Adversary simulation measured in MITRE ATT&CK coverage, detection latency and response gaps - not CVSS scores.
Red and purple team engagements go beyond finding vulnerabilities. We replicate a real adversary's journey, from initial access to objective completion, and test whether your detection and response hold up when it counts. Engagements run in three modes: classic stealth red team, with your SOC unaware; assumed-breach, starting from a known foothold; or collaborative purple team, with red and blue working side-by-side to tune detections in real time. We measure outcomes in MITRE ATT&CK technique coverage, detection latency per tactic and response-gap analysis - not CVSS numbers. Physical, social, cloud and network objectives are all on the table.
A penetration test finds and proves weak points inside a set technical scope. Vectra's penetration testing practice is CREST accredited. Red and purple teams test the whole security system, and each type of test asks a different question.
We chase agreed goals with real attack chains across many parts of your estate. Your operational defenders have limited prior knowledge. We measure how well they detect and respond, then debrief your executives and technical teams.
Our testers and your defenders work side by side. We replay techniques mapped to MITRE ATT&CK while your team watches, then build detections, test playbooks and retest fast.
The test starts from a user, device or identity we control. Time goes into what happens next: identity attack paths, privilege escalation, lateral movement, cloud and SaaS access, and reaching high-value assets.
A real attacker moves across all the controls and services in their way, so a good test does too. We agree the exact techniques when we scope the work, and the rules of engagement always apply.
Authentication, identity attack paths, privilege escalation, service accounts, and the move from user to admin.
Endpoint controls, EDR visibility, malicious execution, persistence, and how defenders respond.
Attack paths through identity, sessions, apps and collaboration tools in the supported SaaS environments.
Whether your network zones really hold back an attacker who already has an approved foothold.
Whether your teams spot the attack, raise it with the right people and work together to contain it.
Red and blue teams work through each technique together. Defenders see the attack, check the data it left and test a change on the spot. It suits SOC uplift, detection work, SIEM moves, new EDR rollouts and checks on an in-house or outsourced SOC.
Vectra runs an agreed attack technique against the controlled target.
Defenders identify which endpoint, identity, network, cloud or SIEM telemetry captured the behaviour.
We check whether your alerts fire with enough context and priority for an analyst to act.
We test whether analysts can reconstruct the activity, understand the impact and identify the next attacker action.
We test how your team contains the attack, escalates it, keeps people informed and follows the playbook.
We adjust telemetry, detection logic, automation or process, then run the technique again to prove the gap is closed.
Your detection and response may come from an in-house SOC, an MSSP or both. Either way, the test checks the service from end to end.
It asks more than whether a console raised an alert. It follows the attack from the first log to the alert, the analyst, the escalation and the response.
Did the required telemetry exist, reach the security platform and contain enough context to investigate?
Did the right alert fire at the right severity before the attacker reached the next objective? Which ATT&CK techniques were missed or gave weak alerts?
Could analysts link what happened across users, devices, identities and systems fast enough, then sort and escalate it?
Did the team have the access, approval and steps it needed to contain the attack? Did security, identity, endpoint, cloud and IT teams hand over without losing time?
Which controls stopped the attack, and which were bypassed or misconfigured?
Where could enrichment, containment or workflow automation reduce analyst delay without unsafe response actions?
How far did the attacker get, and which trust links did the most harm?
When we run the technique again, can the team prove the fix changed the result?
We test only with your explicit approval and under agreed rules of engagement. The red team gets room to act like a real attacker. You get clear limits that protect live systems and key business processes. The rules set out:
The goal the red team is trying to reach, agreed before any work starts.
What is in scope: the systems, users, identities, cloud resources, sites and test windows.
Which techniques are permitted: social engineering, exploitation, persistence, credential use and post-exploitation activity.
When testing must stop or be escalated at once to protect the business and keep people safe.
How we collect, access, store, report and securely destroy evidence and sensitive data.
A small trusted group who manage safety, tell a real incident from the test and approve scope changes.
Stealth red team, assumed-breach or collaborative purple team - sized to your SOC's maturity, not forced into a one-size-fits-all template.
Every engagement produces a technique-coverage matrix, showing which attack techniques you detected, missed or prevented.
Detection rules, hunt queries and runbook updates handed to your SOC during the engagement, not months after a PDF lands.
Cyber, physical, social engineering and cloud objectives sit in a single scope, testing organised-crime TTPs - not an internal pen test under a new name.
Select adversary, define objectives, agree rules of engagement and scope safeguards with your exec sponsor.
Passive and active OSINT, social media mapping and attack-surface discovery, working from what's publicly visible - not your asset register.
Weaponised phishing, credential stuffing, supply-chain or physical vectors depending on the agreed scope.
We build persistence, C2 infrastructure and defence evasion, reaching an operational beachhead ready for actions on objective.
We move laterally, escalate privileges, find data, and complete the objective under live monitoring.
Technique-by-technique replay with your SOC, detection content handover and prioritised tuning recommendations.
APT-style campaigns modelled on threat actors actively targeting your sector and region, not generic playbook content.
We run phishing, voice pretext, spear-phishing and business-email-compromise tests, with human-layer numbers.
We run on-site tailgating, lock-bypass, device-drop and badge-cloning tests, with scoping safeguards and damage controls.
We run AWS, Azure and GCP scenarios, including IAM role chaining, token theft and cross-tenant escalation.
We run hypothesis-driven hunts with your blue team, to find blind spots in SIEM content, EDR coverage and hunt queries.
We tune detection during the engagement, and deliver hunt queries, SIEM analytic content and runbook updates.
We identify which TTPs your current stack can't see, ranked by exploitation frequency in your sector.
Hard numbers on how long each attack phase takes to detect, escalate and contain, broken down per tactic, per host and per team.
We test whether your outsourced SOC delivers what the SLA claims - not just whether alerts fire.
A full-chain attack rehearsal, so your IR runbooks are proven under pressure - before a real adversary tests them.
An executive narrative turns TTP coverage into business risk, regulatory exposure and remediation spend priority.
A remediation roadmap, mapped to ATT&CK tactics, so your SOC can sequence uplift against the gaps that matter most.
MITRE ATT&CK technique coverage matrix showing detected vs missed vs prevented tactics
Hard detection latency numbers, measured per TTP and per attack phase
Response-gap analysis, ranked by exploitation frequency and business impact.
Hardened SOC detection content: SIEM rules, hunt queries and runbooks delivered during the engagement
Executive-level narrative report and regulator-facing evidence pack suitable for APRA and SOCI submission
A pen test finds as many vulnerabilities as possible within a set scope. A red team replicates a real adversary chasing one objective - stealing customer data, compromising the admin domain, or moving money. A red team measures detection and response. A pen test measures vulnerability coverage.
Red team operates covertly. Your SOC doesn't know the engagement is running. Purple team operates collaboratively - red and blue in the same room, tuning detections as attacks run. We do both. Most mature customers alternate between modes across years.
Depends on the mode. Classic red teams are stealth, and only the executive sponsor and one or two safety stakeholders know. Purple teams are openly collaborative. Assumed-breach engagements can go either way. We agree communications rules at kick-off.
For a stealth red team, you need enough maturity to actually expect a catch. Otherwise, the engagement proves nothing. Purple teaming is the right first step for less-mature SOCs. We help you build detection as we run the attacks.
Yes, when scope allows it. Tailgating, lock-bypass, device-drops, badge cloning and social-engineering entry are all on the table, with agreed damage controls, legal authorisation and a physical safety plan.
We document rules of engagement with the exec sponsor, pre-approve destructive-action restrictions, and keep a live bridge to your security lead during on-target phases, with kill-switches for anything that risks availability.
You get three things: an executive narrative for the board, a technical report with full chain-of-evidence and an ATT&CK matrix, and a SOC package with detection content, hunt queries and uplift recommendations.
Speak to us about your cyber governance and compliance requirements.
Message sent
A member of our team will be in touch soon at . You can also reach us during business hours on 1800 816 044.
Need us sooner? Call +61 8 8208 0800, or the 24/7 incident line on 1800 816 044 if something is happening now.