Adversary Emulation: The Extra Spice For Red Teaming

Today, organisations have several different options for testing their security defences (see the table at the end of this article for a quick description of the possibilities). Red teaming is becoming a standard approach to proactively identify vulnerabilities and strengthen defences before adversaries strike. Frameworks such as TIBER (threat intelligence based ethical red-teaming) and ART (advanced red teaming) have raised the bar for threat-actor centred scenarios. And yet, even when simulating a specific threat actor, red team operators use familiar tools and instincts. It's essentially a simulation of the threat actor, as seen through the eyes of a red team operator.

Adversary emulation adds the missing flavour–the extra spice–to red teaming by introducing high-fidelity, repeatable baselines of real-world TTPs (tactics, techniques and procedures) into the organisation’s network. In practice, this means we safely deploy representative malware chains so your controls are tested against the actual behaviours of the groups most likely to target you. As a result, organisations gain:

• A validated baseline confirming that detection rules, endpoint controls, and SIEM alerts trigger as intended, while revealing monitoring and detection gaps that real attackers could exploit.
• More strategic red teaming so operators can focus on complex, creative attack paths while commodity TTPs are validated automatically.
• Actionable, threat-specific findings rather than generic vulnerability lists.

Threat actors are becoming less predictable, particularly nation-state groups whose tactics differ markedly from cybercrime gangs. Generic testing may catch common ransomware patterns, but it can miss the subtleties that let an APT persist.

Our adversary emulation strategy is based on insights by Northwave’s cyber threat intelligence and research teams. We continually analyse the entire threat landscape and individual threats (by sector, systems, etc.) to provide our customers with the best coverage against their unique threats. Combining CTI-driven emulation with human red teaming provides both authenticity and ingenuity for a clearer view of risk and a faster route to intervention.

Why Emulation Matters: A Real-World Example

A recent client case offers a clear example of the benefits of adversary emulation. The client had a strong cyber defence system with both generic as well as targeted measures. A threat intelligence analysis by our CTI team recommended an APT 28 simulation. In doing so, our red team uncovered several weaknesses and ultimately achieved compromise. Of course, this provided useful insights for the security team.

But when we added adversary emulation by deploying a full APT 28 malware chain the picture changed dramatically. Within hours, at a fraction of the red team cost, the emulation uncovered additional areas where the customer had very little coverage or had their rules too loosely configured. Issues that would have left the organisation exposed to this very threat actor and were undetected during the red team exercise.

The outcome: a richer, more relevant set of findings feeding directly into a purple team session, giving the client both strategic reassurance and a tactical roadmap.