Red Teaming

What is red teaming?

Red teaming is a form of security assessment in which a team of specialists (the red team) simulates the actions of a real adversary. Unlike penetration tests, which focus on identifying vulnerabilities within a defined scope, red teaming evaluates an organisation’s ability to detect, respond to and repel attacks under realistic conditions.

A red team operation can last from several weeks to several months and may involve multiple attack vectors simultaneously: phishing and social engineering, exploitation of infrastructure vulnerabilities, physical access attempts, wireless network attacks and supply chain attacks. The red team operates discreetly, informing only a small group of people within the organisation.

The goal of red teaming is not to enumerate every vulnerability, but to test how the organisation - its people, processes and technologies - copes with a realistic threat. The results allow assessment of the SOC team’s effectiveness, incident response procedures and detection mechanisms.

Why does it matter?

Red teaming reveals gaps that standard penetration tests and audits cannot detect. It shows how an attacker can combine seemingly minor weaknesses into an effective attack chain leading to the compromise of an organisation’s critical assets.

The DORA regulation requires financial institutions to conduct TLPT (Threat-Led Penetration Testing), which is based on red teaming methodology. For organisations in the financial sector, red teaming is becoming a regulatory obligation, not just a best practice.

Related topics

• Penetration testing
• MITRE ATT&CK
• TLPT