A red team is an authorized group that imitates an adversary so defenders can practice detection, response, and recovery.
Permission, a written goal, and a way to stop the exercise keep the work as a drill rather than a crime.
How it works
Unlike a narrow test of listed weaknesses, the exercise often pursues an objective such as reaching a crown jewel without being stopped.
Defenders, sometimes called the blue team, are measured on whether they notice and act.
Deconfliction prevents the drill from being mistaken for a real intrusion, and a report teaches what to improve.
This page does not provide intrusion steps, because an authorized exercise is planned with the owner, not copied from a tutorial.
Concrete examples
- A bank hires an authorized team to see whether anyone notices a quiet path toward the ledger network.
- A utility runs a drill with a stop word so operators can halt activity the moment it risks operations.
- An agency compares alert quality during the exercise with the assumptions in its response plan.
Protective measures
- Require written permission, a named objective, excluded systems, and a live contact before an exercise starts.
- Share enough schedule detail with defenders that a real incident is not ignored as part of the drill.
- Forbid lasting access, data theft, and destructive actions, and verify those limits in the contract.
- Turn the report into detection improvements and practice, and do not publish steps that others could copy.
Related articles
What is pentesting and how does scoping work? explains the short name and the scoping that define a permitted test of listed systems.
What is a security operations center? explains the monitoring team that should notice an authorized exercise and a real incident.
What is security incident response? explains the handling process a red team exercise is meant to pressure test.