Red Team Operations
Full-scope and objective-driven. No prior knowledge, no announced window. We stop when we hold the thing you told us we couldn't reach.
Offensive security — Boston — Since 2019
We move laterally. So will they.
Red Rook is the adversary you're paying. We run the full attack against your network — access, escalation, movement, exfiltration — and hand you the board before someone else plays it for free.
- Current posture
- Booking Q4 2026. Two operator teams available.
- Scope
- Financial services, healthcare, critical logistics.
- Offices
- Boston (HQ), Manhattan, Miami, San Francisco.
Capabilities
Six ways to lose,
practiced in advance.
Every engagement is run by the operators who scope it. No handoffs, no sales engineers, no report written by someone who wasn't in the room.
Adversary Emulation
We reproduce a named group's tradecraft against your environment, technique for technique, and score your detections against what they actually do.
Application & API Assessment
Source-assisted testing of the code that touches money, identity, or customer records. Business logic first, injection second.
Cloud & Identity Review
Every path from a contractor's laptop to your production tenant, mapped, rated, and demonstrated rather than asserted.
Detection Engineering
We attack, your analysts hunt, and we sit in the same room. Everything we do is logged, timestamped, and replayable against your rules.
Incident Readiness
A tabletop your executives will not enjoy, followed by the runbook they should have had before it started.
Method
An engagement is a game
with two sides.
We write ours up the way a game is recorded: our move, then your network's reply. Both columns matter. A finding without your response is only half the position.
Move
Red Rook
Your network
1.
Scoping
Objectives written as outcomes, not IP ranges. One page, signed.
Rules of engagement
Your no-go list, your escalation path, your two named contacts.
2.
Reconnaissance
Public exposure, acquisitions, staff, shadow tenants, forgotten DNS.
Attack surface?!
Usually a third larger than the asset inventory says it is.
3.
Initial access
The cheapest credible door. Rarely the one you've spent money on.
First control
Whatever fires — or doesn't. We note the time either way.
4.
Escalation
Local to domain, tenant to tenant, human to service account.
Detection attempt
Scored against your own rules, not a generic maturity model.
5.
Lateral movement!
Straight lines through flat networks. The rook's whole game.
Segmentation
Where it holds, we say so loudly. It's the finding worth paying for.
6.
Objective
The payment run, the patient record, the release pipeline. Proven.
Impact
Stated in your language: money, downtime, regulator, headline.
7.
Disclosure
Live walkthrough with the engineers who own the fix, not a PDF drop.
Remediation
Ranked by attack path, not by scanner severity.
8.
Retest
Included. We replay the exact path, ninety days later.
Position held!!
Or it isn't, and we say that too. That's the only honest ending.
Field notes
Three positions,
annotated.
Redacted with client permission. The annotation marks the move, not the people — every network below is in better shape than the one you're running right now.
!! Brilliant defence
! Strong
?! Dubious
? Mistake
?? Blunder
??
A decommissioned VPN concentrator still trusted the old domain. Nobody had signed into it since 2021. It was the shortest path to every teller terminal in fourteen branches.
Engagement 24‑118
Regional bank
Five weeks · Black box
Decommission process rewritten. Retest at ninety days found no residual trust.
?!
Their detection was excellent — for malware. So we used their own deployment tooling, and the SOC watched the whole operation go past as a routine change window.
Engagement 25‑032
Healthcare SaaS
Three weeks · Purple
Eleven new detections written jointly. Change-approval path now alerts on out-of-band use.
!
Seven days in, blocked at every turn. The segmentation held, the credentials were short-lived, and the alerts were real. We wrote the shortest report in the firm's history.
Engagement 25‑077
Logistics operator
Six weeks · Full scope
Scope widened at the client's request. We got in through an acquired subsidiary on day nineteen.
Engage
Open the board.
Engagements begin with a forty-five minute scoping call — no deck, no discovery questionnaire. You'll be talking to the operator who would run the work.
- Found something in our network?
- We run a disclosure program against ourselves. security@redrook.io
- PGP fingerprint
- B342 55DD 59BE 8112 55DF
2981 6100 782E 5992 BF24 - Response window
- One business day, acknowledged by a human.