Red Team

A red team is a group, internal or external, that plays the role of a determined attacker in an authorised exercise. Its aim is to test whether the organisation can detect and respond to a realistic intrusion, not only to list technical flaws.

Why it matters

Scans and standard penetration tests look for weaknesses broadly. A red team exercise sets a goal, such as reaching a sensitive system, and measures how far the team gets and whether defenders notice. It tests the whole chain: technology, staff awareness and incident procedures. Findings show where detection or coordination failed, even if every individual control worked.

Example

Leadership authorises a month-long exercise with defined rules of engagement and an emergency stop contact. The red team reports that it reached a test file server using a phished test account, and that alerts fired but were not escalated for two days. The blue team uses that finding to improve escalation.

Common mistakes

• Running an exercise without written authorisation and clear limits.
• Treating it as a competition rather than a learning process.
• Skipping the debrief where both sides share what was seen.
• Starting before basic hygiene is in place.

Related

• Blue team
• Penetration testing
• SOC (Security Operations Center)
• Social engineering

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.