Red Team Operations
Full-scope and objective-driven. No prior knowledge, no announced window. We stop when we hold the thing you told us we couldn't reach.
Offensive security — London & Austin — Since 2019
We move laterally. So will they.
Red Rook is the adversary you're paying. We run the full attack against your estate — access, escalation, movement, exfiltration — and hand you the board before someone else plays it for free.
- Current posture
- Booking Q4 2026. Two operator teams available.
- Scope
- Financial services, healthcare, critical logistics.
412
Engagements delivered since the firm was founded.
9 days
Median time from first foothold to domain administrator.
38
Zero-days found in client supply chains and disclosed to vendors.
31%
Engagements where we never needed to send a single phishing email.
Capabilities
Six ways to lose,
practised in advance.
Every engagement is run by the operators who scope it. No handoffs, no sales engineers, no report written by someone who wasn't in the room.
Adversary Emulation
We reproduce a named group's tradecraft against your estate, technique for technique, and score your detections against what they actually do.
Application & API Assessment
Source-assisted testing of the code that touches money, identity, or customer records. Business logic first, injection second.
Cloud & Identity Review
Every path from a contractor's laptop to your production tenant, mapped, rated, and demonstrated rather than asserted.
Detection Engineering
We attack, your analysts hunt, and we sit in the same room. Everything we do is logged, timestamped, and replayable against your rules.
Incident Readiness
A tabletop your executives will not enjoy, followed by the runbook they should have had before it started.
Method
An engagement is a game
with two sides.
We write ours up the way a game is recorded: our move, then your estate's reply. Both columns matter. A finding without your response is only half the position.
Move
Red Rook
Your estate
1.
Scoping
Objectives written as outcomes, not IP ranges. One page, signed.
Rules of engagement
Your no-go list, your escalation path, your two named contacts.
2.
Reconnaissance
Public exposure, acquisitions, staff, shadow tenants, forgotten DNS.
Attack surface?!
Usually a third larger than the asset inventory says it is.
3.
Initial access
The cheapest credible door. Rarely the one you've spent money on.
First control
Whatever fires — or doesn't. We note the time either way.
4.
Escalation
Local to domain, tenant to tenant, human to service account.
Detection attempt
Scored against your own rules, not a generic maturity model.
5.
Lateral movement!
Straight lines through flat networks. The rook's whole game.
Segmentation
Where it holds, we say so loudly. It's the finding worth paying for.
6.
Objective
The payment run, the patient record, the release pipeline. Proven.
Impact
Stated in your language: money, downtime, regulator, headline.
7.
Disclosure
Live walkthrough with the engineers who own the fix, not a PDF drop.
Remediation
Ranked by attack path, not by scanner severity.
8.
Retest
Included. We replay the exact path, ninety days later.
Position held!!
Or it isn't, and we say that too. That's the only honest ending.
Field notes
Three positions,
annotated.
Redacted with client permission. The annotation marks the move, not the people — every estate below is in better shape than the one you're running right now.
!! Brilliant defence
! Strong
?! Dubious
? Mistake
?? Blunder
??
A decommissioned VPN concentrator still trusted the old domain. Nobody had signed into it since 2021. It was the shortest path to every teller terminal in fourteen branches.
Engagement 24‑118
Regional bank
Five weeks · Black box
Decommission process rewritten. Retest at ninety days found no residual trust.
?!
Their detection was excellent — for malware. So we used their own deployment tooling, and the SOC watched the whole operation go past as a routine change window.
Engagement 25‑032
Healthcare SaaS
Three weeks · Purple
Eleven new detections written jointly. Change-approval path now alerts on out-of-band use.
!
Seven days in, blocked at every turn. The segmentation held, the credentials were short-lived, and the alerts were real. We wrote the shortest report in the firm's history.
Engagement 25‑077
Logistics operator
Six weeks · Full scope
Scope widened at the client's request. We got in through an acquired subsidiary on day nineteen.
Engage
Open the board.
Engagements begin with a forty-five minute scoping call — no deck, no discovery questionnaire. You'll be talking to the operator who would run the work.
- Found something in our estate?
- We run a disclosure programme against ourselves. security@redrook.io
- PGP fingerprint
- 4F2C 9A17 B3D0 6E88
1A45 CC72 90FB 2E13
57D4 A8E6 - Response window
- One business day, acknowledged by a human.