Skip to main content

Red team

Overview​

A red team simulates real-world adversaries to test people, processes, and technology. Unlike narrow penetration tests, red team engagements often pursue defined objectives (e.g. domain compromise, data exfiltration simulation) with constraints agreed in a rules of engagement document.

Key concepts​

  • Scope & ROE — What systems, times, and techniques are allowed.
  • Kill chain / ATT&CK — Model adversary behavior for coverage analysis.
  • Stealth vs breadth — Noise trade-offs when avoiding blue detection.
  • Reporting — Actionable remediation, not just vulnerability lists.
  • Legal & ethics — Written authorization only; no out-of-scope testing.

Engagement phases​

Sample: rules of engagement (outline)​

  1. Customer signatory and emergency contacts.
  2. In-scope IP ranges, domains, apps; out-of-scope third parties.
  3. Forbidden actions (e.g. destructive payloads, social engineering of HR).
  4. Communication plan — When to pause if unintended impact occurs.

References​