UK red teaming that finds out who notices, and how fast.

Red teaming is an authorised attack on your whole organisation, aimed at one objective that would hurt you, run by operators who use whatever route a real attacker would: people, premises, the internet or your internal network. It tests your defenders as much as your technology. The NCSC calls it adversary simulation, "sometimes known as red teaming", and defines it as testing an organisation's ability to prevent, detect and respond to a range of cyber attack scenarios.

A penetration test works through a defined scope and proves which weaknesses in it are exploitable. A red team picks an objective, such as reaching your customer database, and attacks the whole organisation to get there, including your people and your detection. The NCSC puts it in one sentence: adversary simulation "focuses on the efficacy of an organisation's technical controls and detection, whereas penetration testing is more focused on identifying all technical vulnerabilities". Most mature programmes run both.

The NCSC says a typical adversary simulation engagement normally takes 8 to 12 weeks depending on size and scope, and a full spectrum engagement may last around 16 weeks. It also warns against setting the testing period at the bare minimum. We agree the timeline with you in writing before any testing starts.

We scope it with you on a call, and you leave with a scope and a fixed price before you commit. Two things move the figure most: the weeks of operator time your objective needs and the routes in scope. Hold any quote against the NCSC benchmark of 8 to 12 weeks for a typical engagement. If the call shows a penetration test would serve you better this year, we will tell you.

The NCSC sets three conditions. You have identified, assessed and regularly review your risks. You have well-established mitigations and defences in place. You have robust network monitoring and detection systems. The NCSC writes the guidance for medium to large organisations, yet sets no size threshold: it calls the testing appropriate for any organisation meeting those conditions. If you fall short, the NCSC points you to other schemes such as Cyber Essentials, and for most private UK firms the practical alternative is a commercial penetration test.

An assumed-breach engagement starts the red team on a device inside your network at an agreed level of access, skipping the initial compromise. The NCSC says that for organisations with a mature security posture it can provide greater value, because the whole engagement goes into whether an attacker can expand access and reach high-value targets. The trade-off, which the NCSC also names, is that you learn nothing about what you expose publicly for an attacker to find.

No. We agree the rules before we start: the objective, what is in scope, what is off limits and what we never touch. Nothing gets deleted or broken, and your business runs as normal. You decide who on your side knows. Tell your SOC and you learn less, because their response is what we are measuring. If a route stalls, we move to the fallback we agreed at scoping.

CBEST is the Bank of England's intelligence-led red team framework for UK financial firms and financial market infrastructures, run since 2014. The Bank puts the average CBEST at around 9 to 12 months. The penetration testing provider scores your detection and response capability and sends those scores straight to the regulator, and CBEST providers are accredited by the Bank and must be CREST members. STAR-FS is the tier below, where firms manage the tests themselves. Our Field Note on what the Bank of England grades covers both.

Cyber Adversary Simulation (CyAS) is the NCSC assurance scheme for companies delivering adversary simulation. Its Scheme Standard and Working Practices Document were published on 17 September 2026. The NCSC blog of that day gives November 2026 as the formal launch, while the scheme page says the NCSC aims to launch to buyers by the end of 2026. Before you rely on any provider's CyAS claim, check it against the NCSC's own list of assured companies. We hold no CyAS mark and will not imply one.

Named, certified operators. Our team holds CREST and Offensive Security certifications, including OSCP, OSEP and OSWE, and the operators who run phishing, pretexting and physical entry are part of the same team. We have delivered more than 1,000 tests, and one of our security researchers was credited by Apple in August 2026. A CREST-certified operator verifies every finding by hand before it reaches you.

Yes. We deliver engagements under your brand, on your paper, and your client never meets us. You get a written promise that we never contact your client. Book a partner call through our booking page, or read how white-label penetration testing works first.