# Adversary simulation preparation guide

Bring the business concern and operational constraints to scoping. SilentGrid and the commissioning team agree the objective, authorised scope and evidence to collect, and who can make decisions while the exercise runs.

Use the companion worksheet to record owners and decisions still to be made. Keep system names, credentials, access instructions and incident information in approved internal records; general descriptions or references are enough for the worksheet.

Bring unresolved questions to scoping and identify who can help answer them. Authorisation and arrangements for pausing or stopping the exercise must be agreed before execution begins.

## Before scoping: bring the question and its context

Describe the concern leadership wants to test, such as fraudulent payments, access to customer information or disruption to a critical function. Explain how proposed techniques or technical targets, such as domain administrator access, relate to that business outcome.

Identify the business function and the decision the findings should support. That might be an investment decision, a change to an approval process, or a test of whether incident response interrupts an attack. Include any regulatory requirement, such as a [CORIE engagement](https://www.silentgrid.com/adversary-simulation/corie), and the date by which the result is needed.

Outline the environment supporting that function, including relevant cloud services, identity systems and suppliers. Existing assessment findings and known visibility gaps can help explain the starting position. Discuss how known weaknesses affect the question and scope; they do not all need to be fixed before scoping.

Identify the sponsor, the people who can authorise testing, and someone who understands operational constraints. An outsourced detection or response provider may also affect the arrangements. Initial conversations can establish who needs to contribute to later decisions without every participant attending.

The [red team scoping questions](https://www.silentgrid.com/resources/scoping/red-team) explain the information a consultant asks for and why. If the engagement itself is still undecided, [Which security test do you need?](https://www.silentgrid.com/which-security-test) recommends a starting point from organisational maturity and circumstances.

## At scoping: agree the objective and how to test it

SilentGrid's activity planning starts with the objective and the evidence it should produce. Agree the authorised scope, exclusions, starting position and acceptable proof together. A preferred attack path can change as the exercise develops, while an excluded system remains outside the authorised scope.

Decide whether the exercise should include obtaining initial access or begin from agreed access. Testing an external entry path can establish how a foothold is obtained. Assumed breach concentrates on what an attacker could do from the supplied position; it cannot establish whether the initial compromise would have been prevented.

Defender involvement affects who needs to know about the exercise, who needs time set aside and what conclusions can be drawn about their response.

- For a covert red team exercise, agree a small Control Group that knows the exercise is running, can make risk decisions and can contact the operators. Agree how the group will confirm exercise activity if defenders escalate, without revealing the exercise unnecessarily.
- For collaborative purple teaming, arrange participation by the defensive team and the people who can examine telemetry, change detection rules and replay techniques.
- For assumed breach, agree the foothold and access arrangements that match the scenario. A compromised endpoint, cloud identity or developer account creates different opportunities and limits.

Assumed access can support either covert testing or collaborative work, and an optional purple team replay can follow a red team exercise. Record the agreed combination of starting access and defender involvement.

Agree the permitted proof and its limits before execution. Demonstrating access, a screenshot or a test file may establish the result without transferring real information or performing the business action.

## A fictional planning example

This fictional example does not describe a SilentGrid client engagement or prescribe an exercise.

| Planning step | Example |
|---|---|
| Business concern | A compromised staff account could bypass payment approval controls. |
| Exercise objective | Establish whether an attacker starting from that account could bypass the separation of duties for payment approval, and whether defenders detect and interrupt the path. |
| Proposed safe evidence | Agree a demonstration of an unauthorised approval step against a test record, with screenshots as evidence. Exclude submitting or releasing a real payment. |
| Decision informed | Determine which access controls, approval arrangements or detections need changing, then decide how to verify the changes. |

The precise starting access and evidence would still need agreement. A result from one account or boundary should be interpreted within that scope.

## Before execution: settle authority and operational arrangements

Confirm who has authority over each part of the agreed scope and obtain any required third-party approval or notice. Permission for one environment does not establish permission for a supplier's systems. Social engineering and physical entry need explicit agreement where included.

Document exclusions, restricted periods and the approved approach to systems carrying high operational risk. Financial close, peak trading and change freezes may affect the timing. For red team engagements, SilentGrid requests approval before targeting systems or accounts with high operational risk. Identify who can make that decision.

Agree who can pause or stop the exercise and how they contact the operators. Establish how to reach operational staff during the testing window. Discuss what happens if a real incident occurs or defensive action risks disruption. For covert work, establish how the Control Group checks an escalation without unnecessarily disclosing the exercise to the defenders.

Identify the telemetry available for the agreed scope and who can retrieve it for analysis. Known gaps belong in the plan because they affect interpretation: an action that was not logged is a different finding from an action that was logged but missed. Check whether a managed security provider requires notice under its contract, and agree what that means for testing its response.

Where access is supplied, agree the identity, device and privileges that represent the scenario with the responsible owner. Account naming, group memberships, multi-factor authentication and application access should match the modelled role. An unusual account name or conspicuous new device can [alert defenders before the scenario starts](https://www.ncsc.gov.uk/guidance/adversary-simulation-what-you-need-to-know). Record the changes needed to enable that access so the findings reflect the conditions tested. Keep actual access details in approved internal records.

## After the exercise: arrange action and verification

Decide who needs the findings before the exercise finishes. Leadership needs the business impact and decisions; technical owners need the attack path and the changes required. SilentGrid holds separate executive and technical debriefs for red team engagements, with exercise evidence circulated on a need-to-know basis.

Assign someone to prioritise findings and coordinate action across system, identity and defensive teams. Agree how those owners will record remediation and what evidence will verify that each change worked. Track deployment separately from verification.

Discuss retesting and any purple team replay at scoping. Replay can verify that changed detections and response measures fire when the relevant attack is repeated. Broader changes may need another scenario or a subsequent exercise to test the remaining path.

For an [annual program](https://www.silentgrid.com/annual-programs) or [CAOS (Continuous Adversary Operations Service)](https://www.silentgrid.com/continuous-red-teaming), carry outstanding actions and verified changes into planning for the next cycle. The next exercise can then test what changed and address the remaining questions. Cadence, follow-up scope and participation are agreed for the engagement.

Preparation worksheet (fillable PDF): https://www.silentgrid.com/resources/adversary-readiness.pdf

https://www.silentgrid.com/contact

SilentGrid · 13 October 2026
Free planning resource. No email required.