Definition
A red team is a group of security experts who act as real attackers, with permission, to test whether an organisation can be breached and whether its people, processes and technology detect and stop the attack.
What a red team is
A red team is a group of security experts who play the role of a real attacker against an organisation, with its permission. Their job is to reach a defined goal, such as access to payment systems or a board member's email, using the same tools, techniques and patience a real threat actor would.
The term comes from military exercises, where the red side plays the enemy. In security, the point is not to find every vulnerability but to answer a harder question: could a determined attacker achieve their goal, and would we notice in time?
What a red team exercise looks like
- Scoping and rules of engagement. Leadership agrees the objectives, what is in and out of bounds, how long the exercise runs and who knows about it. Usually only a small "white team" is informed.
- Reconnaissance. The red team gathers information about people, systems, suppliers and technology, much of it from public sources.
- Initial access. They try to get a foothold, for example through phishing, an exposed service, stolen credentials or physical entry.
- Persistence and movement. Once inside, they stay hidden, escalate privileges and use lateral movement to get closer to the target.
- Objective. They try to reach the agreed goal and collect evidence that they did.
- Reporting and debrief. The team explains the full attack path, what worked, what was detected and what was missed, often replaying it with the defenders.
Exercises often run for several weeks, because real attackers take their time and avoid making noise.
Red team vs penetration testing
The two are related but answer different questions:
| Penetration test | Red team exercise | |
|---|---|---|
| Goal | Find and confirm as many vulnerabilities as possible in a defined scope | Reach a specific objective, like a real attacker |
| Scope | Specific systems, applications or networks | The whole organisation: people, processes and technology |
| Stealth | Usually not a priority | Essential: avoid detection for as long as possible |
| Who knows | The IT and security teams are usually informed | Usually only a few people know |
| Duration | Days to a couple of weeks | Often several weeks or more |
| Main output | A list of confirmed findings to fix | A view of how well the organisation detects and responds |
A penetration test asks "what is broken?". A red team asks "could an attacker get what they want, and would we stop them?".
Red team vs blue team vs purple team
- Red team: the attackers, testing defences by trying to get past them
- Blue team: the defenders, who detect, respond to and recover from attacks
- Purple team: red and blue working together, with the red team running techniques openly so the blue team can tune detections in real time
Red team exercises measure the defence. Purple teaming improves it faster by sharing what happens as it happens.
What red teams test
- People: how staff respond to phishing, phone calls and social engineering
- Processes: whether alerts are escalated, incidents are handled and decisions are made in time
- Technology: whether security tools detect and block real attack techniques
- Physical security: whether badges, doors and reception procedures stop someone walking in
Red teams often use the MITRE ATT&CK framework to plan their techniques and to map what the defenders did and did not detect.
Regulated red teaming
In some sectors, red teaming is a formal requirement. Financial regulators run threat intelligence-led programmes such as TIBER-EU in Europe and CBEST in the UK, and the EU's Digital Operational Resilience Act (DORA) requires threat-led penetration testing for certain financial entities. These exercises follow strict rules on scoping, threat intelligence and independent testers.
When is an organisation ready for a red team?
Red teaming gives the most value once the basics are in place. If regular penetration tests still find many serious issues, a red team will mostly confirm what is already known, at a higher cost. Signs you are ready:
- Regular testing and remediation are already part of how you work
- You have a security operations or monitoring capability to test
- Critical assets and likely threats are understood
- Leadership wants an honest answer about detection and response
Benefits and limitations
Benefits: a realistic view of how an attack would unfold, a test of detection and response rather than just prevention, and evidence that helps leadership understand risk.
Limitations: exercises are expensive and infrequent, they follow a few paths rather than covering every system, and the picture they give starts to age as soon as the environment changes.
How Plainsea helps
Red team exercises are deep but happen only once or twice a year. Plainsea complements them with attacker-style testing that runs continuously within the scope you set: AI agents try to exploit weaknesses and chain them into attack paths, and every finding is confirmed before it reaches your team. Common gaps are found and re-tested between exercises, so red team time can go on the harder questions about detection and response.