Red Team for enterprises: real attack simulation against your defenses
Red Team is an offensive security exercise in which specialists simulate a real adversary — with a defined objective, multiple vectors (network, application, people, physical) and TTPs mapped to MITRE ATT&CK — to measure whether the company can prevent, detect and respond to an attack. Unlike a pentest, the target is not the vulnerability but the resilience of the defense.
What is Red Team?
A Red Team service is a goal-based adversarial operation, run covertly and without a fixed script, in which Berghem operates as a real attacker against your people, processes and technology. Instead of enumerating as many vulnerabilities as possible, the Red Team picks a business target — customer data, the payments environment, intellectual property — and demonstrates the full path to it, combining technical, human and physical vectors.
The goal is not just to break in, but to measure the prevention, detection and response capability of your Blue Team and SOC. Every tactic, technique and procedure (TTP) is mapped to MITRE ATT&CK, and you receive the attack timeline, the matrix of what the SOC saw or missed and prioritized recommendations to close the gaps. It is the difference between assuming the controls work and proving, with evidence, how they behave against a persistent adversary with time, creativity and clear objectives.
For financial institutions, hiring a Red Team reinforces the cyber resilience required by BACEN and produces evidence useful for audit and the incident-management program.
What's included
Red Team vs Pentest vs EHT: what's the difference?
The three approaches are complementary and answer different questions. A pentest seeks technical breadth within a defined scope; Berghem's EHT (Ethical Hacking Test) starts from an adversarial objective and chains flaws to business impact; a Red Team simulates the full adversary and measures the resilience of the defense.
| Criterion | Pentest | EHT | Red Team |
|---|---|---|---|
| Question it answers | Where am I vulnerable? | What path would an attacker take to my business? | Does my defense work under a real attack? |
| Scope | A defined asset or system (application, network, API, cloud) | Defined scope, with an attack chain built from an adversarial objective | The whole organization: network, application, people and physical |
| Vectors | Technical | Technical, chained to impact | Multiple: technical, human and physical |
| Defense team | Aware of the test | Aware of the test | Not warned — only the sponsor knows |
| Duration | Short, defined window | Window defined by tier (Silver, Gold, Diamond) | One-off (defined window) or continuous (RTaaS) |
| Outcome | Prioritized list of vulnerabilities | Attack chains with business impact and remediation | Measure of prevention, detection and response + SOC detection matrix |
| When to use | Technical coverage and recurring compliance | Validate whether chained flaws reach the business | Test the resilience of the defense against a real adversary |
EHT is Berghem's penetration test, structured from the attacker's objective — see the Ethical Hacking Test (EHT) service and the full Offensive Security pillar, which brings together pentest, EHT and Red Team.
How does a Red Team exercise work?
We follow the lifecycle of a real attack in six phases, aligned to MITRE ATT&CK — from the rules of engagement to the debrief with the Blue Team — with a secure channel to the sponsor throughout the operation.
Rules of engagement and objectives
With the sponsor we define the exercise's business objectives — access to customer data, the payments environment, a critical process —, the boundaries, safeguards, secure communication channel and success criteria. Nothing starts without signed rules of engagement (RoE).
Reconnaissance and OSINT
Open-source intelligence gathering on the organization: domains, exposed services, leaked credentials, suppliers, key people and routines an adversary would exploit. This is the phase that turns the company into a mapped target.
Initial access: phishing, vishing and exploitation
Gaining the first foothold via targeted phishing and vishing, exploitation of exposed services, leaked credentials or physical access — or a direct start in an Assumed Breach scenario from an already-compromised host.
Persistence and lateral movement
Privilege escalation, credential harvesting, lateral movement between systems and establishing persistence, always trying to stay below the radar of detection and response controls.
Actions on the objective
Controlled demonstration of impact by reaching the agreed objective — with evidence, without causing downtime and with prior validation of any sensitive action with the sponsor.
Debrief and Purple Team
TTP-by-TTP replay with the Blue Team and SOC: what was seen, what went unnoticed and why. Every gap becomes a detection use case, and the exercise can evolve into a collaborative Purple Team cycle.
TTPs and MITRE ATT&CK from Threat Intelligence: how do we choose the adversary?
A Red Team is only realistic if the simulated adversary is plausible for your sector. That is why we start from Threat Intelligence: we identify the groups and campaigns attacking companies like yours in Brazil and Latin America, extract their tactics, techniques and procedures (TTPs) and map them to MITRE ATT&CK before planning the operation — instead of applying a generic checklist disconnected from your risk context.
Our Threat Intelligence service feeds this emulation plan, and the same mapping is reused in the debrief: every technique executed corresponds to an existing detection or to a concrete gap in the SOC.
For threats to AI systems, we extend the mapping to MITRE ATLAS and the Promptware Kill Chain.
Which Red Team models exist?
We tailor the format to your maturity level and objective — from a one-off operation to a continuous program. Organizations that are starting out usually prefer Assumed Breach; mature teams get more value from a full campaign or the continuous model.
One-off Red Team (4–8 weeks)
A complete operation with a beginning, middle and end: reconnaissance, initial access, lateral movement and actions on the objective, followed by a debrief. Suited to measuring the resilience of the defense in a closed cycle.
Assumed Breach
Assumes the perimeter has already been breached: we start from an internal host or credential to assess how far an attacker would get and how quickly they would be detected and contained. Reduces time and focuses the exercise on detection and response.
Continuous Red Team (RTaaS)
Red Team as a Service: recurring campaigns throughout the year, with rotating objectives and TTPs updated from Threat Intelligence, to keep pace with the SOC's evolution and changes in the environment.
Red Team for AI
Adversarial simulation against AI and LLM systems — prompt injection, jailbreak, data leakage and agent abuse. Complements the corporate Red Team when AI is already part of critical processes.
Deliverables: what do you receive at the end of the exercise?
We don't deliver a generic list of flaws: we deliver the real measure of your ability to prevent, detect and respond to an attack, with a plan to improve it.
Executive report
The attack narrative for leadership: objective, path taken, impact demonstrated and the real measure of the organization's prevention, detection and response.
Attack timeline
Full TTP-by-TTP timeline mapped to MITRE ATT&CK, with evidence for each step — from reconnaissance to actions on the objective.
SOC detection matrix (seen / not seen)
For every technique executed: whether the SOC saw it, when it saw it and what it did — or why it missed it. Direct input for new use cases in the SIEM, the EDR and response playbooks.
Remediation plan
Risk-prioritized recommendations covering technical controls, processes and people — ready to drive security investment and support audit requirements.
Retest
Re-execution of the techniques that went unnoticed to prove that the fixes and the new detections work in practice.
When should you hire a Red Team?
A Red Team delivers the most value when the organization already fixes the flaws found in pentests, has a SOC or monitoring service in operation and wants to know whether that structure works under a real attack. If there is no recurring pentest yet, start with EHT; if there is, Red Team is the natural next step. Beyond maturity, three compliance triggers usually motivate the engagement:
See how Red Team fits the BACEN requirements for financial institutions.
Why hire Red Team with Berghem?
Experienced operators, an adversary emulated from real intelligence and a debrief that turns every missed detection into a concrete improvement.
Experienced operators
Our team combines recognized offensive certifications with hands-on experience in financial, industrial and technology environments across Brazil and Latin America, operating within strict, ethical rules of engagement.
Emulated adversary, not generic
We model the exercise from threat intelligence relevant to your sector, emulating the groups and TTPs most likely to target your organization — instead of a generic checklist disconnected from your risk context.
Replay with the Blue Team
At the end, we run a TTP-by-TTP replay session with your defense team, turning every missed detection into a concrete improvement use case in the SIEM, the EDR and response playbooks.
Actionable report
You receive the attack timeline, MITRE ATT&CK mapping of the TTPs, the SOC detection matrix, evidence and a risk-prioritized remediation plan — ready to drive investment and support audit requirements.
Which services complement Red Team?
Red Team combines disciplines we also offer independently. Explore the services that support and complement the exercise:
Offensive Security
The pillar bringing together pentest, EHT and Red Team.
Pentest (EHT)
Penetration testing driven by the attacker's objective.
Social Engineering
Phishing, vishing and human vectors used in Red Team.
Threat Intelligence
Threat intelligence that feeds the exercise's TTPs.
Incident Response
Containment and recovery after the adversary is detected.
Red Team for AI
Adversarial simulation against AI and LLM systems.
Financial Services
Red Team and compliance for BACEN-regulated institutions.
Red Team frequently asked questions
What is Red Team?
What's the difference between Red Team and pentest?
What is an Assumed Breach scenario?
How much does it cost to hire a Red Team in Brazil?
Does Red Team help meet regulatory requirements?
Ready to test your defenses against a real attack?
In a 30-minute conversation we define the objectives, model and rules of engagement for your Red Team exercise — from Assumed Breach to a continuous program. Request a proposal with your scenario.
Request a Red Team proposal