Penetration TestingRed Teaming

Red team exercises in Saudi Arabia: test your people, process and detection together

A red team behaves like a real adversary with a real objective. We attack in stages, see what your defenders notice, and then work with them to close the gaps in a purple team workshop.

Threat-led scenarios based on real adversaries
SAMA FEER-style exercises for financial entities
Purple team sessions that improve detection

Plan a red team exercise All cyber security services

Driven: ObjectiveDriven
ATT&CK mapped: MITREATT&CK mapped
Workshops: PurpleWorkshops
Aligned: FEERAligned

01Overview

What is a red team exercise?

A red team exercise is a goal-driven simulation of a real attack on your organisation, run by specialists who use the same techniques as genuine adversaries, usually without most staff knowing. It tests whether your people, processes and technology can detect and stop an attack, not only whether a system has a flaw.

Unlike a penetration test, which looks for as many weaknesses as possible in a defined scope, a red team aims for an objective, such as reaching a payment system or exfiltrating a defined data set, and tries to stay unnoticed on the way.

For financial institutions in Saudi Arabia, SAMA's Financial Entities Ethical Red Teaming (FEER) framework sets out how threat-intelligence-led red teaming must be run against live production systems, with certified providers.

Objective: Defined with leadership, for example a crown-jewel system
Scope: People, process, technology and sometimes premises
Intelligence: Threat-led, based on adversaries relevant to your sector
Standards: MITRE ATT&CK, SAMA FEER, TIBER-style approaches
Outcome: Detection and response gaps, with a purple team workshop

02What we do

A red team engagement, in five parts

From threat intelligence to a workshop that helps defenders improve.

Threat-led scenario design

We research the adversaries most likely to target your sector and design a realistic scenario with your control group.

Sector threat intelligence
Scenario agreed with leadership
Rules of engagement and safety controls
A small control group that knows

You receive: A realistic, safe exercise with clear boundaries.

Phishing and social engineering

Email, phone and messaging attacks that test staff and controls.

Initial access to objective

Stage-by-stage attack through the network to the agreed objective.

Physical intrusion

Optional testing of premises, badges and tailgating.

Purple team workshop

Attackers and defenders replay each step together and tune detections.

Reporting and board brief

A timeline of the attack, what was detected and what was missed, with a leadership briefing.

03How we work

Five phases from intelligence to improvement

A typical engagement runs several weeks.

Phase 1 · Weeks 1 to 2
Intelligence and planning
Threat research, scenario and rules of engagement.
Phase 2 · Weeks 2 to 4
Initial access
Phishing and external attack paths to gain a foothold.
Phase 3 · Weeks 4 to 6
Persistence and movement
Escalation and lateral movement while avoiding detection.
Phase 4 · Weeks 6 to 7
Objective
Reach and demonstrate access to the agreed target safely.
Phase 5 · Week 8
Replay and report
Purple team workshop, timeline and recommendations.

04Reference

Penetration test, red team or purple team?

They are complementary, not interchangeable.

	Penetration test	Red team	Purple team
Goal	Find and prove weaknesses	Achieve an objective undetected	Improve detection together
Defenders told?	Usually yes	Only a control group	Yes, they take part
Duration	Days to weeks	Weeks	Days
Output	Findings and fixes	Attack timeline and detection gaps	Tuned detections and playbooks
Best for	Technical assurance	Mature security teams	Improving a SOC quickly

05Frameworks

Frameworks that shape the exercise

Adversary behaviour is modelled on published knowledge, and engagements follow regulator guidance.

SAMA

FEER (May 2019)

SAMA's framework for threat-intelligence-led red teaming of financial entities, using certified providers against live production systems.

How we help: Scenario, rules of engagement and reporting aligned.

MITRE

ATT&CK

A knowledge base of real adversary tactics and techniques.

How we help: Every action is mapped to a technique.

TIBER

TIBER-EU style approach

A European model for intelligence-led testing in finance.

How we help: Useful for groups with EU exposure.

NIST

SP 800-115

Guide to technical security testing.

How we help: Supports safe test execution.

06Saudi Arabia and the GCC

Red teaming under Saudi expectations

Financial and critical-infrastructure operators face the most structured requirements.

SAMA
FEER for the financial sector
SAMA can ask any regulated financial entity to run a red team test, and expects findings to be fixed.
NCA
Critical infrastructure
Operators of critical systems benefit from adversary simulation to prove detection and response.
Safety
Confidentiality and safety
Strict rules of engagement, secure handling of findings and a control group protect operations.

07Why GoAgile

Why organisations choose GoAgile for red teaming

Realism, safety and a plan to improve.

Realistic and controlled

Adversary behaviour with strict safety limits.

Detection feedback

Our SOC analysts help turn findings into detections.

Purple team by default

Every engagement ends with defenders learning together.

Board-ready reporting

A clear story of the attack and what to do about it.

Confidential

Tight control of who knows and who sees findings.

Arabic and English

Briefings in both languages.

Credentials

ISO 9001 certified — ISO 9001
Quality management

ISO 14001 certified — ISO 14001
Environmental management

ISO 45001 certified — ISO 45001
Occupational health and safety

ISO 27001 certified — ISO 27001
Information security management

Registered cybersecurity service provider

MSOC licence, Tier 2

Penetration testing accreditation

Qualified Security Assessor company

Type II report, GoAgile

Business continuity management

08Clients

Trusted by banks, operators and public bodies across Saudi Arabia and the GCC

Organisations in regulated sectors choose GoAgile because security is delivered by the team that also builds and runs their infrastructure.

Tier-1 Saudi bank
Banking
National energy operator
Oil, gas and power
Government authority
Public sector
Regional telecom operator
Telecommunications
Healthcare group
Hospitals and clinics
Retail and e-commerce group
Retail
Ports and logistics operator
Logistics
Insurance company
Insurance
Fintech and payments provider
Financial technology
Industrial manufacturer
Manufacturing

Tier-1 Saudi bankRed team exercise

A threat-led red team exercise for a bank

The bank needed evidence that its people, processes and detection would hold up against a realistic attacker, in line with SAMA expectations.

Agreed rules of engagement and a threat scenario with the CISO
Ran a controlled exercise against production systems
Ran a purple team workshop so defenders could see every step

Result: Detection gaps were fixed, playbooks were updated and the board received a plain-language report.

National energy operatorOT security assessment

OT assessment and segmentation for an energy operator

Plant networks had grown without a clear map, and remote access for vendors was a concern.

Passive discovery of OT assets without touching production
Purdue-model segmentation design and industrial firewall rules
Secure remote access for vendors with session recording

Result: A mapped, segmented network with a prioritised remediation plan the plant team could schedule.

Government authorityNCA ECC programme

NCA ECC gap assessment and remediation roadmap

The authority had to demonstrate compliance with the NCA Essential Cybersecurity Controls and did not know where to start.

Control-by-control gap assessment
Policy and procedure set aligned to ECC
A phased remediation roadmap with owners and dates

Result: A clear compliance position, a funded roadmap and audit-ready evidence.

Client names are withheld for confidentiality.

09Related services

Explore more from this practice

Each service stands alone and works better with the others.

Do you know whether your team would spot a real attack?

Tell us your sector and your objective. We will design a scenario and a plan, with leadership agreement before anything starts.

Plan a red team exercise

Confidential by default
Arabic and English reporting
Findings you can act on

10Questions answered

Red Team Exercises FAQs

What is the difference between red teaming and penetration testing?

A penetration test looks for as many weaknesses as possible in a defined scope. A red team exercise pursues a goal, such as reaching a sensitive system, using stealthy realistic techniques to test your detection and response as well as your defences.

What is SAMA FEER?

FEER is SAMA's Financial Entities Ethical Red Teaming Framework, adopted in May 2019. It describes how threat-intelligence-led red team exercises are run against live production systems in the financial sector, using certified providers.

What is a purple team exercise?

A purple team exercise brings attackers (red) and defenders (blue) together to replay attack techniques and tune detections in real time, so improvements happen during the exercise.

Who in the company knows about a red team exercise?

Only a small control group, usually the CISO and a senior executive. This tests how the organisation really reacts, while the control group can stop the exercise if needed.

Is a red team exercise safe for production?

Yes, when controlled. We agree rules of engagement, avoid destructive actions, monitor continuously and have an emergency stop.

How long does a red team exercise take?

Typically six to ten weeks including planning, attack, workshop and reporting.

Is red teaming suitable for smaller organisations?

It is most valuable for organisations with an established security team and monitoring. Others usually gain more from penetration testing first.

Talk to a red team specialist

Tell us about your environment and what you need. We will respond with a scoped proposal, not a brochure.

Why GoAgile for Red Team Exercises?

Specialists who do this work every week, reporting in Arabic and English.

Aligned to NCA, SAMA and the PDPL
Arabic and English reporting
Certified practices, ISO 27001
Confidential by default

+966 53 534 5103
contact@goagiletechnologies.com

First Name *

Last Name *

Email ID *

Organization

Service of interest

Country *

I have read GoAgile Technologies’s Privacy Statement and agree to the Terms of Use*

By providing your contact information and clicking ‘submit’, you authorize GoAgile Technologies to store your contact details and reach out regarding your enquiry.