Red Team - Advanced Attack Simulations
Red team testing is a controlled attack simulation in which the nFlo team acts like an APT adversary: OSINT, social engineering and physical access attempts. Red team exercises show whether the people, processes and technology of your organization detect the attack and respond before the adversary reaches its objective.
Describe your scope — your account manager will reply within 24 hours.
- Free quote
What is red team testing?
Red team testing (a red team exercise) is a controlled attack simulation: an authorized group emulates a potential adversary, and an exercise under real-world conditions provides a comprehensive assessment of the organization’s security capabilities — this is how NIST describes it. Under the TIBER-EU framework, the test mimics the tactics, techniques and procedures of real-life attackers and covers people, processes and technologies; its outcome is not “passed” or “failed”, but a picture of strengths and weaknesses.
Contact your account manager
Discuss Red Team - Advanced Attack Simulations with your dedicated account manager.
You have tools, but can you detect an attack lasting months?
Full-scale APT attack simulation
OSINT & Recon
Reconnaissance like a real adversary - people, systems, vulnerabilities
Multi-vector Attack
Phishing, vishing, physical access - all vectors simultaneously
Business Objective
Scenario execution - from access to data exfiltration
What Are Red Team Operations?
Red Team is an advanced, multi-week cyberattack simulation conducted by a team of experts who act like real adversaries (APT - Advanced Persistent Threat), using OSINT, social engineering, physical penetration and hacking techniques to test the organization’s ability to detect and respond to a real attack.
| Attribute | Value |
|---|---|
| Difference vs pentest | Multi-week operation vs a test lasting a few days |
| Techniques | OSINT, phishing, vishing, physical access, APT TTPs |
| Framework | MITRE ATT&CK |
| Duration | Weeks — depending on objectives and scope |
| Price | from €12,000 (as of 2026) |
nFlo conducts Red Team operations for companies in Poland, simulating advanced APT attacks and verifying the organization’s ability to detect long-running, multi-month adversary operations.
Attack Detected After Months - Data Already Leaked
This is a scenario a Red Team operation lets you test before a real adversary carries it out: attackers have had access to financial systems, executive mailboxes, and R&D documentation for months, and the organization finds out by accident - for example from an external compliance auditing firm.
Without Red Team operations:
- You don’t know if your SOC will detect a multi-month APT operation
- You have a false sense of security from pentests (which last a week, not months)
- You don’t test incident response procedures under real conditions
- You don’t know how employees react to social engineering
Simulation Like a Real Adversary - No Shortcuts
This is not a pentest on steroids. It’s a multi-week operation conducted like a real APT attack. We use the same techniques as ransomware and espionage groups. Only C-level knows about the operation - the rest of the organization is the target.
What you get:
- OSINT reconnaissance - we find everything an attacker would find about your company
- Initial access attempts through phishing, vishing, physical penetration testing
- Full kill chain execution - from access to data exfiltration
- Detection capability verification - what SOC detected, what it missed, why
- IR procedure test - how quickly and effectively you respond to alerts
- Report with recordings and detailed attack timeline
Who Is It For?
This service is for you if:
- You have a SOC or SIEM and want to check if it actually detects threats
- You’re a critical entity (NIS2) and must test APT resilience
- You’ve passed many pentests but want to test yourself in a real scenario
- The board asks “are we secure?” and you want an honest answer
Red Team vs Pentest
How Do They Differ?
| Aspect | Pentest | Red Team |
|---|---|---|
| Objective | Find as many vulnerabilities as possible | Achieve business objective (like an attacker) |
| Scope | Defined systems/applications | Entire organization (tech + people + physical) |
| Duration | A few days to a few weeks | Weeks to months |
| Organization awareness | IT and security know about the test | Only C-level - others don’t know |
| Methods | Mainly technical | Tech + social + physical + OSINT |
| Stealth | Unimportant - we look for everything | Critical - undetected as long as possible |
Methodology
Red Team Operation Phases
We describe the phases of a Red Team operation using the Cyber Kill Chain model developed by Lockheed Martin. We map the techniques used in each phase to the tactics and techniques of MITRE ATT&CK - a globally accessible knowledge base of adversary behavior based on real-world observations. The seven phases of the Cyber Kill Chain:
- Reconnaissance - OSINT, employee reconnaissance, suppliers, technology
- Weaponization - preparing custom payloads bypassing AV/EDR
- Delivery - phishing, vishing, physical access, supply chain
- Exploitation - exploiting vulnerabilities, configuration errors
- Installation - persistence, backdoors, C2 implants
- Command & Control - remote control, exfiltration channels
- Actions on Objectives - objective execution (data exfiltration, ransomware simulation)
Example Attack Objectives
We define objectives together with you. Typical scenarios:
- Data Breach - exfiltration of customer, financial, IP data
- Ransomware - access to backup, DC, critical systems (without encryption)
- Espionage - access to executive mailboxes, strategic documentation
- Sabotage - access to OT/SCADA systems (without sabotage, only access demo)
TLPT under DORA and TIBER-EU
TLPT (threat-led penetration testing) is advanced testing that the DORA regulation imposes on some financial entities. Who is covered is decided by supervisors: competent authorities identify the financial entities that are required to perform TLPT (Article 26(8)). Identified entities carry out TLPT at least every 3 years (Article 26(1)).
The Red Team operation described on this page is not TLPT within the meaning of DORA. Such an exercise can precede a regulatory test or serve entities and ICT providers that the authority has not identified for TLPT. We describe nFlo’s role as an external tester in TLPT, the phases of the test under the RTS, the requirements for testers, TLPT preparation and control team support on the DORA TLPT Testing page.
Related Glossary Terms
Learn more about key concepts related to this service:
How we work
Our proven service delivery process.
Scoping
Define objectives, attack scenario, and rules of engagement
Reconnaissance
OSINT, employee reconnaissance, infrastructure, suppliers
Initial Access
Gaining first access through phishing, physical, or other vectors
Kill Chain
Privilege escalation, lateral movement, attack objective execution
Report & Debrief
Detailed report with recordings and hardening recommendations
Benefits for your business
What you gain by choosing this service.
Real Risk Assessment
Know where weak points are before attackers find them
Test People & Processes
Verify awareness and incident response procedures
SOC Investment ROI
Check if your tools detect real threats
Training Material
Concrete examples from your organization for team training
Related Articles
Expand your knowledge with our resources.
Network traffic analysis with NetFlow and IPFIX flows: what you see, what you miss and how it supports NIS2
The firewall guards the perimeter, EDR guards devices with an agent. Traffic between servers, printers and cameras inside the network falls outside both. We show what can be detected from flows alone, when you need packet capture and what network data you need within 24 hours of detecting an incident.
Read more →UEM — What Is Unified Endpoint Management and How Does It Work?
Unified Endpoint Management (UEM) consolidates the management of every device — laptops, smartphones, tablets, IoT — into a single platform. Learn how UEM works, how it evolved from MDM, and why it matters for security.
Read more →Artificial Intelligence and State-Sponsored Cyberattacks — Google's Report on AI in Cyber Operations
Google GTIG report reveals how APT from China, Iran, North Korea, and Russia exploit AI. Learn model distillation, Gemini API malware usage, and how to defend.
Read more →Frequently Asked Questions
Common questions about Red Team - Advanced Attack Simulations.
How much does a Red Team operation cost?
A Red Team operation starts from €12,000 and usually takes several weeks. For TLPT under DORA, a pre-TLPT red team starts from €35,000, and nFlo's work in TLPT as an external tester starts from €60,000. Price depends on organization size, number of locations, and attack objective scope.
How long does a Red Team operation last?
Duration depends on the operation's objectives, the number of attack vectors and the size of the organization — we set it during scoping. A Red Team operation lasts longer than a pentest because a real adversary moves quietly and step by step, and the test is meant to check whether you detect it along the way. Unlike pentests, Red Team is a multi-week operation.
What's the difference between Red Team and penetration testing?
Pentest finds as many vulnerabilities as possible in defined scope over several days. Red Team achieves business objectives (like real attackers) over weeks/months using APT techniques, social engineering, and physical access. Only C-level knows about the operation.
Can a Red Team operation damage our systems?
We operate carefully with emphasis on stealth. We avoid actions causing DoS or damage. We have rollback procedures and document every step. Before operation, we establish rules of engagement.
Can we stop the Red Team operation at any time?
Yes. You have a 'panic button' - you can stop the operation at any moment. We also prepare safe words in case your team detects us. Detection is also valuable information about defense effectiveness.
What does red team testing cover?
Red team testing covers the entire organization rather than selected systems: technology, people and physical security. The TIBER-EU framework describes this as an attack on the critical functions of an organization, i.e. its people, processes and technologies. In practice we combine OSINT reconnaissance, phishing and vishing, physical access attempts and technical attacks, and we agree the operation's objectives with you before it starts — e.g. access to customer data, executive mailboxes or backups.
How does a red team exercise work?
A red team exercise starts with agreeing the objectives, the scenario and the rules of engagement. This is followed by reconnaissance, the operation itself — from initial access to achieving the objective — and a report and debrief with the defending team. The TIBER-EU framework defines similar phases: initiation, scoping, threat intelligence, red team testing with planning and reporting, a blue team report and a remediation plan. Only a small team on your side knows about the exercise.
What do you get with red team services?
Red team services conclude with a report including recordings and a detailed attack timeline, an assessment of detection capability (what the SOC detected, what it missed and why), an assessment of incident response procedures, and recommendations for strengthening security. We discuss the results at a debrief with your team — it is material for real improvement, not a “pass/fail” grade.