Red Teaming¶
Red teaming records adversarial exercises — assessments that test whether an attacker could achieve a specific objective, rather than enumerating weaknesses.
How it differs from penetration testing¶
The two are often conflated, and the distinction shapes what the findings look like.
| Penetration test | Red team exercise | |
|---|---|---|
| Question asked | What weaknesses exist in this system? | Could an attacker achieve this objective? |
| Scope | A defined system | Whatever the objective requires |
| Success measure | Coverage of the target | Whether the objective was reached |
| Also tests | The system | The system and whether anyone noticed |
A red team exercise may reach its objective through a chain of individually unremarkable weaknesses. No single finding looks severe; the path is what matters.
What findings look like here¶
Red team findings are narrative. They describe a route: this access led to that credential, which permitted this movement, which reached the objective.
Two consequences for how they are handled:
- Severity reflects the path, not the step. A finding rated Critical may involve several individually minor weaknesses. Do not down-rate the parts.
- Fixing one step may break the chain — but usually only that chain. The underlying weaknesses often remain available for a different route.
Detection matters as much as prevention¶
A red team exercise also tests whether your monitoring noticed. "The objective was achieved and nothing alerted" is a finding in its own right, and often the more important one, because it applies to every future attack rather than one path.
Working with the results¶
- Read the narrative before the findings list. The list without the story loses the point.
- Address the chain, not only its steps. Ask what else the same weakness enables.
- Treat detection gaps as findings. They deserve owners and dates like any other.
- Re-run periodically. A red team result is a statement about one point in time against one objective.