Best Adversary Simulation Providers
Adversary simulation is a higher-tier, threat-led form of offensive security testing. Engagements are longer than typical red teams, usually 4 to 12 weeks of active testing, and built around assumed-breach scenarios, custom tooling, and the goal of mimicking a specific real-world threat actor mapped to MITRE ATT&CK. Financial regulators are the primary source of demand: TIBER-EU under DORA in the EU, CBEST under the Bank of England, and parallel national frameworks like TIBER-DE and TIBER-NL drive most of the spend at this tier. The engagement model differs from a generalist red team in that it is goal-oriented, slow-paced by design, and informed throughout by bespoke threat intelligence.
When choosing an adversary simulation provider, look for CBEST or TIBER-EU eligibility (these schemes pre-vet a small number of providers), evidence of custom offensive tool development, demonstrated EDR-evasion experience, attribution restraint and clean operational tradecraft, and a methodology rigorous enough to satisfy a regulator's threat-led test plan. The shortlist below filters the directory down to providers with documented experience in this category.
Related: Threat-led penetration testing (TLPT) · DORA TIBER-EU testing
SECFORCE
Our top recommendation on this page.
Canary Wharf-based adversary simulation and CBEST-aligned penetration testing consultancy, delivering CREST-accredited offensive security to UK financial services and other organisations with the most demanding requirements.
- CBEST-approved provider staffed by certified CCRTM and CCRTS consultants.
- Has delivered over 15 CBEST engagements for UK high street banks, major financial institutions, and other regulated entities.
- Works with a network of trusted, CBEST-approved threat intelligence partners, and can also work alongside any threat intelligence provider selected by the client or regulator.
- Independently audited against both ISO 27001 and SOC 2 for information security, data handling, and operational integrity.
NCC Group
Global cybersecurity consultancy with CREST, CHECK, and CBEST accreditation, renowned for deep technical research and comprehensive penetration testing services.
Dionach
Global enterprise cybersecurity consultancy founded in 1999 in Oxford, holding rare CREST STAR-FS accreditation and delivering penetration testing, red and purple teaming, and PCI QSA services across five international offices.
Pen Test Partners
The UK's largest independent security testing firm, renowned for IoT/OT research, CBEST red teaming, and CHECK/CREST-accredited penetration testing across all sectors.
PwC Cyber Security
Global Big Four professional services firm delivering CREST, CHECK, and CBEST-accredited penetration testing and red teaming services from London, serving the UK's largest enterprises and regulated organisations.
MDSec
Elite UK offensive security consultancy specialising in CBEST/STAR/TIBER red teaming, advanced adversary simulation, and CREST-accredited penetration testing for FTSE 100 clients.
Cyberis
CREST and CHECK-accredited UK penetration testing consultancy with CBEST approval, specialising in infrastructure, application, and simulated attack assessments across the public and private sectors.
Aristi
CHECK and CREST-accredited Birmingham-based cyber security consultancy with over 15 years of experience delivering penetration testing, red teaming, and OT security assessments for government and private sector clients.
JUMPSEC
Full-service London-based cybersecurity consultancy with CREST, CHECK, and NCSC accreditations delivering offensive testing, managed detection, and strategic advisory services.
Mandiant
World-renowned cybersecurity firm now part of Google Cloud, delivering threat intelligence-led penetration testing and red teaming informed by front-line incident response experience.
Salus Cyber
Award-winning Cheltenham-based cybersecurity consultancy with NCSC CHECK Green Light status and CREST approval, specialising in defence, government, and critical national infrastructure security.
TrustedSec
Offensive security firm founded by former NSA operator David Kennedy, delivering CREST-accredited penetration testing, red teaming, and adversary simulation to Fortune 500 and government clients.
Bulletproof
CREST-accredited UK cybersecurity and compliance provider offering penetration testing, managed security services, and regulatory consultancy to over 2,000 customers from its Stevenage headquarters.
Best Adversary Simulation Providers, FAQs
What is adversary simulation?+
Adversary simulation is a threat-led form of offensive security testing in which a tester emulates the tools, techniques, and procedures (TTPs) of a specific real-world threat actor to test an organisation's detection and response capabilities end-to-end. Engagements are goal-oriented (e.g. reach a defined crown-jewel asset), use assumed-breach scenarios, and are mapped to frameworks like MITRE ATT&CK.
How is adversary simulation different from red teaming?+
Red teaming is the broader category, any objective-driven, end-to-end attack simulation. Adversary simulation is a more specific tier within it: longer engagements, driven by bespoke threat intelligence about a named actor, deliberately slow-paced to test detection over time, and usually required by financial regulators rather than chosen voluntarily. A typical commercial red team is faster and less prescriptive about which actor is being emulated.
What is TIBER-EU?+
TIBER-EU (Threat Intelligence-Based Ethical Red Teaming for the European Union) is the European Central Bank's framework for intelligence-led red teaming of significant financial entities. National variants, TIBER-DE in Germany, TIBER-NL in the Netherlands, and others, implement the same model. Under DORA, threat-led penetration testing aligned to TIBER-EU is mandatory for many large financial institutions across the EU.
How long does an adversary simulation engagement last?+
Adversary simulation engagements typically run 4 to 12 weeks of active testing, with an additional 2 to 4 weeks of threat intelligence and scoping work upfront and 2 to 4 weeks of reporting and purple-team replay afterwards. The full programme, including regulator engagement under TIBER-EU or CBEST, often spans 6 to 9 months end-to-end.