Penetration testing
- The question
- What can be exploited?
- Measures
- Vulnerabilities and attack paths in a defined scope
- Best for
- Every organisation, on a regular cycle
OFFENSIVE SECURITY / RED TEAMINGYour controls pass the audit. Would they stop a real attacker?
A penetration test shows you what is weak. A red team shows you whether anyone notices, and how fast they act. We test your people, processes and technology together, against the objectives that matter most to your business.
- DAY 1Initial access via supplier portalMissed
- DAY 3Privilege escalationMissed
- DAY 5Lateral movement to financeDetected
- DAY 5SOC contains · your contact notifiedStopped
Illustrative example · Measured honestly
- ISO/IEC 27001 certified
- SMB1001 Gold
- Nueva 24x7 SOC
- In house digital forensics and incident response
- CREST Registered Testers in our team
- ARN Innovation Awards: SMB Partner of the Year 2024 and 2025
The challenge
You've tested the parts. Have you tested the whole?
Most organisations have checked their controls one at a time. The endpoint tool passed its review. The SOC meets its SLAs. Staff completed awareness training. None of that tells the board what happens when all of it is tested together, by someone patient and determined.
The question isn't "do we have the controls?" It's "how far would an attacker get, and how quickly would we know?"
Which test do you need?
Different questions need different tests.
These terms are often used interchangeably. They shouldn't be.
Red teaming
- The question
- Would we detect and stop a real attacker?
- Measures
- Detection, response and resilience across the organisation
- Best for
- Organisations with established controls and a SOC or MDR in place
Purple teaming
- The question
- How do we get better at catching this?
- Measures
- Detection coverage, improved in real time with your defenders
- Best for
- Tuning detection, often straight after a red team
How Nueva helps
A realistic adversary. Fully under your control.
Every engagement starts with your business, not our toolkit. Together we agree the objectives a real attacker would pursue in your organisation, such as reaching a critical system, a privileged identity or sensitive data. We then emulate the threat actors most relevant to your sector and map every action to MITRE ATT&CK, so results translate directly into detection improvements.
- Objective-led. Success is measured against goals your board cares about, not a count of findings.
- Threat-informed. Scenarios reflect the adversaries most likely to target your sector.
- Controlled. A small group on your side authorises every stage and can pause the engagement at any time.
Engagement options
Match the engagement to your risk.
Full-scope red team.
Tests your organisation end to end, starting with no prior access.
Assumed breach.
Starts from the point where a first control has already failed. Faster and more focused, so it's a good first red team.
Threat scenario.
A focused simulation of the threat you worry about most, such as ransomware, business email compromise or an insider.
Cyber and physical.
Delivered with Nueva Secure, testing whether physical and digital weaknesses combine to expose critical systems.
Nueva SecureHow it works
Planned carefully. Run safely. Measured honestly.
STEP 01 · SCOPE.
Agree objectives, threat profile, boundaries and rules of engagement with your control group.
STEP 02 · PREPARE.
Build the scenario around the adversaries most relevant to you.
STEP 03 · EXECUTE.
Run the engagement under agreed controls, with every action logged and a pause available at any time.
STEP 04 · MEASURE.
Compare what we did against what your team saw, alerted on and responded to.
STEP 05 · DEBRIEF.
Walk your executives and your defenders through the results, separately and in the right depth.
STEP 06 · IMPROVE.
Replay key techniques with your defenders in a purple team session, then retest once fixes are in.
STEP 01 OF 06
Safe by design
Realistic doesn't mean reckless.
A red team should test your defences, not your business continuity. Safety and governance are built into every engagement.
- Written rules of engagement and authorisation before any activity starts
- A named control group on your side, with a direct line to our engagement lead
- Agreed exclusions for critical systems and sensitive periods
- No destructive actions, and no data leaves your environment without agreement
- Full activity log for every action, so results can be verified and replayed
- If we find signs of a real compromise, we stop and escalate immediately, with Nueva incident response on hand
What you receive
Evidence your board can act on.
- An executive summary: how far an attacker got, how quickly they were detected, and what to prioritise
- A full attack narrative, with each stage mapped to MITRE ATT&CK
- A detection scorecard showing what was prevented, detected, alerted on and responded to
- A prioritised roadmap covering people, process and technology, not just patches
- A purple team session to turn findings into improved detections
- A retest to confirm the improvements hold
Outcomes
What changes after a red team.
Proven, not assumed.
Real evidence of how your defences perform under pressure.
Sharper detection.
Gaps closed with your defenders, technique by technique.
Smarter investment.
Spend directed at the weaknesses that actually matter.
Board confidence.
A clear, honest answer to "would we stop it?"
Why Nueva
Attackers' skills. Advisors' judgement.
- Certified red team operators. Our testers individually hold CRTO, CRTP, OSEP, GXPN, OSCP and CREST CRT certifications.
- CRTO
- CRTP
- OSEP
- GXPN
- OSCP
- CREST CRT
- Cleared people. Team members hold NV1 and NV2 Australian Government security clearances.
- We fix what we find. The team that finds the gap can close it, through Nueva Cyber and Nueva Technology.
- Cyber and physical in one engagement. Few providers can test both. With Nueva Secure, we can.
- Independent and vendor neutral. Our recommendations follow your risk, not a product list.
FAQ
FAQ
How is a red team different from a penetration test?
A penetration test finds as many exploitable weaknesses as possible within a defined scope. A red team pursues specific objectives across the organisation to test whether your detection and response would stop a real attacker. Most organisations start with penetration testing and move to red teaming as their controls mature.
Are we ready for a red team?
Red teaming delivers the most value when you have core controls, endpoint protection and a SOC or MDR service in place. If you're not sure, our free consultation will tell you whether a red team, an assumed breach exercise or a penetration test is the right next step.
Who in our organisation knows it's happening?
Only a small control group, usually a senior executive and a security leader. That keeps the test realistic while giving you full oversight and the ability to pause at any time.
Will it disrupt operations?
No. Rules of engagement, agreed exclusions and a no-destructive-actions principle keep business systems safe throughout.
How long does an engagement take?
It depends on objectives and scope. An assumed breach exercise is shorter. A full-scope engagement typically runs over several weeks. We confirm timing at scoping.
How often should we run one?
Typically once a year, or after major change such as a merger, new SOC provider or significant transformation.
Find out how far an attacker would get, before one tries.
Start with a free scoping conversation with our offensive security team.
Book a red team scoping call