RedMimicry in brief

RedMimicry is a cyber defense validation platform, built by a team of offensive security engineers in Berlin. It runs real-world attack chains in a company’s own environment, safely and repeatably, so the security team sees how its defense holds up against an actual intrusion rather than a checklist.

The platform handles payload generation, attacker infrastructure and evidence. It runs cloud-hosted or on-premises. Every run produces a structured record mapped to MITRE ATT&CK of what ran, where and when, which the team compares with the alerts in its SIEM and EDR. Because runs are repeatable, the same scenario can be checked again after every change.

Threat Signals

Detection coverage at scale. Threat Signals runs a large library of known attacker techniques across endpoints. Each technique is a Molecule, a small self-contained test of one attacker behavior. Many Molecules are generated automatically from threat intelligence on named threat actors, and teams can build their own from a behavior library. Catalyst, a lightweight agent, runs them on endpoints on a central schedule. A Molecule can also be compiled into a standalone binary that runs on any endpoint.

Playbooks

Full-chain emulation of real threat actors such as Black Basta, LockBit and Lazarus, across Windows, Linux and macOS, from delivery to impact. Each Playbook is a close reimplementation of how the actor operates, which keeps the behavior realistic enough to hold up against a modern EDR. Payloads are scrambled per engagement, execution is step-wise and the Playbooks contain no real malware code. A run produces incident-like telemetry in the customer’s own tools and doubles as hands-on training for analysts.

Advanced Practices

The toolkit for offensive security teams: configurable EDR evasion, lateral movement, credential dumping, multi-hop C2, persistence and bring-your-own payloads, driven from a graphical view of the target network. With AI Red Teaming, operators steer the deployed implants in plain language. An agentic system pursues the defined targets within configurable safety controls, with the customer’s own models connected via API or MCP.

Who uses it

SOC and detection teams validate their coverage and catch regressions. Red teams shorten engagements. MSSPs and consultancies deliver validation to their clients. Compliance and audit teams get repeatable evidence, and SOC and incident response teams train against realistic intrusions.

Outlook: Remediate

Remediate is the next generation of the platform and launches in early 2027, with pilots before that. It brings the modules together and moves from attacking to measuring and improving. It is built for mid-sized companies, where one person often owns both the security tools and the decision to change them.

• Data Core. Remediate connects SIEM, EDR, firewall, Microsoft 365 and Entra ID, plus documents such as pentest reports and policies, into one picture of the company’s security.
• Correlation. Every executed attack step is matched with the logs and alerts of the defense, so the result shows what was detected and what was missed.
• Tasks instead of findings. Each gap becomes a concrete hardening task. Configurations such as firewall rules and Active Directory are checked against the company’s own context.
• Re-test. Validation runs agentically on a regular schedule. The same attack runs again and shows whether the change works.
• Questions in plain language. Users ask about their security posture and get answers from the Data Core.
• Capabilities. Further sources can be added as needed, for example external attack surface, domain monitoring, web application testing and vulnerability scanning.
• Built for partners. MSSPs reach all of their customers’ instances through one login and can offer their own services through the platform.