red-teaming

name	red-teaming
description	Use when planning or conducting adversarial red team engagements that test an organization's detection, response, and resilience capabilities beyond traditional penetration testing. Covers red team vs pen test distinctions, adversary simulation frameworks (MITRE ATT&CK, Cyber Kill Chain), purple teaming, C2 frameworks, and AI/LLM red teaming. USE FOR: red teaming, adversary simulation, MITRE ATT&CK, Cyber Kill Chain, purple teaming, C2 frameworks, assumed breach, attack path mapping, detection testing, AI red teaming, LLM red teaming, tabletop exercises DO NOT USE FOR: automated vulnerability scanning (use security-testing), initial vulnerability discovery (use penetration-testing), threat modeling during design (use threat-modeling)
license	MIT
metadata	{"displayName":"Red Teaming","author":"Tyler-R-Kendrick"}
compatibility	claude, copilot, cursor
references	[{"title":"MITRE ATT&CK Framework","url":"https://attack.mitre.org"},{"title":"Lockheed Martin Cyber Kill Chain","url":"https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html"},{"title":"NIST SP 800-53 Security and Privacy Controls","url":"https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final"}]

Red Teaming

Overview

Red teaming is an adversarial assessment that goes beyond penetration testing to evaluate an organization's detection, response, and resilience capabilities against realistic attack scenarios. While pen testing asks "can we get in?", red teaming asks "can you detect us, stop us, and recover?"

Red teams operate with stealth, simulate real-world threat actors (APTs, insider threats, ransomware groups), and test the full kill chain — from initial access through lateral movement to objective completion. The goal is not just to find vulnerabilities, but to expose gaps in people, processes, and technology.

Important: Red team engagements require explicit written authorization from organizational leadership. Only a small group (the "white team" or "trusted agents") should know the engagement is occurring. Unauthorized adversarial activity is illegal.

Key References

Title	Author(s)	Focus
Red Team Development and Operations	Joe Vest & James Tubberville	Planning and executing red team engagements
The Hacker Playbook 3	Peter Kim	Red team field manual with practical TTPs
Adversarial Tradecraft in Cybersecurity	Dan Borges	Offensive and defensive techniques for red/blue teams
MITRE ATT&CK Framework	MITRE Corporation	Comprehensive knowledge base of adversary tactics and techniques
Cyber Kill Chain	Lockheed Martin	Seven-stage model of cyberattack progression

Red Team vs Pen Test vs Vulnerability Assessment

Dimension	Vulnerability Assessment	Penetration Test	Red Team
Goal	Find known vulnerabilities	Exploit vulnerabilities to prove impact	Test detection and response against realistic attacks
Scope	Broad, automated scanning	Defined targets and systems	Objective-based (e.g., "exfiltrate customer database")
Stealth	None	Minimal	High — evade detection, mimic real threat actors