Red Team

A red team is a cybersecurity team that tests technologies, policies, systems, and assumptions by adopting an adversary’s approach. Red team exercises include simulating multi-stage cyberattacks against specific targets on networks to simulate how an adversary might achieve a strategic effect, like stealing financial data, manipulating voter registration data, or destroying data to disrupt critical operations. Red teams pursue these objectives by adopting the tactics, techniques, and procedures (TTPs) of real adversaries. Red team testing is often episodic, and the coverage delivered is therefore limited by personnel hours; the result is that coverage is unfortunately smaller than the scale of the security team’s defenses. Red teams are often used to supplement blue teams.