What are the steps?
| # | Step | What happens |
|---|---|---|
| 1 | Plan | Agree objectives, scope, rules of engagement and participants |
| 2 | Emulate | The attacker side runs a chosen scenario one stage at a time |
| 3 | Detect | The defenders observe what the tooling logged and alerted |
| 4 | Tune | Rules, sources or playbooks are changed |
| 5 | Retest | The same stage runs again to confirm the change |
| 6 | Report | Findings, gaps and an improvement plan are written up |
How do red and blue work together?
They share a timeline. Paranoid Security’s cyber exercises page says the SOC is told of each action so detectability can be assessed, and that detected and missed events are reviewed jointly. The Mandiant datasheet has the client team work with an incident response consultant and a red team consultant at each phase.
What do providers publish?
- Group-IB: collaborative planning, scenario design, controlled execution, detection and response validation, knowledge transfer and findings alignment, proven readiness. See the profile.
- Wattlecorp: reconnaissance, monitoring, reporting and remediation, retest. See the profile.
- Mandiant: intelligence on active threat groups, validation content, step-by-step exercises across the attack lifecycle, a three-week timeline.
- Paranoid Security: real-time stages with SOC feedback after each action, joint review, tuning recommendations. No retest is published.
How are scenarios chosen?
From threat intelligence and from the client’s concerns. Group-IB says its scenarios are grounded in its threat intelligence and mapped to MITRE ATT&CK techniques, with ransomware simulations, Active Directory attacks, supply chain compromise and data exfiltration as examples. The Mandiant datasheet starts from threat groups active in the client’s industry.
What happens after the simulation?
Expect a report and a list of detection changes. Ask whether it names what was missed, what was fixed during the exercise and what remains. Then decide whether a retest is included. The measurement guide covers what to track.
Who is involved from the client side?
At least one analyst who can change a detection during the session, someone who owns log sources, and a sponsor who accepts the report. More in the FAQ below. How the criteria treat live collaboration is on the methodology page.