Red Team

What is a Red Team?

A Red Team is a group of internal or external security specialists who, with the organisation’s permission, emulate a real attacker in order to test whether the organisation detects, stops and recovers from a realistic, targeted attack in time. Where a pentest looks for as many vulnerabilities as possible in a defined system, a Red Team works covertly towards a pre-agreed objective, such as access to an engineering workstation or the payment system. The defenders, the Blue Team, usually do not know an exercise is running.

The aim of a Red Team is not only to find vulnerabilities, but above all to test how well the organisation detects, responds to and recovers from a realistic attack.

The term comes from military exercises, in which the red team played the adversary and the blue team the friendly forces.

🧠 What does a Red Team do?

A Red Team behaves like a real adversary, within rules of engagement agreed in advance:

• Simulates real attackers - cybercriminals, insiders (Insider Threat) or state-backed APTs, based on current threat intelligence
• Uses known techniques - catalogued in MITRE ATT&CK and, for industrial environments, MITRE ATT&CK for ICS
• Carries out controlled attacks - Phishing and other forms of Social Engineering, abuse of misconfigurations, privilege escalation and lateral movement
• Stays under the radar - prefers built-in administration tools (Living Off The Land) to evade detection by EDR and SIEM
• Tests people and processes - not just technology, but also whether staff report suspicious activity and whether escalation to the SOC works
• Avoids damage - scope, prohibited actions and an emergency stop procedure are agreed in writing beforehand

Typical actions include breaking in through poorly secured external assets, abusing open SMB shares or cloud storage, establishing persistence via scheduled tasks or registry keys, and communicating with the team’s own command-and-control (C2) server.

🔄 How does a Red Team differ from other security tests?

A Red Team therefore does not find every vulnerability, but shows whether one well-chosen attack path works and whether anyone notices. Organisations that do not yet have basic security and monitoring in place usually get more value from a pentest.

👥 Which teams and roles are involved in a red team exercise?

The Control Team is crucial: if a real threat or an unexpected disruption occurs, it can halt the exercise, preventing the Blue Team from mistaking an exercise for a real incident or vice versa. Afterwards Red and Blue meet in a purple teaming session to walk through attack paths and missed detections.

🔧 How does a red team exercise work, step by step?

1. Preparation and scope - the board gives written authorisation and the Control Team defines critical functions, flags, prohibited actions, test windows and an emergency stop procedure. Without authorisation, intrusion is a criminal offence in most jurisdictions; in the Netherlands it is computer trespass under article 138ab of the Criminal Code.
2. Threat intelligence - a threat analysis determines which attackers are realistic and which TTPs they use; concrete scenarios follow from this.
3. Active attack phase - reconnaissance, initial access (for example via phishing or remote access), persistence, privilege escalation in Active Directory and lateral movement towards the flags. Under DORA this phase lasts at least 12 weeks.
4. Leg-ups - if the Red Team gets stuck, the Control Team can provide a step up, such as an account or network access, so the rest of the attack chain is still tested.
5. Reporting - the Red Team documents the attack path; the Blue Team reconstructs what it did and did not see.
6. Replay and purple teaming - both sides walk through the steps together and improve detection rules, playbooks and threat hunting hypotheses.
7. Remediation plan - each measure gets an owner and a deadline; a later test checks whether they work.

🏭 How do you run a Red Team safely in an OT environment?

In OT, availability and safety come first. An unintended command to a PLC can make a machine move or stop a process. Extra rules of engagement therefore apply:

• Flags instead of impact - the Red Team proves it can reach an engineering workstation, HMI or historian, or that it has write access to a controller, but does not make any change.
• Never touch the SIS - safety instrumented systems are excluded from active attack; showing that the route exists is enough. Attacks such as TRITON show why that path is so dangerous.
• The IT/OT boundary as the core scenario - can an attacker reach the OT zones from the office network via the jump server, a supplier connection or the DMZ? This directly tests whether network segmentation in line with the Purdue Model works.
• Test environment for risky steps - exploits against controllers and protocol fuzzing belong on a test bench or digital twin, not in production.
• Operators on standby - a process engineer sits in the Control Team and can intervene immediately; test windows preferably coincide with quiet production periods.
• Count OT detection too - the test reveals whether the OT SOC or a passive OT IDS spots unusual engineering sessions in real time.

🔐 Which frameworks and rules apply to red teaming?

For most industrial companies red teaming is therefore not a legal obligation, but it is a strong way to demonstrate that controls from ISO 27001 or IEC 62443 work in practice. That supports compliance and maturity assessments.

🎯 What does a Red Team deliver?

• A proven attack path - which combination of small weaknesses led to the flag
• Insight into detection - which steps the SOC saw, when, and which log sources were missing
• A test of Defense in Depth - did several defensive layers slow the attack, or did a single layer fail
• A test of people - did staff report the phishing email, and does security awareness match reality
• Improved incident response - playbooks, escalation lines and cooperation between IT and OT

❓ Frequently asked questions

How long does a red team exercise take?

A red team exercise usually takes several weeks to a few months, including preparation and reporting. Under DORA, the active attack phase of a threat-led penetration test must last at least 12 weeks. A pentest, at a few days to weeks, is much shorter.

Does the Blue Team know a Red Team is active?

In a classic red team exercise the Blue Team does not know; only a small Control Team is informed. This is how genuine detection and response are measured. Afterwards Red and Blue share their insights in a purple teaming session.

Is red teaming mandatory for companies under NIS2?

Red teaming is not mandatory under NIS2 or the Dutch Cyberbeveiligingswet, although the law does require you to assess the effectiveness of your security measures. Only financial entities designated under DORA must have a threat-led penetration test carried out at least every three years.

Can a Red Team safely test an OT environment?

A Red Team can safely test an OT environment if it works with flags rather than real process interventions and keeps safety systems out of the attack. Risky steps take place on a test bench or digital twin. A process engineer in the Control Team can stop the exercise immediately.

What is the difference between a Red Team and a Purple Team?

A Red Team attacks covertly and measures whether the defence notices the attack on its own. A Purple Team has attackers and defenders cooperate openly to improve detection rules straight away. Many organisations close a red team exercise with a purple teaming session.

When is an organisation ready for a Red Team?

An organisation is ready for a Red Team when basic measures such as patching, segmentation and logging are in place and a working SOC or monitoring process exists. Without that foundation a pentest finds the same weaknesses faster and at lower cost. Red teaming mainly measures the maturity of detection and response.

📌 In summary

A Red Team tests your organisation as a real attacker would: targeted, stealthy and realistic, but within strict rules of engagement.

The difference from a pentest is the goal: not finding every vulnerability, but proving whether detection and response work. In OT this means working with flags, keeping the SIS out of scope and putting the IT/OT boundary at the centre. Frameworks such as TIBER-EU and DORA TLPT provide structure, and a closing purple teaming session ensures the lessons end up as a better defence.