RED TEAMING · ADVERSARY SIMULATION · AUTHORIZED EXERCISES
Safematix runs authorized red-team and adversary-simulation exercises that examine how people, process and technology hold up together against a realistic intrusion attempt. The engagement is agreed in writing, observed by your own teams and closed with a detection-focused debrief—so the result is evidence about your defense, not a story about an attacker.
AT A GLANCE
01 / BUYER FIT
A penetration test answers whether a defined system can be broken. A red-team exercise answers whether your organization notices, contains and responds when someone tries in a realistic sequence. It needs a defense that is prepared to be examined, not only a target to be tested.
01
You have prevention measures, logging and a response team, but little evidence about how they behave against a thinking adversary. An exercise produces that evidence: which steps were noticed, which alerts fired, how long a decision took and where the response stalled. Gaps become findings with an owner, not a general impression.
02
A framework review or questionnaire can describe intent; an exercise shows how the agreed processes are actually exercised. Safematix documents what was attempted, what was observed and what the defense concluded, so the result can be discussed with an auditor or risk owner without being presented as a certification or regulatory approval.
03
A migration, acquisition, new cloud estate or remote-working model can create paths that no single team sees in full. An exercise follows those paths across organizational boundaries and shows where ownership, monitoring or segmentation assumptions no longer hold.
04
Ransomware, credential theft, business-email compromise and supplier abuse are discussed often and rehearsed rarely. Within an agreed scope, Safematix can simulate the relevant behavior with controlled, non-destructive stand-ins, so your teams practice the decision instead of reading about it.
02 / CAPABILITIES
Every exercise selects from the work below and fixes its limits in writing. The absence of a fixed package is deliberate: a red-team exercise is scoped around your environment, your detection capability and the decision you need to support, not sold as a catalog item.
01
Safematix plans a realistic intrusion path across the elements an attacker would actually use—identities, exposed services, user trust, supplier relationships and physical or organizational process. The exercise examines whether those elements combine into a route that your organization would notice and stop, rather than testing each in isolation.
02
The agreed behavior is modeled on a documented threat relevant to your sector, with the techniques, timing and noise level stated before the exercise begins. Safematix records which technique was used at each step so your detection team can compare its telemetry against what actually happened, not against a generic report.
03
Where the written scope includes it, Safematix can deploy controlled, non-destructive stand-ins that imitate malware or ransomware behavior—execution, persistence, credential access, encryption of disposable test data—inside an isolated environment agreed in advance. These are simulations with an explicit kill switch and a named abort contact, not real malicious code, and they never leave the agreed boundary.
04
After the exercise, Safematix works through the timeline with your detection and response teams: which events were visible, which rules produced noise, which alerts went unread and where the escalation path broke. The output connects each observation to a concrete detection, process or ownership change.
03 / DELIVERABLES
The exercise produces two audiences and two levels of detail: a decision record for management and a technical record for detection engineering, response and infrastructure teams. Coverage limits and the rules of engagement stay visible in both.
01
The agreed targets, techniques, time windows, abort conditions, contacts and evidence handling, signed by an authorized representative before any activity begins. This document is also the reference for what the exercise may and may not do; anything outside it is not performed.
02
A step-by-step account of what was attempted, what succeeded, what failed and when, mapped to the techniques stated in the scope. The narrative distinguishes demonstrated access from assumptions and marks each point where a defensive control or a human decision changed the outcome.
03
A record of the telemetry, alerts and escalations observed during the exercise, including the gaps. It shows how long each stage remained undetected and which signals would have shortened that time, giving detection engineering a prioritized basis for rule and log-source work.
04
Each finding states the observed condition, its practical significance, the affected control and a criterion for checking an improvement. Findings cover technical, procedural and organizational weaknesses, because an exercise that only reports missing patches has not tested the defense that was commissioned.
05
A structured debrief with the teams involved, separating what was demonstrated from what remains untested. Where agreed, Safematix also runs a remediation workshop to turn the findings into an ordered plan, and can retest the agreed improvements in a separate, explicitly scoped engagement.
04 / EXPERIENCE
You work directly with Robert Ressl. His public CV documents offensive-security leadership and delivery in regulated environments; these are descriptions of his background, not invented customer results or claims about your organization’s readiness.
Robert’s public CV documents global offensive-security leadership and work in FINMA, DORA and TLPT environments. That is experience with the documentation, authorization and evidence expectations of regulated exercises—not regulatory approval, independent certification or a guarantee that a client’s organization meets its obligations.
The work connects intrusion technique with the telemetry it produces. Robert’s background spans infrastructure, cloud and application security, so an exercise can be planned around what is technically reachable and then examined against what your monitoring can realistically observe.
Robert publishes tooling, model artifacts and engineering material, including AI-security work around MCP tool use. That hands-on background is what makes a scenario credible: the simulated steps are ones an engineer can actually build, not a list copied from a framework.
05 / Approach
The exercise is planned like an operation and documented like an audit. Each step fixes what is authorized, what will be observed and who decides when to stop.
Safematix clarifies which decision the exercise should support, which parts of the organization are in view and what detection and response capability exists. Safematix agrees the threat model, the techniques in scope and the questions the exercise will not answer.
Your responsibility Name the decision owner and the defensive teams involved, and describe the environment at a level sufficient for planning.
Before any activity, the authorized representative signs the rules of engagement: targets, techniques, windows, abort conditions, escalation contacts and evidence handling. Safematix confirms the safe stand-ins for any malware or ransomware simulation and the isolated environment that contains them.
Your responsibility Sign the authorization, confirm the named contacts and provide the agreed access and environment for the exercise.
Safematix follows the agreed path and records each step with its timestamp, technique and observed effect. The exercise stops at the documented evidence boundary and at any abort condition; if observed behavior differs from the plan, work pauses until the decision owner confirms how to continue.
Your responsibility Keep the agreed contacts reachable, observe through your own telemetry and raise an abort when required.
Safematix walks through the timeline with detection, response and infrastructure teams, then delivers findings with owners and fix criteria. The debrief separates demonstrated weaknesses from untested areas and leaves your organization with an ordered plan it can verify.
Your responsibility Attend the debrief, confirm ownership of the findings and decide which improvements to schedule and verify.
06 / COMMERCIAL TERMS
Red-team and adversary-simulation work is quoted against the agreed objective, environment, techniques and observation window rather than sold as a fixed package. Safematix confirms scope, authorization requirements, deliverables, responsibilities, verification, fees and the start date in writing. The published day rates provide the commercial starting point; the applicable rate and effort are confirmed in the offer.
Flexible engagements: CHF 2’200 per working day. Longer, clearly scoped remote projects: CHF 2’000–2’100. Short-notice OT, red-team, and high-security engagements: CHF 2’400–2’600, subject to scope. Package prices are fixed-scope equivalents at CHF 1’850–2’100 per working day; the day rate applies when the scope cannot be fixed in advance.
All package prices and day rates exclude applicable VAT and pre-approved travel and third-party costs, unless expressly included in the order form. Fixed-price packages apply within their stated scope. Scope, authorization, and start date are confirmed in writing before work begins. Regulatory mapping is technical, not legal advice. Savings and compliance outcomes are not guaranteed.
Discuss an exercise07 / FAQ
No. A penetration test examines exploitable weaknesses inside a defined technical scope, usually one application or system. A red-team exercise tests the defense as a whole—whether people, process and technology notice and contain a realistic sequence of actions. The two can complement each other, and Safematix will state in writing which one the engagement covers.
An authorized representative of the organization that owns the targets must agree the scope and sign the rules of engagement before any activity. Where infrastructure or services belong to a third party, their agreement is required as well. Safematix does not begin an exercise on an informal instruction, and does not perform work outside the signed boundary.
The rules of engagement fix the techniques, time windows and any environment that must not be touched. Safematix plans around availability, uses controlled non-destructive stand-ins where behavior must be simulated, and stops at the documented evidence boundary. Availability and change freezes are agreed beforehand, and an abort condition can end activity immediately.
It uses controlled stand-ins that imitate the relevant behavior inside an isolated environment agreed in advance, with a documented kill switch, a named abort contact and no reach into production systems or third-party infrastructure. The simulation is not real malicious code and is never left behind; the report describes what was simulated and how it was contained.
That depends on the objective and is decided in writing. A full-surprise exercise tests detection and escalation as they are; a notified exercise lets response teams rehearse a specific scenario. Most engagements use a hybrid: a small set of named contacts knows the window, the rest of the organization does not. Safematix documents which model was chosen and why.
Describe the decision the exercise should support, the parts of the organization in view and any legal, regulatory or availability constraints. You do not need to send a complete network diagram to begin. Please keep credentials, live architecture details and incident information out of the initial form; secure sharing can be agreed during scoping. I reply personally, usually within one business day (Mon–Fri, CET).
08 / Contact
Tell Safematix what the exercise should establish, which parts of the organization are in view and what constrains the work. Safematix can then propose a scope, a technique set and a written authorization path. Keep credentials, architecture details and incident information out of the first message.
Discuss an exercise