RedMimicry

What RedMimicry does

RedMimicry GmbH is a Berlin-based cybersecurity vendor that operates a semi-automated Breach and Attack Emulation (BAE) platform designed to emulate realistic, multi-stage cyber threats against enterprise environments. The platform executes playbook-based attack scenarios modeled on the techniques, tactics, and procedures (TTPs) of named real-world threat actors including LockBit, Black Basta, and SPECTRE, covering ransomware, supply chain compromise, remote access tooling, and payload delivery techniques across Windows, macOS, and Linux endpoints. Operators can deviate from predefined playbooks via an "Attack Shell" for manual custom actions, which the company positions as a differentiator versus fully automated Breach and Attack Simulation tools. A dedicated DORA Compliance Module aligns scenarios with the TIBER-EU Threat-Led Penetration Testing framework.

The product is built on a Go-based backend that supports on-premises and distributed deployment in customer environments, with post-emulation reporting in raw data or PDF form. RedMimicry does not sell or deliver services directly; instead, all service delivery is channeled through a certified partner network of nine European security consultancies and managed security service providers (DCSO, SCHUTZWERK, SITS Group, MindBytes, Mint Secure, intcube, lachenmair.info, Schönbrunn TASC, INSIDIA). Pricing is quote-based and not publicly disclosed, with billing on an annual cadence, and primary end-customers are financial institutions, critical infrastructure operators, and enterprise security teams required to meet DORA and NIS-2 compliance obligations.

Founded in 2023 by Alexander Rausch (former Senior Offensive Security Engineer at Proofpoint) and joined operationally by COO Stefan Steinberg (ex-DCSO Director of Cyber Defense) in April 2024, RedMimicry is a privately held GmbH registered in Berlin (HRB 250955). The company raised a seven-figure seed round led by High-Tech Gründerfonds in August 2025 to scale its technology and operations, with stated focus on critical infrastructure and financial services attack scenarios. Marketing channels combine website/LinkedIn content, conference presence at events including Hannover Messe, it-sa, and InfoSec Europe, and a physical-media Capture-the-Flag program (RedMimicry CTF / rcr.sh) used as a security community engagement vehicle.

Name

RedMimicry

Legal name

RedMimicry GmbH

Website

https://redmimicry.com

Company type

Private

Founded year

2023

Operating status

Operating

Headcount range

11–50 employees

Short description

RedMimicry is a Berlin-based semi-automated breach and attack emulation platform that emulates real-world threat actors (LockBit, Black Basta, SPECTRE) to validate enterprise cyber defenses, sold via certified partners to financial institutions and critical infrastructure operators for DORA and NIS-2 compliance.

Ownership category

akta.pro rank

Product category

Breach and Attack Simulation Software

NAICS

Other Computer Related Services (541519), Custom Computer Programming Services (541511)

SIC

Services-Prepackaged Software (7372), Services-Testing Laboratories (8734)

akta.pro primary industry

Penetration Testing & Red Teaming (BPAKADAE)

akta.pro secondary industry

Penetration Testing & Red Teaming (BPAKAHAF)

Keywords

• Breach attack emulation
• Threat-led penetration testing
• Cybersecurity attack simulation
• Purple team platform
• Offensive security software

Headquarters

HQ city

Berlin

HQ country

Germany

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Infrastructure, Marketing or Sales, Operations

Revenue model

1. Software Platform License/Subscription: RedMimicry provides breach and attack emulation software. The company is a product vendor and does not offer services directly - all service delivery is through partners. Pricing is quote-based and not publicly disclosed.

Pricing tiers

Go-to-market motion2 records

Distribution channels2 records

Marketing channels5 records

Core offering

RedMimicry sells a semi-automated Breach and Attack Emulation (BAE) software platform that lets enterprises execute playbook-driven attack scenarios modeled on real-world threat actors to test EDR, NDR, SIEM, and SOC processes. The platform is sold through annual subscriptions to enterprise security teams and through a European partner network of cybersecurity consultancies that deliver red-team, purple-team, and incident-response-readiness services on top of the software, with a dedicated DORA-compliant Threat-Led Penetration Testing module aligned to TIBER-EU for financial institutions.

Product overview

RedMimicry is a Berlin-based cybersecurity startup offering a semi-automated Breach and Attack Emulation (BAE) platform. The core RedMimicry Platform enables enterprises to validate and improve cyber defenses by executing realistic attack scenarios modeled after real-world threat actors (LockBit, Black Basta, SPECTRE). The platform includes modular scenario packs: Ransomware Scenarios, Supply Chain Attack Scenarios, Remote Access Tooling Scenarios, and Common Payload Techniques playbooks. A dedicated DORA Compliance Module supports financial institutions in meeting Threat-Led Penetration Testing requirements aligned with the TIBER-EU framework. The company also operates RedMimicry CTF, a physical-media capture the flag program featuring artifacts like SectorZero (2025) and SectorOne (2026).

Differentiator

Problem solved

Functional benefit

Products and services

• RedMimicry Platform Semi-automated breach and attack emulation software platform that enables enterprise security teams to validate and enhance cyber defenses by executing playbook-driven attack scenarios modeled on real-world threat actors such as LockBit, Black Basta, and SPECTRE across Windows, macOS, and Linux environments.
• DORA Compliance Module Dedicated DORA-aligned Threat-Led Penetration Testing (TLPT) offering for financial institutions, providing threat-intelligence-based emulation playbooks mapped to the TIBER-EU framework to support mandatory DORA testing requirements.
• RedMimicry CTF RedMimicry's branded Capture the Flag (CTF) competition for the cybersecurity community, in which participants investigate physical-media artifacts to recover hidden flags and compete on the rcr.sh leaderboard.

Quantifiable outcome

• Enables continuous testing in line with DORA's emphasis on regular assessments
• +1 more outcomes

Named customers4 records

Segments4 records

Ideal customer profiles4 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature6 records

Partnerships

Nine partnerships are on record, tiered core, major and minor.

• DCSO (Deutsche Cyber-Sicherheitsorganisation)coreStrategic or Co-development PartnerFounded in 2015 by Allianz, BASF, Bayer, and Volkswagen. Uses RedMimicry for Cyber Security Effectiveness Assessment and Incident Response Readiness Exercise services. Former COO Stefan Steinberg was Director of Cyber Defense at DCSO before joining RedMimicry.
• SITS Group AGmajorImplementation/ SI/ Consulting PartnerEurope's leading cybersecurity provider with 700+ employees in seven European countries. Offers end-to-end security and cloud services. Uses RedMimicry for Breach and Attack Emulation (BAE) services to assess security tool effectiveness and test internal procedures.
• SCHUTZWERK GmbHmajorImplementation/ SI/ Consulting PartnerCybersecurity consultancy established in 2010 specializing in security assessments from 'Silicon to Cloud.' Uses RedMimicry for Breach and Attack Simulation Assessments as a lean alternative to red teaming, offering fast execution and high reproducibility.
• Mint SecuremajorImplementation/ SI/ Consulting PartnerBerlin-based offensive security and security consulting company. Offers Ransomware Emulation Service using RedMimicry to emulate ransomware attacks and evaluate how security solutions detect and respond to threats.
• MindBytesmajorImplementation/ SI/ Consulting PartnerSecurity services provider specialized on penetration testing and red teaming with headquarters in Stuttgart. Uses RedMimicry playbooks to conduct typical attack activities and uncover blind spots in customer Microsoft environments.
• intcubeminorImplementation/ SI/ Consulting PartnerBerlin-based cybersecurity startup helping mid-sized organizations make right security decisions. Specializes in orchestrating enterprise security tools for mid-sized organizations using RedMimicry.
• lachenmair.infominorImplementation/ SI/ Consulting PartnerIT security and information protection services provider for SMBs and corporate clients with 20+ years experience across EMEA markets. Helps customers implement RedMimicry with comprehensive consulting and real-life attack scenario execution.
• Schönbrunn TASCminorImplementation/ SI/ Consulting PartnerIT security and information security consulting firm providing holistic project support from security concepts to data protection. Offers Incident Readiness Assessment using RedMimicry.
• INSIDIAminorImplementation/ SI/ Consulting PartnerSpecialized in penetration testing, red teaming and purple teaming. Enables organisations and public authorities to act before attackers do using RedMimicry platform.

Scale indicators3 records

Recent moves5 records

Expansion highlights6 records

Direct peers

• SafeBreach: SafeBreach runs a breach and attack simulation platform that emulates adversary TTPs against customer environments, closely comparable to RedMimicry's playbook-driven approach and competing for the same SOC validation and red-team tooling spend.
• XM Cyber: XM Cyber provides continuous exposure management and attack-path simulation, overlapping with RedMimicry's objective of validating cyber defenses by modeling realistic adversary behavior across enterprise environments.
• AttackIQ: AttackIQ provides an adversary emulation platform built on the MITRE ATT&CK framework to test security controls, overlapping directly with RedMimicry's TTP-based scenarios for purple-team and continuous security validation use cases.
• Picus Security: Picus offers a Breach and Attack Simulation platform that continuously validates security controls against real-world threats, directly competing with RedMimicry's threat-emulation playbooks for the same enterprise security and CISO budget line.
• Cymulate: Cymulate delivers a SaaS-based breach and attack simulation and exposure management platform, competing with RedMimicry for enterprise security validation budgets, including ransomware and supply-chain emulation scenarios.
• Pentera: Pentera offers automated security validation that emulates real attack techniques against enterprise networks, serving the same CISOs and security teams that RedMimicry targets and competing for adjacent purple-team and red-team engagements.

Broad incumbents

• Mandiant: Mandiant (now part of Google Cloud) is a leading incident response and red-team services provider whose adversary intelligence and validation offerings overlap with the threat-emulation outcomes RedMimicry promises to its customers.
• Rapid7: Rapid7 is an established security analytics and orchestration vendor whose Insight platform includes exposure validation and red-team tooling, providing a broader portfolio alternative to RedMimicry's specialized BAE platform.

Emerging players

• Hadrian: Hadrian is an Amsterdam-based offensive-security vendor combining attack surface management with adversary emulation, comparable to RedMimicry as a European peer targeting similar regulated enterprise buyers and DORA-driven demand.
• Scythe: Scythe offers an adversary emulation platform focused on purple-team exercises, targeting a similar niche of offensive-security practitioners and consultancies as RedMimicry but with a more US-centric footprint.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat4 records

Key risks7 records

Key highlights7 records

Customer concentration

• LinkedInlinkedin.com/company/redmimicry

Revenue estimate

Valuation estimate

Number of profiles

Profiles2 records

Funding overview

Funding rounds1 record

Investors3 records

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about RedMimicry