Red Team ServicesCovert Adversary Emulation That Tests Whether Your Defenses Hold Against a Real Intruder
Red team services are covert, objective-based security engagements in which experienced operators emulate a real adversary against your organization, pursuing agreed goals such as reaching regulated data or taking control of the domain, without warning your defenders. Unlike a penetration test, which catalogs vulnerabilities, a red team engagement tests whether your people, processes, and detection tools can recognize and stop a determined intruder who is trying not to be seen. The deliverable is an attack narrative and a detection timeline, not a vulnerability list. Petronella Technology Group has tested and defended regulated networks in Raleigh and nationwide since 2002, and this page explains what red teaming services include, how they differ from penetration testing and purple teaming, and how to scope an engagement your board and assessor can both use.
Last Updated: October 26, 2026
- Red teaming tests the whole defense, not a list of hosts. A penetration test asks "what is vulnerable?" A red team engagement asks "can a realistic adversary reach this objective, and does anyone notice?" People, process, and technology are tested together.
- It is covert by design. Only a small control group, the white cell, knows the engagement is running. Your SOC, help desk, and IT staff respond as they would to a real intrusion, which is the only way to measure how detection and response actually perform.
- The unit of success is the objective, or "trophy." Objectives represent real business harm: reading controlled unclassified information, moving money through the finance system, reaching the production network. The report says which were reached, how, and what was seen along the way.
- Every action maps to MITRE ATT&CK. Operators record the tactic and technique for each step, so the detection timeline can be compared against your telemetry and turned into a detection-engineering backlog that a later purple team exercise or retest can measure against.
- It supports compliance without being named by it. CMMC Level 2, NIST SP 800-171, PCI DSS, HIPAA, and SOC 2 each call for periodic assessment of controls and monitoring that detects attacks. A red team report is strong evidence for both, in a form assessors recognize.
What Are Red Team Services?
Red team services are professional engagements in which a trusted team of offensive security operators plays the role of a specific, realistic adversary and attempts to achieve defined objectives inside your organization while avoiding detection. The term comes from military exercises, where a "red team" plays the opposing force so the "blue team" can be tested under realistic conditions. In red team cybersecurity work, the opposing force uses the same tradecraft a criminal group or state-sponsored actor would use, under written authorization, with safety controls, and with the goal of producing evidence rather than damage.
The defining features are covertness and objectives. Covertness means your defenders are not told the exercise is happening, so their reaction to each phishing email, unusual login, and lateral movement attempt is genuine. Objectives mean the engagement is judged by whether the team reached specific trophies agreed in scoping: reading a share that holds controlled unclassified information, obtaining domain administrator rights, accessing the electronic health record database, approving a fraudulent payment, or reaching a segment that controls physical equipment. A penetration test that found a long list of vulnerabilities but never reached a trophy would succeed as a penetration test and fail as a red team assessment, because the two measure different things.
Red team services are often described as adversary emulation or adversary simulation. Adversary emulation means the operators model a named threat actor or threat profile and reproduce its known tactics, techniques, and procedures, so the result shows how you would fare against the adversaries most likely to target your industry. Adversary simulation is the broader term for any engagement in which attacker behavior is imitated rather than scanned for. Red team as a service is the delivery model in which this capability is retained on an ongoing basis: smaller, scoped operations across the year, each feeding the detection backlog and the next operation. For regulated small and mid-sized businesses and defense contractors, who rarely have offensive specialists on staff, that model turns a red team exercise from an event into a program.
Detection is assumed
EDR is installed, logs reach the SIEM, the SOC is staffed. Whether any of it catches an intruder using valid credentials and built-in tools has never been tested.
Response is a document
The plan lists roles and a tabletop was held. Nobody knows whether the on-call analyst escalates an odd authentication late at night or closes it as noise.
Risk is argued
Leadership hears the network is "probably fine." The board has no way to evaluate the claim.
Detection is measured
You know which techniques were alerted, which were logged and ignored, and which were invisible, with timestamps from both sides.
Response is observed
You know what the analyst did when the alert fired, and whether containment stopped the operator or just moved them to a second foothold.
Risk is shown
The board reads a plain-language narrative: how the adversary reached payroll, where they could have been stopped, and what it costs to close each gap.
Red Team vs Penetration Test vs Purple Team
The red team vs penetration testing question comes up in nearly every scoping call, and the honest answer is that they are different tools for different stages of a security program. A penetration test finds and exploits exposures. A red team assessment measures whether a realistic adversary can reach an objective without being caught. A purple team exercise removes stealth so attackers and defenders can tune detections together.
| Factor | Red Team Engagement | Penetration Test | Purple Team Exercise |
|---|---|---|---|
| Objective | Reach business-impact trophies while avoiding detection, as a named adversary would | Find and safely exploit as many vulnerabilities as the scope allows | Measure and improve detection coverage for a defined technique set |
| Knowledge of defenders | Not told; only a small white cell is aware | Usually informed; may whitelist the tester | Participate in the open and watch each technique run |
| Scope | Objective-driven: the whole organization, including people, physical access, and cloud identity, with explicit exclusions | Asset-driven: an external range, an internal segment, an application, a cloud tenant | Technique-driven: a list drawn from MITRE ATT&CK and your threat profile |
| Duration character | Longer and paced to stay quiet; operators wait and act when timing favors them | Compressed and systematic; covers the scope as thoroughly as the window allows | Session-based; techniques are run, scored, tuned, and re-run |
| Deliverable | Attack narrative, detection timeline against SOC response, root-cause findings, ATT&CK heat map, backlog | Findings ranked by severity with proof of exploitation and remediation steps | Per-technique coverage scores, tuning applied with evidence, backlog |
| Best for | Organizations with monitoring in place that want to know whether the whole program holds | Any organization, especially as the first assessment or to satisfy a testing requirement | Organizations with EDR, XDR, or a SIEM to tune against real techniques |
| What it proves | Whether people, process, and technology together can stop a realistic adversary before the objective is reached | Which exposures exist and how far each can be exploited | Which specific techniques your detection stack sees, and which it does not |
A useful rule: if you have never had a penetration test, start there, because a red team will simply walk through the exposures a test would have found. If you have had tests and deployed detection tooling, a red team engagement is the right next step. Once the report identifies detection gaps, a purple team exercise closes them, and a later retest proves they stayed closed. Automated breach and attack simulation platforms, which replay known technique libraries on a schedule, complement this cycle but do not replace human operators who adapt to what they find.
When a Red Team Engagement Is the Right Test
Red teaming is the most demanding assessment an organization can commission, and it pays off in specific situations. If you have no centralized logging and no endpoint detection, the engagement will record that nothing was seen, which you already know. These are the situations where a red team assessment changes what you do next.
Your detection program is mature and untested as a whole
EDR on endpoints, logs in a SIEM, a SOC watching alerts. Each piece has been tested alone. Nobody has tested whether they work together against an intruder using valid credentials, built-in tools, and patience.
You handle CUI, cardholder data, or protected health information
Defense contractors under CMMC, merchants under PCI DSS, and covered entities under HIPAA face adversaries who target the regulated data. An engagement with that data as the trophy shows whether your controls protect it in practice, not just on the System Security Plan.
Your penetration tests keep coming back clean
A clean test can mean the environment is well hardened, or that the test was scoped narrowly and announced. An engagement that includes phishing, physical access, and cloud identity will show which explanation is correct.
You recovered from an incident and want to know whether it could recur
The forensic report names the adversary's techniques. Emulating the same adversary against the rebuilt environment proves to leadership, insurers, and regulators that the gap is closed, rather than asserting it.
You outsource monitoring and want independent verification
A managed SOC or MDR provider promises detection and response. A covert engagement, coordinated only with your white cell, measures what they actually detect, how quickly they escalate, and whether the escalation reaches the right person.
The board or a customer is asking a question you cannot answer
"Could an attacker get to our customer database?" is a reasonable question, and "our last scan was clean" is not an answer. A red team report gives leadership a narrative they can follow and a costed plan for what did not hold.
How a Red Team Engagement Works, Phase by Phase
A red team engagement follows the structure of a real intrusion, with planning and safety work wrapped around it. Each technical phase corresponds to one or more MITRE ATT&CK tactics, and operators record the tactic and technique for every action so the engagement can be reconstructed against your telemetry.
Scoping and objectivesWe agree on the trophies: the data, systems, or actions that would represent real harm, written so that reaching them is unambiguous, for example "read a named file in the CUI share" rather than "access sensitive data."
Rules of engagement and the white cellA small group of trusted agents on your side knows the engagement is running, approves risky steps, deconflicts with real incidents, and holds stop authority. Everyone else responds normally. The written rules cover scope, exclusions, hours, and data handling.
Threat intelligence and adversary profileUsing current threat intelligence for your industry, we select the adversary to emulate: the initial access methods, tooling, and objectives of the groups most likely to target a defense supplier, a medical group, or a financial firm. The profile keeps the result realistic rather than unlimited.
ReconnaissanceATT&CK Reconnaissance and Resource Development. Operators gather open-source intelligence: staff names and roles, email formats, vendors named in job postings, exposed services, cloud tenants, leaked credentials, and physical details of your sites. Phishing and command-and-control infrastructure is built to resemble legitimate traffic.
Initial accessATT&CK Initial Access. Depending on the profile, operators send targeted phishing, exploit an exposed external service, attempt physical entry to plant a device, or begin from an assumed-breach position on a standard workstation you provide. Most engagements pursue more than one path.
Persistence and command and controlATT&CK Persistence and Command and Control. Operators establish a way back in that survives reboots and password changes, and a covert channel to control it, often over encrypted web traffic. Egress filtering, DNS monitoring, and beaconing detection are tested here.
Privilege escalation and lateral movementATT&CK Privilege Escalation, Defense Evasion, Credential Access, Discovery, and Lateral Movement. Operators harvest credentials from memory and configuration files, abuse misconfigured permissions, and move between systems using the same administrative tools your IT staff use.
Objective actionsATT&CK Collection, Exfiltration, and Impact. Operators reach the agreed trophies: reading protected data, demonstrating domain dominance, reaching the operational technology segment, or showing they could approve a payment in the finance system. Destructive actions are demonstrated to the white cell, never executed.
Detection avoidance measured against the SOCEvery action is logged with host, account, command, and timestamp. That log is then laid against your SIEM, EDR, and SOC ticketing data to show which actions were alerted, logged but not acted on, or invisible, and what the analyst did when something fired.
Debrief and replayOperators and defenders meet, now in the open, and walk through the engagement step by step. Missed techniques are replayed so the blue team sees exactly what their console showed. The replay hands off to a purple team exercise and the detection backlog.
Find Out Whether a Realistic Adversary Could Reach Your Most Important Systems
Petronella Technology Group scopes red team engagements for defense contractors, healthcare organizations, financial firms, and other regulated businesses in Raleigh, Durham, the Research Triangle, and nationwide. A scoping conversation covers your detection tooling, the trophies that matter, and the adversary profile that fits your industry, and ends with a written proposal and draft rules of engagement.
What the Red Team Report Contains
A red team report is read by executives who need to understand the risk, engineers who need to close the gaps, and assessors who need evidence. It is organized by the path the adversary took, not by host.
Attack narrative and timeline
A chronological account from first reconnaissance to the final trophy, in plain English with screenshots and command evidence. Each step names the ATT&CK tactic and technique, the host and account, and the decision the operator made.
Detection timeline versus SOC response
The operator's log laid beside your telemetry and ticket history. For each action: alerted, logged only, or invisible; when a human saw it; what they did; and whether it stopped the operator. This is the basis for every detection recommendation.
Findings organized by root cause
Findings are grouped by the weakness that allowed a phase to succeed: credential reuse, excessive local administrator rights, missing egress filtering, a log source never collected, an alert routed to nobody. Fixing the root cause closes a class of attacks.
MITRE ATT&CK heat map
Every technique used, colored by whether it was alerted, logged, or invisible, across the tactics of the framework. It shows at a glance where visibility is strong and where it is absent, and gives you a baseline for the next engagement.
Remediation and detection-engineering backlog
Prioritized work in two lists: hardening changes that remove the weakness, and detection changes that would have caught the technique. Each item names the control, the log source or rule, and the trophy it protects.
Executive summary
A short, non-technical account of the adversary profile, which objectives were reached, how far detection and response got, and what to fund first. Written for a board or an owner who needs to make a decision.
Retest and verification plan
A defined scope for confirming the backlog was completed: which techniques will be replayed, which detections must fire, and which trophies must be unreachable. The retest can be a focused red team operation, a purple team exercise, or both.
Indicators and cleanup record
Every artifact the operators left, including accounts, scheduled tasks, implants, and infrastructure, with confirmation that each was removed, so your team can distinguish engagement activity from real activity found later.
Rules of Engagement and Safety
A red team engagement is a controlled, authorized activity that deliberately resembles a crime. The paperwork and procedures around it make it legal, safe, and useful, and nothing operational begins until each of the following is in place.
Authorization letter
A signed letter from an officer with authority over the systems in scope, naming the engagement, dates, operators, and permitted activities. Operators carry a copy during physical phases. Without it the activity is unauthorized access.
Scope and exclusions
The systems, cloud tenants, people, and sites in scope, and explicit exclusions: production medical devices, safety systems, third-party environments you do not own, individuals who should not be phished. Operators who find an unexpected path need to know immediately whether it is permitted.
Deconfliction
The white cell has a direct channel to the operators at all times. If your SOC escalates something, the white cell can confirm whether it is the red team or a real intruder without tipping off responders. If a real incident begins, operations pause.
Data handling
Reaching a trophy that contains regulated data is demonstrated with minimal access and recorded with file listings or redacted screenshots. Protected health information, cardholder data, and CUI are never copied off your systems. Captured credentials are stored encrypted and destroyed at close-out.
Stop conditions
Named triggers that pause or end the engagement: a production outage, a real incident, evidence of a prior compromise, a request from the white cell, or a boundary not anticipated in scoping. Operators never decide alone whether a risky step is acceptable.
Legal review
Where phishing, physical access, or employee-targeted social engineering is in scope, the rules are reviewed with your counsel and HR so the exercise respects employment law and privacy obligations. Findings about individuals are reported as process findings, not personnel findings.
Evidence handling follows forensic practice. Craig Petronella is a North Carolina Licensed Digital Forensics Examiner (License 604180-DFE) and a cybersecurity expert witness for law firms, and the chain-of-custody discipline from his digital forensics casework governs how operator logs, captured artifacts, and screenshots are collected, hashed, and stored. If an engagement uncovers evidence of a real prior compromise, which happens, that evidence is preserved to a standard a court would accept and the engagement transitions to incident response.
How Red Teaming Supports CMMC, NIST SP 800-171, PCI DSS, HIPAA, and SOC 2
No major framework uses the phrase "red team" as a requirement. Each of them, however, calls for two things a red team engagement produces: evidence that security controls are periodically assessed under realistic conditions, and evidence that monitoring detects attacks and unauthorized use. As a CyberAB Registered Provider Organization (RPO #1449), Petronella Technology Group maps each finding to the relevant control in ComplianceArmor so the report answers the assessor's questions directly.
| Framework | What the framework calls for | Reference | How the red team report supports it |
|---|---|---|---|
| CMMC Level 2 and NIST SP 800-171 Rev 2 | Periodically assess security controls for effectiveness; monitor systems to detect attacks and indicators of potential attacks; identify unauthorized use | Requirement 3.12.1; Requirements 3.14.6 and 3.14.7 | An independent assessment of control effectiveness against a realistic adversary. The detection timeline shows what monitoring detected, and credential abuse and lateral movement test exactly the unauthorized use the framework expects you to identify. See our CMMC compliance guide. |
| PCI DSS v4.0 | Perform external and internal penetration testing regularly and after significant changes, including segmentation validation; log and monitor access to system components and cardholder data | Requirement 11.4; Requirement 10.x logging and monitoring | An engagement with the cardholder data environment as the trophy exercises segmentation and access controls the way an attacker would, and shows whether logging produced alerts someone acted on. It supplements, and does not replace, the required PCI DSS penetration test. |
| HIPAA Security Rule | Conduct an accurate and thorough risk analysis of risks to electronic protected health information; perform periodic technical and nontechnical evaluation of safeguards | 45 CFR 164.308(a)(1)(ii)(A); 45 CFR 164.308(a)(8) | An engagement with the electronic health record or billing system as the trophy is a technical evaluation with a written result, and the root-cause findings feed the risk analysis as tested threats. See HIPAA compliance. |
| SOC 2 Trust Services Criteria | Perform ongoing or separate evaluations to ascertain whether controls are present and functioning; use detection and monitoring procedures to identify anomalies indicative of malicious acts | CC4.1; CC7.1 and CC7.2 | The report is a separate evaluation by an independent party, and the detection timeline speaks to the operating effectiveness an auditor tests. See SOC 2 compliance and SOC 2 controls. |
How Petronella Technology Group Runs Red Team Engagements
Petronella Technology Group was founded in Raleigh in 2002 and has spent 24+ years securing regulated small and mid-sized businesses and defense contractors. The company is a CyberAB Registered Provider Organization (RPO #1449), and its red team work is led by Craig Petronella, an MIT-certified cybersecurity professional, CMMC Registered Practitioner, CCNA, CWNE, North Carolina Licensed Digital Forensics Examiner (License 604180-DFE), and expert witness with 30+ years in the field. He is the author of 15 books, including How Hackers Can Crush Your Business and the CMMC 2.0 Certification Guide, and hosts the Encrypted Ambition podcast.
The same company operates a 24/7 Security Operations Center and the Managed XDR Suite. The operators who run red team engagements know what a defender sees in an EDR console because their colleagues watch those consoles every day, and the SOC engineers who tune detections know what an attacker tries next because they have watched the red team do it. For organizations using Petronella Technology Group's SOC as a service, the engagement can be run against that SOC with only the white cell aware, which is the most honest test of a managed detection provider that exists.
Scoping callWe review your industry, regulated data, detection tooling, and prior test or incident reports, and propose trophies, an adversary profile, and access paths.
Rules of engagement and authorizationScope, exclusions, white cell membership, stop conditions, data handling, deconfliction, and the signed authorization letter.
Covert operationReconnaissance through objective actions, paced to the adversary profile, with every action logged to forensic standards and the white cell informed at each decision point.
Detection analysisThe operator log is correlated with your telemetry and SOC records to produce the detection timeline and the ATT&CK heat map, reviewed with your technical team.
Debrief, replay, and reportExecutive debrief for leadership, technical replay for defenders, and the full report with root-cause findings and backlog, mapped to your frameworks in ComplianceArmor.
Purple team follow-up and retestA purple team exercise with your blue team or our SOC closes the detection gaps in the open, and a scoped retest confirms the trophies are no longer reachable.
Engagements are scoped to clear deliverables with no long-term contract required, and red team as a service is available for organizations that want the discipline to continue across the year. Petronella Technology Group serves Raleigh, Durham, Chapel Hill, Cary, and the Research Triangle, and runs engagements nationwide. The company has held a BBB A+ rating since 2003. We promise a candid engagement: if your defenders catch the operators early, the report will say so, and if they do not, it will say exactly where and why.
Scope a Red Team Engagement Around the Systems That Matter Most
Whether you are preparing for a CMMC assessment, answering a customer's security questionnaire, or want to know whether your detection investment works, a scoping conversation will clarify what the engagement should target and what evidence it will produce. Our SMB Cybersecurity Survival Guide is a good place to start if you want the threat landscape first.
Doing Nothing, Automated Breach and Attack Simulation, or Working With Petronella Technology Group
Organizations that recognize the need to test their defenses as a whole have three realistic paths. The comparison is candid about where each lands, including the strengths of automated tooling.
| Factor | Doing Nothing | Automated Breach and Attack Simulation | Petronella Technology Group Red Team |
|---|---|---|---|
| What is tested | Nothing, until a real adversary tests it for you | A library of known techniques replayed on schedule against agents you install | The whole organization, including people, physical sites, cloud identity, and the SOC, against an adaptive human operator |
| Realism | Not applicable | High per technique, low for the attack path; the platform does not phish your controller or wait for the right moment | Modeled on a real adversary profile, paced to avoid detection, adapted to what the operators find |
| Detection measurement | None | Per-technique coverage data for agent hosts, with no view of how analysts respond | Detection timeline against actual SOC response, including escalation and containment decisions |
| Root-cause findings | None | Technique passed or blocked; no explanation of why the path existed | Findings grouped by the weakness that allowed each phase, with hardening and detection fixes |
| Compliance evidence | None, and the absence is itself a finding | Supporting evidence for monitoring controls; not an independent assessment | Independent report from a CyberAB Registered Provider Organization, mapped to CMMC, PCI DSS, HIPAA, and SOC 2 |
| Best use | Not recommended for any organization that holds regulated data | Continuous regression testing of detections between human engagements | Periodic, objective-based proof of whether the program works, with purple teaming to close what it finds |
Seven Red Team Mistakes That Waste the Engagement
Most disappointing red team engagements fail in planning or in how the results are received, not in the operation itself.
Buying a red team before a penetration test
If exposed services are unpatched and default credentials are in use, the operators will walk in through them and teach you what a far cheaper test would have. Fix the known exposures first.
Telling the SOC
Once defenders know the dates, the engagement measures how attentive they are when warned, which is not the question. Keep the white cell small and let everyone else respond as they would to a real event.
Vague objectives
"Get domain admin" is a technique, not a business outcome. Trophies should describe harm the business cares about: the CUI share, the payroll approval, the production line controller.
Scoping out the paths real attackers use
Excluding phishing, physical access, and cloud identity because they are uncomfortable leaves the engagement testing only the paths you are already confident about. Exclusions should exist for safety and legal reasons, not for comfort.
Treating detection as a side note
The attack narrative is interesting, but the detection timeline is where the value is. Insist that the report correlates operator actions with your telemetry and SOC tickets, and that the backlog includes detection engineering.
Blaming the people who clicked
An employee who opened a well-crafted phishing email is a process finding, not a personnel finding. Engagements that end in discipline teach staff to hide mistakes. Use the result to improve training and reporting culture.
Skipping the purple team and the retest
A report on a shelf changes nothing. Schedule the purple team exercise and the retest when you scope the engagement, so gaps are closed, fixes are verified, and the next engagement starts from a measured baseline.
"Petronella's work has been a major factor in our business success, helping it to become one of the most secured networks of its kind on the Internet."
Financial Services Firm, Raleigh, NC
Petronella Technology Group is rated 4.7 across 92 verified TrustIndex reviews and 5.0 across 15 Google reviews.
Red Team Services: Frequently Asked Questions
What are red team services?
What is the difference between a red team and a penetration test?
How long does a red team engagement take?
Do small businesses need red teaming?
What is adversary emulation?
Is red teaming required for CMMC, PCI DSS, or SOC 2?
What is red team as a service?
What happens if the red team is detected?
Explore Related Security Services
Penetration Testing
Manual and automated testing that finds the exposures a red team would otherwise walk through.
Purple Teaming
Red and blue teams working in the open to tune detections technique by technique.
AI Red Teaming
Adversarial testing of LLM applications and AI agents before and after deployment.
Social Engineering Testing
Phishing, pretext calls, and physical access attempts against your people and processes.
Managed XDR Suite
24/7 monitoring, detection, and response operated by our Security Operations Center.
Threat Hunting Services
Proactive searches for adversaries already inside, using the techniques a red team would use.
Incident Response Services
Planning, retainers, and forensic response when an intrusion is real rather than emulated.
Digital Forensics
Court-grade evidence collection and analysis led by a North Carolina Licensed Digital Forensics Examiner.
Red teaming sits inside a larger program. Internal, external, and network penetration testing find the exposures. Phishing simulation and security awareness training prepare your people. Threat intelligence informs the adversary profile. Managed SIEM and MDR or XDR provide the telemetry the engagement tests. Tabletop exercises and tabletop scenarios rehearse the decisions, an incident response retainer stands behind them, and a virtual CISO keeps the cycle on the calendar. Our team and broader cybersecurity services are described elsewhere on this site.
Find Out How a Real Adversary Would Fare Against Your Defenses, Before One Tries
Since 2002, Petronella Technology Group has helped regulated businesses in Raleigh and across the country test, defend, and document their environments. A red team engagement is the most honest answer to whether your security program works, with a report your board can read and your assessor can use. Call 919-348-4912 or schedule a consultation to begin scoping.
Last Updated: October 26, 2026. Written by Craig Petronella, MIT-certified cybersecurity professional, CMMC Registered Practitioner, and NC Licensed Digital Forensics Examiner (License 604180-DFE). Framework references are to NIST SP 800-171 Rev 2 requirements 3.12.1, 3.14.6, and 3.14.7; PCI DSS v4.0 Requirement 11.4 and the Requirement 10.x logging controls; HIPAA Security Rule 45 CFR 164.308(a)(8) and 164.308(a)(1)(ii)(A); and SOC 2 Trust Services Criteria CC4.1, CC7.1, and CC7.2. Technique and tactic names follow the MITRE ATT&CK knowledge base.
Petronella Technology Group, Inc., 5540 Centerview Dr., Suite 200, Raleigh, NC 27606, 919-348-4912, info@petronellatech.com