Project + managed Detect, respond, recover
Security control validation and red teaming
You've paid for EDR, a firewall and email filtering. We show you whether they stop a real attack, and whether your team does too.
- Mapped to
- MITRE ATT&CKevery simulated technique
- Simulation
- Continuousor one-off, as you prefer
- Exercises
- [x]wargames run for clients
- One team
- MSSPwe can fix what the test finds
01 / The problem
Buying a control isn't the same as knowing it works.
Controls drift
Policy changes, exceptions and updates quietly weaken settings that were right on day one.
Vendor claims aren't proof
A datasheet says the tool blocks ransomware. Only a test on your estate shows if yours does.
The people side is untested
Who isolates the server? Who calls the insurer? Most teams find out during the real thing.
02 / What’s included
Attack your defences before someone else does.
Breach and attack simulation
Safe, repeatable simulations of real attacker techniques against your EDR, email gateway, firewall and SIEM.
Detection gap report
Each technique marked blocked, detected or missed, mapped to MITRE ATT&CK, with the fix for each gap.
Red team engagement
An objective-led attack, run quietly over weeks, to test whether your people and tools notice and respond.
Tabletop wargames
A realistic incident played out round the table with your leadership and IT, decision by decision.
Fix and re-test
We help close the gaps, then run the same simulations again to prove the fix worked.
[Placeholder: offer for this service, written by ITB]
03 / How it works
Test, find the gaps, fix, test again.
- Scope and agree the rules We agree objectives, targets, exclusions and emergency contacts before anything runs.
- Simulate and attack Simulations run against your controls; red team and wargame scenarios run to the agreed plan.
- Report the gaps You get what was blocked, what was seen and what was missed, in plain English.
- Fix and re-test We help close the gaps, then test again so you have evidence, not assumptions.
A control you've never tested is a guess. We'd rather you found out from us.
How ITB validates controls
04 / Why ITB
Tested by the people who run the defences.
We run SOC, EDR, firewall and email security for clients every day. So when a test finds a gap, we know how to close it, and we can do the work. Smaller red team and wargame engagements are led by our own team; for advanced red teaming we bring in specialist partners and manage the engagement for you.
| What it takes | Do it yourself | With ITB |
|---|---|---|
| BAS platform | Licensed, deployed and maintained by you | Included |
| Attack scenarios | Researched and kept current in house | Mapped to MITRE ATT&CK, updated by us |
| Red team skills | Rare, and hard to hire | Our team for smaller engagements, specialist partners for advanced ones |
| Fixing what's found | Back to your team's to-do list | Fix and re-test with the team that runs the tools |
| Board evidence | Built from scratch | A report your board can read |
· 05 / Questions
Control validation, plainly answered.
Q01 How is this different from a penetration test?
A penetration test looks for weaknesses an attacker could exploit. Control validation asks a different question: when an attacker acts, do your tools block or detect it? Red teaming adds your people and processes. For finding weaknesses, see our penetration testing page.
Q02 Is breach and attack simulation safe on live systems?
Yes. The simulations copy attacker behaviour without doing real harm, and we agree targets and exclusions first. We stop at once if anything looks like it could affect availability.
Q03 Who needs to be in a tabletop wargame?
Usually someone from leadership, IT, communications and whoever owns your supplier and insurer contacts. The value comes from people making real decisions under time pressure, so bring the people who would.
Q04 How often should we validate our controls?
After any major change to your tools or estate, and on a regular cycle in between. Continuous simulation catches drift between those points. A red team or wargame once a year suits most organisations.
Q05 Do we need a SOC or EDR first?
No. Testing what you have is a good way to decide what to buy next. If you already run our SOC or EDR, the results feed straight into tuning.
Related services
Penetration Testing
Finds the weaknesses; this page tests whether your controls catch them being used.
See the serviceManaged SIEM / SOC
The detections we tune after a simulation finds a miss.
See the serviceEDR / XDR / MDR
The endpoint control most simulations test first.
See the serviceIRaaS
The response a wargame rehearses.
See the service· [Placeholder]
[Placeholder] [Placeholder]
[Placeholder: written by ITB]