What is a red team?

Red teams in plain English

The term comes from military war games: the red side played the enemy, while the blue side defended. It’s the same in IT security. The red team attacks, and the blue team defends – that is, IT operations, the security team, or a service provider that monitors the systems.

Imagine a museum hiring professionals to “steal” a particular painting without warning. Which route they take is up to them: a trick at the reception desk, a fake maintenance work order, an open window in the storeroom. The security guards know nothing about it. In the end, the museum knows not only its weaknesses but also whether its alarm system and guards would work in a real emergency. That is exactly what a red team does – using technical, human, and physical routes.

The difference from a penetration test: a pentest looks for as many vulnerabilities as possible within a clearly defined area. A red team, by contrast, pursues a specific objective, chooses its own route, and at the same time tests whether your organization detects the attack and responds correctly. So the pentest answers the question “Where are we vulnerable?” – the red team answers “Would we notice a real attack in time?” Our Red Teaming & APT Simulation page describes how such exercises work.

How a red team works

Three groups are involved in a red team exercise: the red team as the attacker, the unsuspecting blue team, and a small white team. The white team is in the know, steers the exercise, and can intervene at any time. Here’s how it works:

1. Objectives and ground rules: Objectives are defined together with the white team, such as access to financial data or production systems. Permitted routes, off-limits areas, and abort criteria are set down in writing in the rules of engagement.
2. Reconnaissance: The red team gathers publicly available information about the organization, its employees, and its technology (OSINT).
3. Initial access: Depending on the scenario, the team gets in via a phishing email, a vulnerability in a server, or physical access to the building.
4. Spreading: The team escalates privileges, moves inconspicuously through the network (lateral movement), and works its way toward the objective.
5. Reaching the objective: Once there, the team might simulate data exfiltration using test data, for example – without any destructive actions.
6. Evaluation: The report traces the attack step by step and shows which steps were detected and which weren’t. This is often followed by joint purple teaming to close detection gaps.

A special form is the APT simulation. APT stands for “advanced persistent threat” – well-resourced groups of attackers that move through networks undetected for long periods. Many red teams base their approach on MITRE ATT&CK, a freely accessible knowledge base of attack techniques.

A practical example

A fictional scenario: A medical technology manufacturer has been commissioning pentests for years and has its systems monitored by a service provider. Now it wants to know whether its development data would withstand a targeted attack. On a professional networking site, the red team finds the names of new employees, sends a fake email in the name of the HR department, and thus gains access to a new colleague’s computer. From there, it works its way to the development servers over several weeks.

The evaluation shows: some employees had reported the phishing email, but nobody acted on their reports. The security software on one server raised an alert, but the alert was closed as a false positive. So the technology worked – the processes behind it didn’t. A classic pentest would not have delivered this insight.

Why does this matter for businesses?

A red team tests whether technology, people, and processes work together in an emergency. This is especially valuable for organizations that have already invested in monitoring and threat detection: they find out whether that investment is paying off.

For financial entities, the topic also carries regulatory weight. The EU’s DORA regulation requires financial entities selected by the supervisory authorities to carry out threat-led penetration testing (TLPT), as a rule at least every three years. Methodologically, this is a red team test based on the European TIBER-EU framework.

What to look out for

• Assess your maturity: Red teaming pays off above all when the fundamentals are in place – regular pentests, functioning patch management, and detection tools. Otherwise, a penetration test is the better place to start.
• Set specific objectives: Define the assets that really matter instead of having “everything” tested.
• Keep the circle of insiders small: That’s the only way the exercise stays realistic.
• Commission it on a sound legal basis: The foundation is a written engagement signed off by senior management, with clear off-limits areas and abort criteria. Involve the people responsible for data protection and, where applicable, the works council (employee representatives) at an early stage.
• Evaluate together: Use the results to learn, not to assign blame.

How Rootsektor can help

With Red Teaming & APT Simulation, Rootsektor simulates targeted attacks across technology, people, and buildings – based on MITRE ATT&CK and, if you wish, modeled on the TIBER-EU methodology. Depending on your maturity level, you can choose a full-scope scenario without prior knowledge, a start from an already compromised account (assumed breach), or purple teaming as an open variant of, or complement to, red teaming. After scoping, you receive a fixed-price quote within 24 hours (on business days).