How much should a red team engagement include (initial access, lateral movement, exfil)?

Enough to reach and prove the business objective — typically initial access → escalation → lateral movement → objective/exfil — without a test-everything scope.

Can you scope web, mobile, and internal network in one red team engagement?

Yes — use the scoping checklist above to combine them under one objective-led scope.

Are red teams run against a single target at a time?

Not necessarily — scope can cover multiple systems and locations under one objective, or focus on a single crown-jewel target.

What's the difference between red team scope and objectives?

The objective is the goal; the scope is the boundary — the systems, identities, and locations in play. See red teaming objectives examples.

Get AI-Powered + Human Validated Pen Testing!

Services

Offensive Security Services

Validate Initial Access Before an Attacker Does
Our Breach & Exposure Testing services focus on gaining realistic initial access and proving exploitability under controlled conditions.

Penetration Testing
Targeted, scenario-driven offensive testing of external, internal, cloud, and application environments.

Compromise Assessment
When suspicion exists, but evidence does not, we conduct deep compromise investigations.

Assumed Breach Testing
Operate under the assumption that perimeter defenses have failed.

Secure the Modern Attack Surface
We perform adversarial testing against large language model applications, AI agents, and ML-integrated systems to validate real-world abuse scenarios.

LLM Application Penetration Testing
Security testing of AI-powered applications, including, Retrieval-augmented generation (RAG) systems, API-connected AI workflows, Data-integrated LLM deployments.

AI Chatbot & Agent Attacks
Simulated adversarial abuse of Customer-facing AI chatbots, Autonomous agents, and Internal AI copilots.

Prompt Injection & Model Abuse
Targeted red team operations against LLM logic, including Direct injection, Indirect injection via content ingestion, Context poisoning, and model manipulation.

Full-Scope Attacker Campaigns
We conduct multi-stage, intelligence-led campaigns that replicate real threat actor tactics, techniques, and procedures (TTPs).

Digital Red Teaming
Our operations emulate modern ransomware groups and advanced persistent threat (APT) behaviors.

Assumed Breach Red Teaming
We begin post-compromise and simulate, Stealth persistence, Active Directory dominance, Sensitive data targeting, Business process manipulation.
Focused on detection, containment, and response resilience.

Purple Teaming
We coordinate with your SOC and security engineering teams to improve detection rules, validate telemetry coverage, Tune response playbooks, and strengthen defensive maturity.
This is how detection engineering evolves.

Controlled Impact. Executive-Level Validation.
Ransomware remains the most financially destructive cyber threat facing modern organizations.
We simulate it safely, before criminals do.

Adversary Simulation
Targeted, scenario-based attack exercises aligned to real threat intelligence.

Live Ransomware Simulation
A controlled encryption simulation conducted in a contained and approved environment to validate, backup integrity, restoration timelines, business continuity plans, and incident response coordination
We do not deploy live, destructive malware.
We simulate operational impact safely.

Ransomware Tabletop Exercises
Executive and technical leadership walk-through. This aligns technical risk with business reality.

Real-World Intrusion. Real Consequences.
Cybersecurity does not exist only in the cloud.
We conduct physical and blended intrusion campaigns to validate security across facilities, personnel, and infrastructure.

Global Physical Penetration Testing
Simulated unauthorized access attempts against corporate offices, data centers, warehouses, and critical facilities.

Global Physical Red Teaming
Blended campaigns combining physical access with digital compromise.
Attackers do not respect silos. Neither do we.

View all services
Programs

Offensive security programs

Continuous adversarial assurance programs for regulated enterprises.Continuous adversarial assurance programs for regulated enterprises.

Continuous Red Team
Continuous adversarial coverage. Quarterly cadence, real-time findings.

AI Assurance
End-to-end security for LLMs, agents, and RAG systems.

Resilience & Threat-Led Assurance
Threat-led testing for DORA, TIBER, CBEST, and regulated entities.

View all programs
About Us
Industries

See how we help teams across industries defend against real-world adversaries through realistic, attack-driven security testing.

Banking & Financial Services

Red teaming for banks targets fraud, credential theft, core system compromise, and regulatory validation.

Healthcare

Healthcare faces ransomware, data breaches, and legacy system risks.

SaaS & Technology

Cloud-native companies face identity attacks, API flaws, and supply chain risks.

Energy & Utilities

Critical infrastructure faces nation-state attacks, OT/ICS threats, and operational disruption.

E-commerce & Retail

E-commerce platforms face payment fraud, account takeovers, and API abuse.
Resources

Access All Resources
Discover a wide range of offensive security resources, from in-depth reports and practical step-by-step guides to expert-led webcasts and live sessions, crafted to keep you informed and one step ahead.

Customer Stories
See how organizations strengthened their security posture through real-world offensive security engagements and outcomes.

Live sessions/video guides
Join expert-led live sessions and video guides designed to help teams understand, improve, and stay ahead in their security journey.

Up-to-Date Cybersecurity Statistics
Stay informed with the latest cybersecurity statistics and insights to better understand evolving threats and trends.

Checklists
Access practical checklists to assess, strengthen, and stay on top of your organization’s security posture.
Instant Pentest Quote

Red Team Scope Examples: What’s Included in a Red Team Engagement?

Understanding Red Team Engagement Scope

A red team scope defines exactly what an engagement will test – the systems, identities, locations, and attack paths in play, and the business objective the adversary will try to reach. A typical scope covers initial access, identity and privilege escalation, lateral movement, detection and response validation, and a business-impact objective – tailored to your industry and threat model, not a test-everything checklist. Below are real red team scope examples by industry, and a scoping checklist you can reuse.

Scope defines the boundary; the red teaming objectives define the goal. This page focuses on scope, so pair it with objective-based examples when you plan.

What's included in a red team engagement scope

Initial access: phishing, credential theft, external surface, cloud identity
Identity & privilege escalation: AD, Entra ID, privileged/service accounts, IAM
Lateral movement: pivoting to crown-jewel assets
Detection & response validation: how far before the SOC notices
Business-impact objective: the outcome that proves real risk

What Is Included in a Red Team Engagement?

While every engagement is customized, most enterprise red team exercises include some combination of the following components.

Initial Access Testing

The engagement begins by identifying how an attacker could gain an initial foothold.

This may include:

Spear phishing campaigns
Credential theft attacks
Password spraying
External attack surface testing
Cloud identity compromise
Third-party or vendor attack paths

The objective is to determine whether attackers can establish access using techniques that mirror real-world threat actors.

Identity & Privilege Escalation

Modern attackers target identities more than vulnerabilities.

A red team may assess:

Active Directory security
Microsoft Entra ID
Privileged accounts
Service accounts
Cloud IAM configurations
Single Sign-On (SSO) environments

The objective is to determine whether attackers can elevate privileges and gain access to critical resources.

Internal Lateral Movement

Once access is obtained, attackers rarely stop there.

Red team operators evaluate whether they can:

Move between systems
Access sensitive data
Pivot across network segments
Reach crown-jewel assets
Escalate privileges further

This stage often reveals security gaps that traditional testing misses.

Detection & Response Validation

A key component of red teaming is measuring how well defenders detect and respond.

The engagement evaluates:

Alert generation
SOC visibility
Incident response workflows
Escalation procedures
Detection coverage gaps

The question becomes:

“How far could an attacker get before someone notices?”

Business Impact Demonstration

The final objective is not simply gaining access.

The objective is demonstrating what a real attacker could achieve.

Examples include:

Accessing sensitive financial data
Reaching production environments
Simulating ransomware deployment
Accessing customer records
Compromising executive accounts
Demonstrating fraud pathways

This allows organizations to prioritize remediation based on real risk.

Reporting is covered separately: for what you receive at the end of an engagement, see what’s included in a red team report.

Red Team Engagement Examples by Industry

Each example below shows a realistic red team engagement, objective, in-scope systems, simulated attack paths, and success criteria for a specific industry.

For the specific adversary red team attack scenarios that get run within the scope, see our top 5 scenarios guide.

Example Red Team Scope: Financial Institution

Objective

Determine whether attackers can access sensitive financial systems without detection.

In Scope

Microsoft 365 and Entra ID
Employee endpoints
VPN infrastructure
Internal applications
Payment processing systems
Corporate offices

Simulated Attack Paths

Spear phishing campaigns
Credential theft
MFA bypass attempts
Privilege escalation
Lateral movement
Payment workflow abuse

Success Criteria

Reach sensitive financial systems
Demonstrate fraud pathways
Evaluate SOC detection effectiveness
Assess business impact

Typical Outcomes

Financial institutions frequently discover identity-related attack paths that bypass traditional perimeter controls and expose critical business processes.

Example Red Team Scope: Healthcare Organization

Objective

Assess resilience against ransomware-style attacks targeting patient services and clinical systems.

In Scope

Hospital networks
Active Directory
Electronic Health Record (EHR) platforms
Clinical systems
Cloud infrastructure
Third-party vendor access

Simulated Attack Paths

Phishing campaigns
Credential compromise
Lateral movement
Privilege escalation
Backup discovery
Ransomware simulation

Success Criteria

Access critical healthcare systems
Evaluate operational impact
Validate incident response processes
Measure detection and response timelines

Typical Outcomes

Healthcare organizations often discover attack paths capable of disrupting operations long before security teams would detect them.

Example Red Team Scope: SaaS & Cloud Companies

Objective

Determine whether attackers can compromise customer data or gain administrative control of cloud environments.

In Scope

AWS, Azure, or GCP
SaaS applications
CI/CD pipelines
APIs
Source code repositories
Identity systems

Simulated Attack Paths

OAuth abuse
Token theft
IAM privilege escalation
API exploitation
Supply-chain attacks
Cloud persistence techniques

Success Criteria

Demonstrate customer data exposure
Validate cloud security controls
Assess detection capabilities
Identify privilege escalation paths

Typical Outcomes

Cloud identity weaknesses frequently provide attackers with broader access than organizations expect.

Example Red Team Scope: Energy & Critical Infrastructure

Objective

Validate resilience against cyber-physical attacks targeting operational systems.

In Scope

Enterprise IT infrastructure
OT/ICS environments
SCADA systems
Remote access platforms
Identity infrastructure
Physical facilities

Simulated Attack Paths

Vendor compromise
Credential theft
IT-to-OT pivots
Physical intrusion attempts
Operational disruption scenarios

Success Criteria

Reach operational systems
Evaluate monitoring effectiveness
Validate incident response readiness
Demonstrate potential operational impact

Typical Outcomes

Organizations gain visibility into how attackers could bridge the gap between enterprise IT and operational technology environments.

Red Team Scoping Checklist

Use this to scope a combined web, mobile, and internal-network engagement:

Define the business objective (what the adversary must reach)
List in-scope web apps and external surface
List in-scope mobile apps and APIs
Define internal-network scope (segments, AD/identity, crown jewels)
Set assumed starting position (external vs assumed-breach)
Specify identity systems in scope (Entra ID, AD, SSO, IAM)
Agree detection/response validation (will the SOC be tested blind?)
Set out-of-scope systems and safety guardrails
Define success criteria and reporting requirements

Want this as a downloadable scoping template?

Get the Red Team Scoping Checklist (PDF) →

What Should NOT Be Included in a Red Team Scope?

One of the most common mistakes organizations make is attempting to test everything.

An effective red team engagement is not defined by how much is tested.

It is defined by how realistically objectives are achieved.

Poorly designed scopes often result in:

Excessive noise
Unrealistic attack paths
Limited actionable insight
Increased costs
Reduced value

The most successful engagements focus on realistic objectives aligned with actual threats facing the organization.

How Scope Impacts Red Team Cost

The scope of an engagement is one of the primary factors influencing cost.

Variables include:

Number of attack vectors
Physical security testing requirements
Number of locations
Cloud complexity
Identity infrastructure complexity
Engagement duration
Reporting requirements

A focused engagement typically provides greater value than an excessively broad assessment.

Organizations evaluating budgets should consider the business objectives they want validated rather than simply expanding scope.

Read More: Red Team Cost Guide

Why Scope Matters More Than Tools

Many organizations evaluate red teams based on tools.

Experienced security leaders evaluate them based on scope design.

The value of a red team engagement comes from:

Realistic threat modeling
Experienced operators
Clearly defined objectives
Relevant attack scenarios
Meaningful business outcomes

A properly scoped engagement provides evidence of resilience, not simply a list of findings.

Related: Part of the Red Teaming hub. Pair your scope with clear red teaming objectives examples, plan around how long a red team takes, and know what you’ll receive.

Request a Tailored Red Team Scope Assessment

Request a tailored red team engagement today and discover how a real attacker would target your organization.

FAQ - Red Team Scope Examples

What's included in a red team engagement scope?
Initial access, identity/privilege escalation, lateral movement, detection & response validation, and a business-impact objective — tailored to your threat model.
How much should a red team engagement include (initial access, lateral movement, exfil)?
Enough to reach and prove the business objective — typically initial access → escalation → lateral movement → objective/exfil — without a test-everything scope.
Can you scope web, mobile, and internal network in one red team engagement?
Yes — use the scoping checklist above to combine them under one objective-led scope.
Are red teams run against a single target at a time?
Not necessarily — scope can cover multiple systems and locations under one objective, or focus on a single crown-jewel target.
What's the difference between red team scope and objectives?
The objective is the goal; the scope is the boundary — the systems, identities, and locations in play. See red teaming objectives examples.

Red Team Scope Examples: What’s Included in a Red Team Engagement?

Understanding Red Team Engagement Scope

What's included in a red team engagement scope

What Is Included in a Red Team Engagement?

Initial Access Testing

Identity & Privilege Escalation

Internal Lateral Movement

Detection & Response Validation

Business Impact Demonstration

Red Team Engagement Examples by Industry

Example Red Team Scope: Financial Institution

Objective

In Scope

Simulated Attack Paths

Success Criteria

Typical Outcomes

Example Red Team Scope: Healthcare Organization

Objective

In Scope

Simulated Attack Paths

Success Criteria

Typical Outcomes

Example Red Team Scope: SaaS & Cloud Companies

Objective

In Scope

Simulated Attack Paths

Success Criteria

Typical Outcomes

Example Red Team Scope: Energy & Critical Infrastructure

Objective

In Scope

Simulated Attack Paths

Success Criteria

Typical Outcomes

Red Team Scoping Checklist

What Should NOT Be Included in a Red Team Scope?

How Scope Impacts Red Team Cost

Why Scope Matters More Than Tools

Request a Tailored Red Team Scope Assessment

FAQ - Red Team Scope Examples

What’s Inside

Before You Leave...