What is Red Team?

Red teaming differs from penetration testing in scope, duration, and goal. A pen test asks 'what vulnerabilities exist in this system,' runs for days, and produces a findings report the customer patches from. A red team asks 'can this organization detect and stop a sophisticated, persistent adversary,' runs for weeks or months, and is judged on stealth and objective completion, not just exploit count. A typical objective might be 'exfiltrate a sample of the customer database without triggering an alert that leads to containment' or 'simulate ransomware deployment across the domain.' To do that convincingly, red teams draw from the full MITRE ATT&CK playbook: custom or living-off-the-land malware that avoids known signatures, spear-phishing and other social engineering against employees, sometimes physical intrusion attempts (tailgating into a badge-controlled office, planting a rogue device on the network), and supply-chain or third-party-access simulation. Operators maintain operational security deliberately: they rotate C2 infrastructure, throttle activity to avoid volumetric anomalies, and adapt their techniques mid-engagement if they suspect the blue team has spotted something, exactly like a real intrusion actor would. The engagement typically closes with a joint debrief (sometimes called a purple team session) where the red team walks the SOC through their full kill chain step by step against the SOC's own alert timeline, so analysts can see precisely which step should have fired an alert and didn't, and why. Some organizations run this as an assumed-breach engagement instead, where the red team starts with a foothold already granted (a low-privilege user account, or an implant pre-placed on one workstation) to compress the timeline and focus purely on lateral movement and detection, since not every organization has the budget or patience for a full months-long external-to-domain-admin campaign. A related but distinct discipline is purple teaming, where the red and blue teams work side by side in real time rather than in an adversarial black-box setup, deliberately trading the realism of a blind test for faster detection-engineering iteration.