Adversary Simulation

Adversary simulation is a red team assessment in which the scenario is constrained by threat intelligence rather than chosen by the operators. A full-scope red team lets us pick the most effective route to the objective. A simulation requires us to move the way a specific category of attacker moves, even where an easier path exists.

The distinction matters because attackers are not interchangeable. A ransomware affiliate, a state-aligned espionage group and a malicious insider move differently, want different things and are caught by different controls. The simulation tests you against the one that is plausibly interested in you.

Everything else is shared with a full-scope engagement: one agreed objective, defenders not told, rules of engagement, a white team, and MITRE ATT&CK mapping of every technique in the deliverable.

No, we hold no accreditation under TIBER-EU or ART, and no provider of adversary simulation should tell you otherwise unless they can name the authority that issued it. Both are supervisory programmes run by central banks, not vendor certifications.

What we do claim is narrower and honest. RedTeam Security has EU and US roots, so our method is built on the sequence those standards fix: generic threat landscape, targeted intelligence, scenario, execution, closure. That shape is the discipline our heritage brings, and it is what lets us show a UAE regulator how the scenario was chosen.

The easiest way to test any proposal for adversary simulation is to ask which authority accredited the provider and under which programme. The answer tells you whether you are reading a description of method or a sales claim.

The threat actor an adversary simulation models comes out of a threat profile built from your sector, your region, your asset profile and your exposure, cross-referenced with documented group activity. It is an output of the intelligence phase, not an input to it.

Regional fluency matters here in a practical way. The groups active against UAE finance, government, aviation and critical infrastructure are not identical to those modelled by default in a European or North American engagement, and the supplier ecosystems that shape an attack path in this region are local.

We show you the reasoning before the scenario is built, because a scenario whose choice you cannot defend is not much use to your board. The profile is produced and shown to you before execution is scoped.

TIBER-EU and Advanced Red Teaming are two regulator-run programmes for threat-intelligence-led adversary simulation of financial entities. They share the same reasoning and a similar shape, and differ in who runs them and where. MITRE ATT&CK, which sits beside them in most proposals, is neither.

TIBER-EU

The European framework published by the ECB and run by national central banks. It fixes the sequence: generic threat landscape, targeted intelligence, scenario, execution, closure.

ART

Advanced Red Teaming, published by De Nederlandsche Bank in 2024 for the Netherlands. It builds on TIBER-EU and the Bank of England's CBEST and is aligned to threat-led penetration testing under DORA, with its own governance.

MITRE ATT&CK

Not a programme and not a testing framework. It is the technique taxonomy the industry writes findings in, and every technique we use is mapped to it so one engagement compares with the next.

Our method is built on the TIBER-EU and ART sequence and we hold no accreditation under either. Neither is a UAE requirement: in the UAE the governing rules are the local regimes, and we map the engagement to their wording rather than to a European label.

Adversary simulation usually costs somewhat more than a standard red team engagement, because the intelligence phase is real work rather than a paragraph in the proposal. The threat profile, the scenario design and your sign-off all happen before execution is scoped.

Whether the difference is worth paying depends on the question you need answered. If the question is whether you could be breached, a full-scope red team answers it. If the question is whether you could be breached by the people actually interested in you, only a simulation does.

Every engagement is quoted individually against the objective, the scope and the tempo the modelled adversary requires.

A threat-intelligence-led adversary simulation typically takes eight to twelve weeks, against six to ten for a full-scope red team assessment. The extra time goes on the threat profiling and scenario design that precede execution, and on the tempo of the execution itself.

Simulations often run slower than standard engagements by design. The modelled adversary is patient, and testing your detection at their tempo is the point. An espionage-style intrusion that is quiet for weeks measures dwell time in a way a fast engagement cannot.

The six steps above set the order: threat profiling, scenario design, scenario approval, execution, detection and response validation, then debrief and mapping. The scenario is signed off by you before anything runs.

An adversary simulation can emulate a specific named group where its tradecraft is documented and publicly attributed. We build the scenario from that observed behaviour and map it technique by technique to MITRE ATT&CK.

What we will not do is claim certainty about attribution that the public record does not support, or imply we have intelligence sources we do not have. Scenarios are derived from attributable tradecraft, never from invented capability.

If the group you are worried about is in the news, bring the reporting. We will tell you what of it is documented well enough to simulate, and what would be guesswork.

Where a UAE regulator expects a red team exercise, a threat-intelligence-led adversary simulation is generally the shape supervisors have in mind, because it evidences that the scenario was chosen for a reason. That applies to institutions licensed by the CBUAE and, with different wording, to entities under the ISR, ADHICS and the UAE IAS.

The methodology sits on a separate axis from the Gulf regimes. The EU standards our method is built on, TIBER-EU and ART, tell you how to structure an intelligence-led test. The CBUAE, DESC, the Department of Health Abu Dhabi and NESA tell you whether one is expected and what evidence they want to see.

Bring us the specific wording from your regulator and we will map the engagement to it honestly, in writing, before a proposal goes out. We will also say plainly where it does not fit.

The adversaries most often emulated in an adversary simulation are the six listed above: the ransomware affiliate, the espionage-style intrusion, supply chain compromise, the malicious insider, business email compromise and edge device exploitation. Which one you get is decided by the intelligence, not by us.

Ransomware affiliate

Fast, noisy and financially motivated. Tests whether you detect and contain before encryption would begin, which is a timing question.

Espionage-style intrusion

Slow, quiet and persistent. Tests dwell time and whether long-lived access is ever noticed at all.

Supply chain compromise

Entry through a trusted third party with legitimate access. The path most organisations have never tested, and directly relevant to supplier scope under the ISR.

Malicious insider

Legitimate credentials, legitimate access, illegitimate intent. Almost invisible to perimeter thinking, and usually run from an assumed breach starting position.

Scenario approval in an adversary simulation means you see and sign off the scenario and the rules of engagement before anything runs, while your defenders see neither. It is the third of the six steps above and nothing is executed until it is complete.

You receive the threat profile with its reasoning, the modelled group and the documented tradecraft the scenario is built from, and the objectives chosen to match what that group would actually want. You can push back on any of it.

The white team that holds the approval is small, two to four reachable people, because the measurement depends on the SOC not knowing. Approval is a written record you can show a regulator who asks how the scenario was chosen.

Yes, an adversary simulation can be re-based as the threat landscape changes without rebuilding the whole engagement. The intelligence phase is re-run, the threat profile is refreshed, and the scenario is updated to the tradecraft now in use.

Because every technique in the deliverable is mapped to MITRE ATT&CK, the second run is comparable with the first. You can see which detection gaps closed, which stayed open, and which are new because the modelled group changed its methods.

The cadence is the same as any red team assessment: yearly is common, sooner after a material change, and later if the detection work from the last run has not landed. A purple session between runs turns the gaps into detection content.