For in-house red teams
who run offensive operations against their own org
Run continuous adversary simulation, assumed-breach exercises, and full-scope red team operations from one workspace. Track engagements, log technique findings against MITRE ATT&CK, retest closed paths, and produce reports leadership and risk committees can actually read.
No credit card required. Free plan available forever.
A platform built around the in-house red team programme
In-house red teams run offensive operations against their own organisation as a continuous programme rather than as a series of disconnected projects. The work spans assumed-breach exercises, scenario-based scenarios, full-scope engagements, purple-team collaboration with the SOC, and the leadership reporting that ties offensive results back to risk decisions. Most teams end up running this programme across a notes app, a screenshot folder, a spreadsheet of techniques, a separate document for the rules of engagement, and a series of Slack threads with the blue team that age out before the next operation kicks off.
SecPortal gives in-house red teams one workspace for engagements, technique findings, evidence, retests, and leadership reporting. Findings carry CVSS scores from the moment they are opened, ATT&CK mapping is part of the workflow, the SOC and detection engineering see the same shared record on purple-team operations, and AI assists the reporting work that sits on top. Whether the team is two operators inside a Series B product company or a dedicated red team supporting a global enterprise, the platform scales without adding administrative overhead.
Capabilities the in-house red team actually uses
Engagement records that persist
Each operation lives as an engagement record with scope, rules of engagement, operators, dates, and findings attached. The record persists after the engagement closes, so the next operation builds on documented exposure history rather than starting from a blank page.
Technique findings with ATT&CK context
Log findings with CVSS 3.1 vectors, severity, evidence, and the technique used to reach them. Map results against the MITRE ATT&CK framework so leadership and detection engineering see what was exercised, what worked, and what got caught.
Evidence on the same record
Screenshots, request and response captures, payloads, and beacon artefacts attach to the finding they prove. The post-operation evidence pack is the engagement record itself, not a folder of disconnected files the next reviewer has to rebuild context against.
Retests paired to the original finding
When the blue team or platform engineering closes an attack path, the retest pairs to the same finding rather than opening a new record. The aging clock keeps running on the original capture date, and the verification evidence sits with the original report.
AI-assisted leadership reporting
Generate executive summaries, narrative engagement writeups, and remediation roadmaps from the live engagement record. Operators stop spending the post-operation week in a document editor producing the same five views by hand.
Role-based access for purple-team partners
Scope SOC analysts, detection engineers, and platform owners to the engagements they belong on. Team leads keep cross-programme visibility, individual operators get their assigned operations, and partners outside the red team see only the records they need.
How the programme runs inside SecPortal
An in-house red team is most effective when one operating picture covers offensive results, detection coverage, and remediation closure. SecPortal supports the full programme rather than a single phase of it.
- Tag findings by tactic and technique using the same MITRE ATT&CK reference the SOC uses, so coverage drift across operations is visible rather than implicit.
- Bring assumed-breach, full-scope, and scenario-based engagements into one workspace, with a per-engagement scope record that the rules of engagement template fills out at kickoff.
- Coordinate with the SOC and detection engineering inside the same shared finding record, so the gap from technique fired to detection written is documented rather than reconstructed in a debrief.
- Track every attack path through open, in-progress, fix-pending, retest-pending, verified-closed states with a date and actor on each transition for the audit trail.
- Roll engagement records forward year over year against the same internal target, so prior findings, prior detections, and prior closure status carry as planning context for the next operation.
- Run scheduled external scans and authenticated scans alongside manual operations, so the picture between point-in-time engagements stays current rather than ageing out.
From operation kickoff to verified close, in one record
The leverage in red team operations is the durability of the record after the engagement closes. SecPortal runs a single operation flow that the next engagement can build against.
- 1Open the engagement with scope, rules of engagement, operators, communication channels, and abort criteria stamped against the record. The rules-of-engagement template populates the standard sections; the engagement record holds the bespoke ones.
- 2Log findings with technique, CVSS vector, severity, evidence, and remediation guidance as the operation runs. Each finding lands on the same record the engagement lives on, not in a parallel notes file.
- 3Coordinate with the SOC and detection engineering through shared finding records when the operation is purple-team rather than red-team. Detections written, alerts fired, and gaps captured all sit on the same finding the technique was logged against.
- 4Run a retest after remediation, attach the verification evidence to the same finding, and either close it with a status change actor recorded automatically or revert to open with regression notes captured in place.
Where in-house red teams typically start
Most teams adopt the platform in three phases: bring the active engagement record under one workspace, layer in technique findings against ATT&CK with evidence attached, then consolidate purple-team coordination, retests, and leadership reporting onto the same record. The relevant capability and workflow pages explain each phase in detail.
- The core offensive workflow lives in the red teaming use case, the assumed-adversary simulation pattern is covered in the threat-led penetration testing use case, and the SOC-collaboration model is on the purple teaming use case.
- Technique mapping and ATT&CK coverage tracking are covered on the MITRE ATT&CK framework page, with regulator-led adversary simulation context on the TIBER-EU framework page and the CBEST framework page.
- Engagement records, scope, rules of engagement, and operator assignment live in the engagement management feature, while the underlying findings model with CVSS scoring and evidence sits in the findings management feature.
- The retest workflow that pairs verification to the original finding is covered in the retesting use case, with the underlying economics and audit expectations laid out in the pentest retest economics research.
- Continuous operations between point-in-time engagements are covered in the continuous penetration testing use case, and the rules of engagement template that populates the standard scope sections is the rules of engagement template tool.
SecPortal is built for in-house red teams that want one platform for the whole programme: live engagements, technique findings, evidence, retests, purple-team coordination, and the reporting on top. The SOC gets a clearer signal, leadership gets faster reports, and the red team gets back the hours that used to disappear into post-operation document production.
If your function is closer to defensive operations than offensive operations, the sister page SecPortal for internal security teams covers the same workspace from the defensive angle. If you run an external red team consultancy that delivers operations to client organisations, the SecPortal for cybersecurity firms page covers the multi-client delivery model.
For broader context on how red team programmes connect to remediation tracking, the remediation tracking use case and the aging pentest findings research cover what happens after the offensive operation hands its findings to the engineering owners.
The problems you face
And how SecPortal solves each one.
Red team findings live in Markdown notes, screenshots, and the lead operator's drive
One findings database with CVSS 3.1 vectors, severity, evidence, technique mapping, and remediation guidance. Every operation contributes to a durable record rather than a one-off PDF.
Each engagement starts from scratch instead of building on prior exposure history
Engagement records roll forward year over year against the same internal target. Prior findings, prior detections, and prior closure status carry as historical context the next operation can plan against.
Reporting to leadership and risk committees takes weeks per engagement
AI generates executive summaries, technique writeups, and remediation roadmaps from the live engagement record. Operators stop spending the post-engagement week in a document editor.
Coordination with the SOC and detection engineering happens in Slack threads that age out
Shared engagement records mean the offensive operator and the SOC analyst see the same finding, the same technique, and the same evidence at the same time. Purple-team workflows are part of the same workspace, not a separate tool.
Retests of closed attack paths get skipped because the bookkeeping is hard
Retests pair to the original finding rather than opening new records. Verification evidence attaches to the same audit trail, so closure is durable and reproducible months later when the question gets revisited.
Operators outside the red team need scoped access to specific engagements without seeing everything
Role-based access control scopes operators, tooling owners, and SOC partners to the engagements they belong on. Team leads keep visibility across the full programme without exposing every active operation.
Key features for you
Run the red team programme as records, not as binders
Engagements, technique findings, evidence, retests, and leadership reporting on one workspace. Free plan available.
No credit card required. Free plan available forever.