With Red Team exercises we measure your organization’s capacity to detect and respond to attacks. We run the scenarios according to the MITRE ATT&CK framework, within a defined scope and rules.
Detected and missed techniques.
Detection and response times.
Improving detection rules together with your Blue Team.
A Red Team service is a pre-authorized security exercise that measures an organization’s capacity to detect and respond to attacks. The tactics, techniques and procedures (TTPs) of real attackers are applied in scenarios aligned with the defined business objective and test scope.
At Nesil Teknoloji, we define objectives such as access to a critical application or lateral movement within the network together with your organization. We map the applied techniques to MITRE ATT&CK and report which steps were noticed, when the response began and which controls were missing. In covert scenarios, the Blue Team and the security operations center (SOC) are not informed in advance; the organization’s authorized control team monitors the work.
We compare every attack step with security logs and alert results. This way we show not only which systems were reached, but also where the defense kicked in and which steps it missed.
An assessment and coverage map showing which of the techniques applied in the exercise were detected.
Mean time to detect (MTTD) and mean time to respond (MTTR). The start and end points of the measurement are explained in the report.
A session in which missed scenarios are reviewed together with the Blue Team and detection rules are re-tested.
Testing lateral movement and detection controls under the assumption that initial access has been achieved.
Attack scenarios selected by considering the organization’s sector and the threats it may face in Türkiye.
Findings explained with screenshots, relevant logs and the attack techniques applied.
According to your organization’s needs, we also include the following technical security tests in the Red Team scenario.
Penetration testing focuses on verifying vulnerabilities in defined systems and assessing their impact. A Red Team, on the other hand, combines multiple attack steps to test the organization’s detection and response processes. The two engagements complement each other; scope and duration are defined at the start of the project.
Scroll the table horizontally to compare.
| Criterion | Penetration Test (Pentest) | Red Team Exercise |
|---|---|---|
| Objective | Verify vulnerabilities and their impact | Test the attack path to the target and the defense |
| Success measure | Verified findings and their risks | Detection, response and target-access results |
| Blue Team awareness | Usually informed | Not informed in advance in a covert scenario |
| Scope | Defined systems | Authorized systems, people and processes |
| Scenario | Focused on technical vulnerabilities | Attacker scenario tailored to the organization |
| Duration | Depending on scope; usually 1-3 weeks | Depending on scope; usually 4-10 weeks |
| Core output | Vulnerability report | Visibility Score + MTTD/MTTR |
Depending on the scope of the exercise, at Nesil Teknoloji we make use of four platforms we developed in-house.
We run social engineering scenarios with email, SMS and voice phishing simulations. In authorized exercises we evaluate how employees respond to these scenarios.
Integrations:ElevenLabs, Netgsm and Setrow.
PhishScope · nesil.ai
We assess the resilience of the infrastructure and defense systems with controlled DDoS tests. We obtain separate approval for the targets, traffic limits and test hours.
We use the cyber threat intelligence we obtain through Nesil CTI when selecting the attack methods the organization may face and the exercise scenarios.
We manage the process tracking of pentest and Red Team engagements through Nesil ASM, which we developed in-house.
We perform the source code security analyses included in the scope with OpenText Fortify. We use static application security testing (SAST) as an additional technical analysis for the Red Team engagement.
We map attack stepsMITRE ATT&CKto its techniques. The Visibility Score is based on the detection results of the techniques we apply in the exercise.
TIBER-EU, is a threat-intelligence-based exercise framework. For projects that require an official TIBER-EU test, the scope and provider conditions are assessed separately.
Penetration Testing Execution Standard; the guide we refer to during the scoping, technical testing and reporting stages.
Used to break attack steps into stages and to assess at which stage the defense kicks in.
We define the scope of the engagement according to your existing security controls and test objectives. The groups below are a practical distinction for service planning; they are not an official certification or maturity standard.
If SOC and log collection processes are newly being set up, addressing basic vulnerabilities and log gaps first is considered.
If SIEM and detection rules exist, specific scenarios are attempted; results are reviewed together with the Blue Team.
An active SOC and response processes can be tested with a scoped covert Red Team exercise.
For organizations that run exercises regularly, new scenarios and retests are planned according to current threats.
The Red Team service is suitable for organizations that want to test their detection and response processes, such as banks, fintech companies, critical infrastructure operators, the defense industry and public institutions. It is used in particular to see how active SOC or CSIRT teams respond to attack scenarios.
If you are having a test done for regulatory or audit purposes, the applicable requirements and report scope must be defined separately. A Red Team exercise on its own is not a compliance certificate. For such work you can review ourregulation-compliant penetration testingservice.
Our team across penetration testing, social engineering, cloud security and exercise compliance.
Attack scenarios and penetration testing
Tests web, mobile and network attack scenarios on corporate systems and critical infrastructure.
In-network access and privilege control
Assesses how gaps in network segmentation and database privileges could be used in attack scenarios.
Web, API and internal network tests
Verifies gaps in web, API and the internal network; transfers attack steps and findings into a technical report.
Social engineering and initial access
Tests human-focused initial-access scenarios with authorized phishing simulations.
Web, API and Active Directory
Verifies web, API and Active Directory vulnerabilities with manual tests; assesses in-house attack paths.
Exercise scope and compliance
Assesses the alignment of the exercise scope with data protection and information security requirements.
Cloud and container attacks
Tests privilege escalation, container escape and lateral movement scenarios in Azure and Kubernetes environments.
Attack surface and post-exploitation
Assesses the attack surface at the web, mobile and network layers; runs post-initial-access progression scenarios.
Web, API and identity attacks
Tests web and API vulnerabilities and Active Directory attacks in Red Team scenarios; reports the business impact of the findings.
Penetration testing and attack validation
Tests web, network and application vulnerabilities; validates the exercise’s attack steps and reports the findings.
Our team works on source code, web and mobile applications, network infrastructure and social engineering testing. You can review our corporate authorization certificates and our team’s certifications through the link below.
Nesil Teknoloji is one of the cybersecurity firms providing Red Team services to organizations in Türkiye. In its exercises, it evaluates attack scenarios and detection and response processes together.
Evaluate the team’s technical competence, similar work experience, test scope and report content. Check that authorizations and certifications are current from the documents; clarify risk management and confidentiality terms in writing.
No. A penetration test verifies vulnerabilities in defined systems; a Red Team, on the other hand, tests the organization’s detection and response processes with connected attack scenarios. Which engagement is appropriate depends on your test objective.
Depending on the approved scope, externally exposed systems, the internal network, Active Directory, social engineering and physical security can be assessed. The systems, people and permitted actions to be tested are defined before starting.
The price is determined by the number of targets, the scenarios, the engagement duration and the reporting scope. For a quote suited to your organization, you cancontact Nesil Teknoloji.
Engagements are usually planned for 4 to 10 weeks. The exact duration is set at the quotation stage according to the number of scenarios and targets.
In a covert exercise, the Blue Team and SOC team are not informed in advance; the organization’s authorized control team monitors the work. The timing of the joint evaluation and retests is planned separately.
In active tests, operational risk cannot be completely eliminated. Test hours, operational limits and stop conditions are defined in advance; scenarios that could affect service, such as DDoS, are separately approved.
We manage the process tracking of the exercise through the Nesil ASM Pentest Management Platform. The scope, work steps and reporting schedule are defined at the start.
Yes. Depending on the scope, we use the Nesil Phishing and Voice Phishing, Nesil VOLTRA DDoS, Nesil CTI and Nesil ASM platforms. When source code analysis is required, we make use of the third-party solution OpenText Fortify.
Depending on the scope, an executive summary, technical findings, an attack timeline, MITRE ATT&CK mappings and detection-response metrics are provided. Priority improvements are evaluated together with the Blue Team.
Contact our team to discuss the scope and the exercise process.