classic penetration tests are an important building block, but they're limited by time, scope, and predefined assumptions. They examine clearly defined systems, within a fixed scope, based on assumptions set in advance.

Real attackers don't play by those rules. They look for the weakest link – and that's exactly where we come in. Red teaming evaluates your security as a complete system: technology, processes, and people.

Our experts know both sides – how attackers operate and what challenges defenders face.

Timo Sablowski

Principal IT-Security Consultant

In digital forensics, we see it all too often: organizations get completely encrypted – despite expensive EDR solutions. A single overlooked attack vector can lead to disaster. Only a realistic attack simulation uncovers these gaps.

Timo Sablowski

Principal IT-Security Consultant

Red teaming, purple teaming, or TLPT – what's right for when?

Red Teaming

Choose red teaming if you want to test how well your security strategy holds up against a real, unannounced attack.

Purple Teaming

Choose purple teaming if you want to systematically improve your detection logic (SIEM/EDR) and share knowledge transparently across teams.

Threat-Led Penetration Testing

Choose TLPT if you need to meet regulatory requirements such as DORA and require audit-proof documentation.

What you gain with red teaming

Uncover hidden attack paths

Broad scope, no artificial boundaries. We find attack paths that standard tests miss.

Incorporate physical security

What good is the best firewall if we can walk into your office and plug a device into your network? We test both.

Test detection and monitoring

Do your security systems (SIEM, EDR) even detect us? We use the same techniques as advanced persistent threat groups – including living-off-the-land attacks, where we abuse legitimate system tools to stay under the radar.

Train your blue team

How quickly and effectively does your team respond under real conditions? We give you the answer.

Purple teaming – working together to identify security vulnerabilities

Alongside red teaming, we also offer purple teaming. Here we don't operate independently – instead, we develop attack scenarios together with you, execute them, and evaluate your SOC's response. In accompanying workshops, we derive concrete action items.

Threat-led penetration testing under DORA and TIBER

For banks and insurers, TLPT isn't optional – it's mandatory. We know the TIBER-DE requirements and guide you through the entire process: from threat intelligence to a BaFin-compliant final report.

Guided threat intelligence: We identify the TTPs (specific attack techniques and tactics) that threat actors are currently using against your industry.
TIBER-EU methodology: Preparation, execution, and closure with the involvement of a white team.
MITRE ATT&CK mapping: Detected coverage gaps are documented according to a standard framework, making them measurable and traceable.
Regulatory-compliant reporting: Reports in line with BaFin and ECB requirements included.

How red teaming & TLPT are conducted in a controlled and safe manner

Step 1: Joint planning

The process begins with a joint planning phase involving our red team and a white team defined by you. This white team should consist of key decision-makers who oversee the engagement and are responsible for risk management. Only this group is aware that the exercise is taking place – ensuring that the responses of the blue team and all involved stakeholders can be assessed objectively.

Together we define the scope and objectives. Where applicable, findings from a prior threat intelligence report can be incorporated.

Step 2: The attack

The red team begins by gathering publicly and technically available information, then develops realistic attack scenarios based on that intelligence – using the same techniques as real-world attackers: from spear phishing and physical access attempts to living-off-the-land (LotL) methods, where we leverage existing system tools to bypass security solutions.

Throughout the process, we evaluate both the effectiveness of the attacks and the blue team's response. The white team monitors the engagement and ensures no damage to production systems occurs.

Step 3: Debrief & reporting

After completion, we optionally bring the red and blue team perspectives together in a purple team format. We discuss findings transparently, prioritize action items, and derive well-founded recommendations. Additional attack scenarios can be explored on request.

You receive a detailed report – in TIBER format if required – along with practical suggestions for advancing your defensive strategy. For those who want to go deeper: we offer targeted support through threat-informed defense or SSDLC assessments.

Certified expertise for your IT security

Red teaming requires a strong sense of responsibility and deep technical expertise. That's why our testers continuously expand their knowledge, whether through CTF competitions or certifications.

OffSec Certified Professional (OSCP+)

Certified Red Team Operator I & II (CRTO)

OffSec Certified Expert (OSCE)

Certified Red Team Expert (CRTE)

OffSec Experienced Penetration Tester (OSEP)

Certified Red Teamer (MRT)

Certified Red Team Professional (CRTP)

Frequently asked questions about red teaming & TLPT

When is red teaming the right choice and when is TLPT the better option?

Red teaming is the right choice if you want to know how well your organization detects, defends against, and responds to real-world attacks. It's especially well-suited when a solid security foundation is already in place and you want to advance your detection and incident response capabilities under realistic conditions. The focus is on creative, unconventional attack paths and the interplay of technology, processes, and people – without a primary focus on regulatory requirements.

Threat-Led Penetration Testing (TLPT) is the better option when you need to meet regulatory requirements, particularly in heavily regulated industries such as financial services or insurance. TLPT follows a clearly defined methodology (e.g., TIBER-EU / TIBER-DE) and is based on guided threat intelligence. The goal is audit-ready, supervisory-compliant evidence of your digital operational resilience – for example, in the context of the EU DORA regulation.

Is there a risk of disrupting ongoing operations?

No. The simulations are controlled and closely coordinated with your white team. Critical business processes remain protected.

Why isn't a standard penetration test enough anymore?

Pentests check the front door. Red teaming checks whether we can get in through the window or trick the janitor – this tests the entire defense chain: prevention, detection, and response.

Does the blue team need to be informed?

With red teaming, typically not, in order to test authentic responses.

In purple teaming, on the other hand, we work transparently hand in hand with your blue team.

How do you handle sensitive data?

All data is treated confidentially, stored encrypted, and securely deleted upon project completion. We treat your data as if it were our own. If preferred, we work exclusively within your infrastructure.

Do you support DORA implementation?

Yes. Our TLPTs are aligned with the TIBER-DE framework and designed to meet DORA requirements. We guide you through the entire process.

Ready for the reality check?

You know how good your security looks on paper. We show you how it holds up under real pressure.

Marc Lenze

IT-Security Business Development Lead

Marc Lenze

IT-Security Business Development Lead