Outflank turned ten this year and we’re celebrating by sharing our journey and giving away swag you can’t buy anywhere. 

Outflank started in 2016, when Cobalt Strike was still only a few years old, BOFs did not exist yet, EDRs were just AVs with a fancy name and the same easy bypasses, and generative AI was firmly science fiction.  

At the very beginning, we had no polished website, no elaborate launch campaign, and barely even a company name. What we did have was a four-headed team eager to kick ass, an email address, enough red-team work to keep us very busy and a temporary ‘coming soon’ website with nothing more than just a red hoodie stock photo. 

That temporary page was intended to be there for ‘just a few weeks’. It stayed up for nearly a year as we were simply focused on client work. This created an unexpected amount of mystery and speculation. Looking back, that red hoodie picture was the accidental start of something that became an integral part of our identity. Go to an infosec conference today and you will likely spot red Outflank hoodies, worn by our team and by OST customers around the world. 

A decade later, a lot has changed. The work has evolved, the team has grown (but nobody has ever left!), and Outflank is now part of Fortra. But we are still driven by the same instincts: creating quality offensive tech that matters on the forefront of research, working with some of the greatest minds in the industry, helping customers to become better, sharing publicly what can be shared responsibly, and having some fun along the way. 

The Early Years: Delivering Research Based Red Teaming Services  

While we were still looking for a website, the four founders were already getting the work done. The early days included white-label red teaming, advanced penetration testing, and novel research. There was no grand masterplan written on a whiteboard. We were a small group of specialists who enjoyed working together and had a laser-focus. We understood the industry was about to get ready for the quality we love to deliver, and bit-by-bit organisations were getting ready to learn from a proper red team exercise.  

Nothing but a stock photo and a name was our website for a long time  

We strongly believed and still believe that with a specialist service like red teaming, clients value practitioner-led conversations: sitting directly across from the people doing the work, who could explain the technical details to other specialists, yet just as easily can make the impact clear to relevant management boards, and turn findings into advice that mattered. Our slogan ‘clear advice from a hacker mindset’ embodied our philosophy. 

Red teaming done right is what we aimed for, and what we delivered. 

That practical beginning shaped everything that followed. 

Differentiating and Defining Red Teaming 

In 2016, ‘red teaming’ was still a very broad label. Some firms were selling Nessus scan results as red team reports. Others did a regular internal pen test, added a phishing email, and called it a red team exercise. 

At the other end of the spectrum, there were teams coming up with attack scenarios that were technically impressive but had little relevance to the organisation being tested. Think of plans involving a stolen security van, DDoSing security cameras, flying a WiFi interception drone, and hoping that the guest network would somehow lead to internal backup systems. Technically fun? Absolutely. Relevant to 99 percent of organisations? Probably not. 

We knew red teaming had to be more grounded than that. A good exercise should be based on a realistic threat, relevant to the organisation, and adapted to what the blue team could actually learn from it. 

TIBER: Bringing Structure to Red Teaming 

Around the same time, the TIBER framework was being drafted by the TIBER team at De Nederlandsche Bank. TIBER, short for Threat Intelligence Based Ethical Red Teaming, brought much needed structure to the field. 

It set clear expectations for how a test should be scoped, run, and reported. More importantly, it required attack scenarios to be based on threat intelligence that was relevant to the organisation being tested. TIBER gave organisations a way to undergo a realistic attack, understand how their people, processes, and technology held up, and use that experience to improve their resilience against the threats that actually mattered to them. 

That was exactly how we thought red teaming should work. We were involved from the earliest consultations and remained closely involved during the years in which the framework took shape. It is no surprise that TIBER was later adopted and adapted by regulators far beyond the Netherlands and even beyond the EU. 

There were years in which Outflank delivered roughly half of all TIBER tests in the Netherlands. For a small team competing with much larger and better known firms, that was a strong indication that our approach was working and being well received. 

Putting it Into Practice 

Over the years, we have delivered more than 100 authorised red team engagements for major companies and institutions across much of the Western world. These were often complex environments where the stakes were high and assumptions about defensive maturity needed to be tested properly. 

We grew into the role of a high quality red team. What started with hacking a single bank eventually became running parallel red team exercises across a country’s major banks, and making enough impact for those organisations to steer their defences based on what we found. 

One early debrief captured that impact better than we could: 

“So you are telling me that we’ve spent years investing millions in cyber defence, and now these four guys turn up and just hacked our entire organisation from their kitchen tables?” 

At the time, that was literally true. We did not yet have an office and regularly worked from our kitchen tables. 

But the point of red teaming was never to find a sneaky way in, loot all the gold, and leave behind a beaten down blue team. We were, and still are, firmly against that ‘wrecking-ball’-approach. 

A red team exercise should help defenders understand where their strategy, visibility, or response needs to change. It should help management understand what modern cyber attacks actually require of an organisation. And it should leave the organisation stronger than it was before the exercise began. 

We are proud to have contributed to the professionalisation of red teaming in this way: by doing the work, helping shape the standards around it, and making sure the outcome mattered. 

Contributing to the Offensive Community with Shared Tradecraft 

From the start, we were confident that a small team could still make a meaningful contribution beyond its client work. Over the past decade, we have published dozens of technical blog posts, open-sourced numerous research and operational code projects, and delivered dozens of presentations at major security conferences including Black Hat, DEF CON, TROOPERS, DerbyCon, BruCON, x33fcon, FIRST, Nullcon, and more. 

Projects such as RedELK, EvilClippy, Dumpert, C2-Tool-Collection, and WdToggle have found their way into the hands of many red teamers, researchers, and defenders around the world. Our contributions to MITRE ATT&CK have helped defenders better understand common attacker techniques. 

For a team that spent much of its early life with only a handful of people, that output matters to us. It reflects our belief that research should not live only in private reports or internal repositories. When it can be shared safely and responsibly, publishing tools, research, and lessons learned makes the wider industry better. Sadly, we also experienced Russian and North Korean threat actors abusing our tools. This was our first signal that the industry was changing and that there were occasions in which sharing should be limited. This idea planted a seed for a new service later on. 

Another way of sharing tradecraft came in the form of launching training services. What started as debriefing sessions for blue teams after a red team exercise eventually resulted in several highly appreciated trainings given to nearly 1000 defenders throughout the years. It was not only about insight into the modern attacker’s techniques by having them explore the tech details of attack and defend. Ask anyone who we trained and they will say it was equally beneficial to learn about strategic topics like Clean Source Principle and Tiering, how we made difficult tech subjects like AD security easy to understand, and more architectural subjects like Pyramid of Pain practical to implement. This was always very fulfilling to do as it’s what this red teaming game is about in the end: helping blue improve. 

From Creating Tools in the Field to Launching an Official Product 

As red team work evolved, so did the amount of research and engineering required to do it well. 

Modern defences move quickly. EDR products improve, tradecraft becomes more specialised, and the difference between a realistic operation and a noisy simulation often comes down to the quality of the tooling behind it. We increasingly found ourselves investing significant time in building, refining, and maintaining the capabilities needed for our own engagements. 

That naturally led to Outflank Security Tooling.  

OST is now our main focus: a broad, evasive red-team toolset that supports operators across the kill chain, backed by documentation, knowledge sharing, community support, and practical tradecraft. Rather than keeping every capability limited to the engagements we could personally deliver, OST gave us a way to help more red teams worldwide. This is embodied in a changed slogan: ‘Offensive Tools & Tradecraft’. 

Today, OST includes 25+ tools, more than 25k+ lines of documentation, 40+ hours of training video content, and a focused community of 1500+ red teamers. We stay highly up to date with quick release cycles (100+ releases delivered over the years), with new capabilities, improvements, research, and operator-focused knowledge sharing continuously flowing into the platform. 

We still take on a select number of red-team engagements. Not because we want to return to being a consultancy, but because staying close to the work keeps our tooling honest and our people happy.  

When we launched OST, we wrote more extensively about the reasoning behind that decision. You can still read Our Reasoning for Outflank Security Tooling.

Joining Fortra, Remaining Outflank 

On September 1st 2022, Outflank was acquired by Fortra. 

It was a significant moment for our small team. But it did not change why we do this work. Instead, we decided to go that route as it gave us the support needed to take OST to more red teams around the world. We wrote about this move in a past post.

The Outflank team continues to lead the technology, research, and work behind OST. Fortra provides the supporting capabilities that help us operate responsibly at greater scale: legal expertise, export controls, customer vetting, sales, and marketing. Plus we get to work with the great people of the Cobalt Strike team. 

That combination has allowed us to stay focused on what we do best while serving a broader international community of red-team operators. It also meant that we could work together with the great team behind Cobalt Strike, a tool that we heavily used and built-on since our early days. 

How We Gained The Advantage of Continuity 

Outflank started with four people. By September 2022, we were at 9. Today, the team has grown to 14. We don’t grow quickly, we only grow with the right people that are a fit for our candid, goal focused culture.  

One fact we are particularly happy about: Over the last ten years, no one has left the team. 

That continuity matters. Good teamwork relies on trust, shared context, honest feedback, and people who know how each other thinks. It is hard to build that overnight. But when you find the right people you enjoy working with on technical and on human level, time flies! 

Fun team events make for a fun team 

This is how you tell your customers that Max is working on socksv5 support in your C2 tool 😉 

The community around us matters too. 

Together with MDSec, we created RedTreat: a small, invite-only, TLP:RED gathering for experienced red teams. Now in its sixth edition, it creates space for the research, operational lessons, and honest conversations that increasingly do not belong (anymore) on the open internet. 

RedTreat conference

And, of course, not every contribution to the community happens in a conference room. Together with Northwave, we organise the annual InfoSec Kart Cup. Three editions in, it has become a day for red teams, blue teams, security professionals, racing, barbecue, and healthy competition. 

Infosec Kart Cup  

Sometimes, after enough discussions about OPSEC, evasion, and detection engineering, the best next step is simply putting on a racing suit and getting behind the wheel of a kart. 

Ten Years by the Numbers 

Looking back at 10 years, we have some great stats that we are proud of to have achieved: 

• Team size at the start in 2016: 4 

• Team size today: 14 

• Authorized red-team engagements performed: 100+ 

• TIBER engagements: dozens 

• OST releases: 100+ 

• Tools in the OST toolbag today: 25+ 

• Public research and operational-code projects: 25+ 

• Technical blog posts and conference presentations: almost 100 

• Lines of OST documentation: 25k+  

• Hours of video training content in OST: 40+ 

• Red teamers in the OST community: 1500+ 

• Blue teamers trained: nearly 1000 

• RedTreat editions: 6 

• InfoSec Kart Cup editions: 3 

• Conferences where we got complaints due to a wrecking ball picture: 1  

• Organisations pwned with a phishing payload equipped drawing made by one of our kids: 1 

• Secure passport solutions hacked with rubber face masks: 1 

• 1 stock red hoodie photo that got a little out of hand 

Staying True to Ourselves in Changing Times 

The world around us is changing quickly. AI is changing how research is conducted, how tools are built, and how defenders and attackers operate. At the same time, the red team community has become more careful about what it shares openly. 

Those changes make practical experience, trusted communities, and responsible research more important, not less. 

Tools will evolve. AI will evolve. Red teaming will evolve. But the need for curious operators who can challenge assumptions, understand real environments, and help organisations improve their defences will remain. 

“The work has changed a lot over ten years. Our instinct has not: stay curious, stay close to the operator, and focus on making a real difference.” 

– The Outflank OG team 

Thank you to everyone who has trusted us, challenged us, shared research with us, invited us to speak, worked with us, raced with us, and worn red with us. 

Here is to the next decade of evasion! 

Celebrate with Us 

As we are the ones celebrating, the free treats are on us. We will ship a limited number of special 0xA hexadecimal edition Outflank hoodies to anyone who wants to help us celebrate our first ten years. You have until the end of this month to enter your relevant details in this form. If you are one of the lucky ones to be drawn, we will connect with you around Dec.1 to get the right shipping address and you will get some limited-edition swag. Blue teamers are allowed to enter as well. In the end, we are all part of the same family. 

https://forms.cloud.microsoft/e/QDSxfK07QY

Outflank Security Tooling 

Are you a red teamer and in need of some kick-ass tooling that makes your life easier? Check out what we build, and why many red teamers around the world are happily using: Outflank Security Tooling. We run periodic demos. Click here to register yourself for the next one, or get in contact for a bespoke demo if you think that is needed.