Red Teaming: The Complete Guide to Adversary Simulation

Master the art of thinking like an attacker to build stronger defenses. From MITRE ATT&CK methodology to career paths, this guide covers everything security professionals need to know about red team operations.

What Is Red Teaming?

Red teaming is a structured, adversary-simulation exercise in which a group of authorized security professionals — the red team — attempts to compromise an organization using the same tactics, techniques, and procedures (TTPs) employed by real-world threat actors. The goal is not simply to find vulnerabilities, but to test the organization's detection, response, and resilience capabilities against realistic attack scenarios.

Unlike vulnerability assessments or penetration tests that focus on identifying technical weaknesses, red team engagements evaluate the entire security ecosystem: people, processes, and technology. A red team might combine spear-phishing campaigns, physical intrusion attempts, social engineering, and technical exploitation to achieve objectives such as accessing the CEO's email, exfiltrating customer data, or deploying simulated ransomware — all while remaining undetected for as long as possible.

Military Origins

The concept of red teaming originated in military and intelligence communities during the Cold War. The U.S. military used "red teams" to simulate Soviet adversary strategies and tactics, stress-testing war plans and defensive postures. The idea was straightforward: if your own people cannot find the weakness, the enemy will. The Israeli Defense Forces adopted a similar approach after intelligence failures, establishing a dedicated unit (known as the "Devil's Advocate" office) specifically tasked with challenging prevailing assumptions.

This adversarial thinking methodology migrated into cybersecurity in the late 1990s and early 2000s as organizations recognized that compliance checklists and automated scanners were insufficient to defend against sophisticated, motivated attackers. The National Security Agency (NSA), the Department of Defense, and major financial institutions were among the first to adopt formal red team programs.

Evolution in Cybersecurity

Modern cybersecurity red teaming has evolved far beyond its military roots. Today's red teams operate with detailed rules of engagement, formalized methodologies, and sophisticated tooling. The discipline has matured from ad-hoc "tiger teams" running basic exploits into a recognized profession with dedicated certifications, career paths, and an entire ecosystem of commercial and open-source tools.

Several factors have driven this evolution:

• Advanced Persistent Threats (APTs) — state-sponsored groups like APT28, APT29, and Lazarus Group demonstrated that traditional defenses were inadequate against patient, well-resourced adversaries.
• Regulatory requirements — frameworks like TIBER-EU (Threat Intelligence-based Ethical Red Teaming) and CBEST (in the UK financial sector) now mandate red team assessments for critical infrastructure.
• The rise of purple teaming — organizations realized that red teams deliver maximum value when they collaborate with defenders, not just adversarially test them.
• Cloud and hybrid environments — the attack surface expanded dramatically, requiring red teams to develop skills in cloud exploitation, container breakouts, and identity-based attacks.

At its core, red teaming answers a question that no other security assessment can: "If a skilled, motivated adversary targeted our organization right now, would we detect them — and could we stop them?"

Red Team vs Penetration Testing vs Vulnerability Assessment

These three assessment types are often confused, but they serve fundamentally different purposes. Understanding the distinction is critical for security leaders deciding which assessment their organization needs — and for practitioners building their career path.

When to use which: Organizations with mature security programs should run all three in a layered approach. Vulnerability assessments provide continuous baseline hygiene. Penetration tests validate that specific defenses work. Red team engagements answer the strategic question of whether the overall security posture can withstand a determined adversary. If your organization has never had a penetration test, starting with a red team engagement would be premature — you need to walk before you can run.

Red Team Methodology

Professional red teams do not operate on instinct alone. They follow structured methodologies that ensure comprehensive coverage, repeatable results, and alignment with real-world adversary behavior. Several frameworks guide red team operations, each offering a different lens on the attack lifecycle.

MITRE ATT&CK Framework

The MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) framework is the de facto standard for mapping red team activities to real-world adversary behavior. ATT&CK catalogs hundreds of techniques organized across 14 tactical categories, from initial access through exfiltration and impact. Red teams use ATT&CK to:

• Plan engagements — select specific techniques that match the threat profile the client faces (e.g., simulating APT29 against a government agency).
• Track coverage — map which ATT&CK techniques were tested during the engagement and which detection gaps were found.
• Report findings — communicate results in a language that both technical teams and executives understand.
• Measure improvement — compare detection rates across engagements over time using consistent technique IDs.

The Cyber Kill Chain

Developed by Lockheed Martin, the Cyber Kill Chain describes seven phases of an intrusion. While less granular than ATT&CK, it provides an intuitive linear model that is useful for explaining red team operations to non-technical stakeholders:

1. Reconnaissance — Gathering intelligence about the target. This includes passive OSINT (open-source intelligence) such as LinkedIn profiles, DNS records, leaked credentials, and public-facing infrastructure. Active reconnaissance involves port scanning, service enumeration, and technology fingerprinting. The goal is to build a comprehensive picture of the attack surface before ever sending a single packet to the target.
2. Weaponization — Developing or acquiring the attack payload. This might involve crafting a malicious Office document with embedded macros, building a custom implant that evades endpoint detection, or preparing a phishing infrastructure with lookalike domains. Sophisticated red teams develop their own tooling to avoid signature-based detection.
3. Delivery — Transmitting the weaponized payload to the target. Common delivery vectors include spear-phishing emails, watering hole attacks (compromising websites the target visits), USB drops, supply chain compromise, or exploiting internet-facing services. The delivery mechanism is chosen based on reconnaissance findings.
4. Exploitation — Triggering the payload to gain initial code execution. This could be a user opening a malicious attachment, a browser exploit firing on a compromised website, or exploiting an unpatched vulnerability in an exposed service. Initial access is often the hardest phase — modern defenses like email filtering, sandboxing, and endpoint protection create multiple layers that must be bypassed.
5. Installation — Establishing persistence on the compromised system. Red teams deploy implants (also called agents or beacons) that survive reboots, user logoffs, and basic remediation. Persistence mechanisms include scheduled tasks, registry run keys, WMI event subscriptions, DLL hijacking, and service creation.
6. Command and Control (C2) — Establishing a communication channel between the implant and the red team's infrastructure. Modern C2 frameworks support encrypted communications over common protocols (HTTPS, DNS, SMB) to blend with legitimate traffic. Malleable C2 profiles allow operators to shape their traffic to mimic specific applications or services, making detection significantly harder.
7. Actions on Objectives — Executing the engagement goals. This is where the red team demonstrates business impact: accessing sensitive data, moving laterally to critical systems, escalating privileges to domain administrator, deploying simulated ransomware, or exfiltrating data. Everything is documented meticulously to reconstruct the attack narrative for the final report.

Additional Frameworks

PTES (Penetration Testing Execution Standard) provides a comprehensive methodology covering pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting. While originally designed for penetration testing, its structured approach is widely adapted for red team engagements.

OSSTMM (Open Source Security Testing Methodology Manual) takes a more scientific, metrics-driven approach to security testing. It defines "attack surface" mathematically and provides formulas for calculating "actual security" versus "operational security." While less commonly used than ATT&CK in practice, OSSTMM's emphasis on quantifiable results appeals to organizations seeking data-driven security assessments.

Regardless of which framework a red team follows, every professional engagement begins with clearly defined rules of engagement (RoE) that specify: what is in scope and out of scope, emergency contact procedures, data handling requirements, and legal authorization. Red teaming without proper authorization is illegal — the line between authorized red teaming and criminal hacking is the paperwork.

Common Red Team Tools

Red teams rely on a combination of commercial, open-source, and custom-built tools to simulate adversary behavior. Understanding what each tool does — and when it is used during an engagement — is essential knowledge for both offensive and defensive security professionals. The following tools are described here for educational purposes only.

Cobalt Strike

Cobalt Strike is the industry-standard commercial adversary simulation platform. Its "Beacon" implant supports sophisticated post-exploitation capabilities including process injection, token manipulation, lateral movement, and data exfiltration. Cobalt Strike's Malleable C2 profiles allow operators to customize their network traffic to mimic legitimate applications, making detection extremely challenging. It is the primary tool used in most professional red team engagements and is a core component of the CRTO certification.

Metasploit Framework

Metasploit is the most widely used open-source exploitation framework, maintained by Rapid7. It contains thousands of exploit modules, payloads, and auxiliary tools for every phase of an engagement. While often associated with penetration testing rather than red teaming, Metasploit's Meterpreter payload and its extensive post-exploitation modules make it valuable for red team operations, particularly during initial access and early lateral movement phases.

BloodHound

BloodHound is a graph-theory tool that maps Active Directory (AD) relationships to identify attack paths from any compromised user to high-value targets like Domain Admin. It reveals trust relationships, group memberships, ACL misconfigurations, and delegation issues that are nearly impossible to find manually. BloodHound has fundamentally changed how red teams approach Active Directory environments — it can identify attack paths that would take days to discover manually in minutes.

Mimikatz

Mimikatz is a Windows credential extraction tool that can recover plaintext passwords, NTLM hashes, Kerberos tickets, and PIN codes from memory. It is used in nearly every red team engagement targeting Windows environments. Mimikatz also supports advanced techniques like pass-the-hash, pass-the-ticket, Golden Ticket, and Silver Ticket attacks against Kerberos. Its capabilities have driven significant improvements in Windows credential protection (Credential Guard, LSA protection).

Burp Suite

Burp Suite (by PortSwigger) is the standard web application security testing platform. Red teams use it when the attack path goes through web applications — intercepting and modifying requests, testing for injection flaws, analyzing authentication mechanisms, and discovering API vulnerabilities. The Professional edition's scanner automates detection of common web vulnerabilities, while its extensibility through BApps allows teams to build custom testing capabilities.

Nmap

Nmap (Network Mapper) is the foundational network reconnaissance tool. It performs host discovery, port scanning, service version detection, and OS fingerprinting. Red teams use Nmap during the reconnaissance phase to map the target network, identify live hosts, discover open services, and find potential entry points. Its scripting engine (NSE) extends its capabilities to include vulnerability detection, brute-force testing, and service enumeration.

CrackMapExec (NetExec)

CrackMapExec (now maintained as NetExec) is a Swiss Army knife for Active Directory post-exploitation. It automates credential spraying, share enumeration, command execution across multiple hosts, and credential harvesting. Red teams use it for rapid lateral movement once initial credentials are obtained — testing recovered passwords against every system in the network to map access and identify paths to high-value targets.

Beyond these tools, red teams frequently develop custom tooling — bespoke implants, loaders, and evasion techniques designed to bypass the specific defensive stack of their target. The ability to write custom tools (or modify existing ones to evade detection) separates red team operators from penetration testers who rely primarily on off-the-shelf tools.

Red Team Certifications

Certifications validate skills and open doors in the competitive red team job market. The following certifications are most valued by employers hiring red team professionals, roughly ordered from foundational to advanced.

OSCP — Offensive Security Certified Professional

The OSCP is widely considered the gold standard for hands-on offensive security skills. The 24-hour practical exam requires candidates to compromise multiple machines in a lab environment — there are no multiple-choice questions. OSCP proves that you can actually hack, not just talk about hacking. It is the most requested certification in red team job postings and serves as the minimum bar for most offensive security roles. Practice with our quiz resources to prepare.

CRTO — Certified Red Team Operator

The CRTO from Zero-Point Security focuses specifically on red team operations using Cobalt Strike. The curriculum covers adversary simulation, OPSEC, Active Directory attacks, lateral movement, and data exfiltration in a realistic lab environment. CRTO is increasingly valued because it tests real red team skills — not just exploitation, but the full operational tradecraft of remaining undetected while achieving objectives.

GPEN — GIAC Penetration Tester

The GPEN validates comprehensive penetration testing knowledge including reconnaissance, scanning, exploitation, password attacks, and web application testing. While more pen-test oriented than purely red-team focused, GPEN is respected in government and enterprise environments. The GIAC ecosystem also offers GXPN (Expert Penetration Tester) for more advanced practitioners.

CEH — Certified Ethical Hacker

The CEH from EC-Council provides foundational knowledge of hacking methodologies, attack vectors, and countermeasures. While less hands-on than OSCP, CEH is widely recognized and often required for government and military positions (particularly those requiring DoD 8570/8140 compliance). It serves as a good entry point for professionals transitioning into offensive security.

PenTest+ — CompTIA PenTest+

The CompTIA PenTest+ covers penetration testing planning, scoping, vulnerability management, and reporting. It is performance-based (includes simulations) and vendor-neutral. PenTest+ is a solid stepping stone toward more advanced certifications like OSCP and is recognized for DoD 8570/8140 compliance at the CSSP Auditor level.

Certification Progression Path

A recommended progression: CEH or PenTest+ (foundation) → OSCP (proving ground) → CRTO (red team specialization) → GXPN or OSEP (expert level). Each certification builds on the previous, expanding from theoretical knowledge to hands-on exploitation to full adversary simulation capabilities.

Building a Red Team Career Path

Red teaming is one of the most technically demanding and rewarding career paths in cybersecurity. Here is a realistic progression from entry-level to leadership, including the skills and experience needed at each level. For more career guidance, see our guide to getting into cybersecurity.

Level 1: Junior Penetration Tester (0-2 Years)

Salary range: $70,000-$95,000

Most red teamers start in penetration testing, not red teaming directly. At this level you are learning the fundamentals:

• Network and web application vulnerability assessment
• Using standard tools (Nmap, Burp Suite, Metasploit) under guidance
• Writing clear findings in penetration test reports
• Understanding common vulnerabilities (OWASP Top 10, SANS Top 25)
• Building lab environments (Active Directory, vulnerable VMs) for practice

Target certifications: CEH, PenTest+, eJPT (eLearnSecurity Junior Penetration Tester)

Level 2: Penetration Tester (2-4 Years)

Salary range: $95,000-$130,000

At this level you are running engagements independently:

• Leading penetration tests from scoping through reporting
• Active Directory exploitation (Kerberoasting, AS-REP roasting, delegation attacks)
• Web application exploitation beyond automated scanners
• Basic social engineering and phishing campaigns
• Client communication and presentation skills

Target certifications: OSCP, GPEN

Level 3: Red Team Operator (4-7 Years)

Salary range: $130,000-$175,000

This is where you transition from penetration testing to true red teaming:

• Adversary simulation using C2 frameworks (Cobalt Strike, Mythic, Sliver)
• Custom tooling development (implants, loaders, evasion techniques)
• Advanced post-exploitation and lateral movement tradecraft
• OPSEC — maintaining stealth throughout the engagement
• Threat intelligence-informed operations (emulating specific APT groups)
• Physical security testing and advanced social engineering

Target certifications: CRTO, OSEP (Offensive Security Experienced Penetration Tester)

Level 4: Senior Red Team Operator / Red Team Lead (7-10+ Years)

Salary range: $175,000-$220,000+

At the senior and lead level, you are designing engagements and mentoring the team:

• Engagement planning, threat modeling, and adversary emulation design
• Leading multi-operator campaigns spanning weeks or months
• Developing red team infrastructure (redirectors, DNS, C2 profiles)
• Malware development and advanced evasion research
• Executive briefings and strategic security recommendations
• Building and managing red team programs
• Purple team facilitation and blue team capability development

Target certifications: GXPN, OSED (Offensive Security Exploit Developer), OSEE

Essential Skills at Every Level

Regardless of seniority, every red team professional needs:

• Programming — Python for tooling and automation, C/C# for implant development, PowerShell for Windows operations, Bash for scripting
• Networking — deep understanding of TCP/IP, DNS, HTTP/S, Active Directory protocols (LDAP, Kerberos, SMB)
• Operating systems — internals of both Windows and Linux (process injection, memory management, privilege escalation mechanisms)
• Communication — the ability to translate technical findings into business risk for executive audiences
• Continuous learning — the threat landscape evolves constantly; yesterday's techniques get detected tomorrow

Blue Team and Purple Team: The Defensive Counterparts

Red teaming does not exist in a vacuum. Its value is realized through interaction with the blue team (defenders) and, increasingly, through collaborative purple team exercises. Understanding these relationships is essential for anyone in offensive security — and for organizations deciding how to structure their security teams.

Blue Team: The Defenders

The blue team is responsible for detecting, responding to, and mitigating attacks. Blue team functions include:

• Security Operations Center (SOC) — 24/7 monitoring of alerts, logs, and security events
• Incident response — containing and remediating active threats (see our Incident Response Guide)
• Threat hunting — proactively searching for adversary activity that evades automated detection
• Detection engineering — building and tuning detection rules, SIEM correlation, and automated response playbooks
• Digital forensics — analyzing compromised systems to understand what happened and preserve evidence

In a traditional red team engagement, the blue team does not know the engagement is happening. This tests their ability to detect and respond to a real attack. The engagement's success is measured not just by what the red team achieved, but by what the blue team detected — and how quickly they responded.

Purple Team: Collaborative Security

Purple teaming is the collaborative integration of red team (offensive) and blue team (defensive) activities. Rather than operating in adversarial secrecy, purple team exercises have both sides working together in real-time:

1. The red team executes a specific technique (e.g., MITRE ATT&CK T1055 — Process Injection).
2. Both teams observe whether the blue team's detection stack identifies the activity.
3. If detected — validate the alert quality, response time, and triage accuracy.
4. If not detected — the blue team builds a detection rule on the spot, and the red team validates it works.
5. Move to the next technique and repeat.

Purple teaming maximizes the value of every red team technique. In a traditional engagement, a red team might use 50 techniques but only report 15 detection gaps in the final report — weeks after the engagement ends. In a purple team exercise, every technique produces an immediate, actionable outcome: either a validated detection or a new rule.

Why Purple Teaming Is the Future

The industry is shifting toward purple teaming for several compelling reasons:

• Faster ROI — detection improvements happen during the exercise, not weeks later after a report is delivered.
• Knowledge transfer — blue team members learn attacker techniques firsthand; red team members learn what defenders can see.
• Measurable outcomes — organizations can track exact ATT&CK technique coverage before and after each exercise.
• Cost efficiency — a single purple team engagement can deliver more security improvement than multiple traditional red team assessments.
• Reduced friction — collaborative exercises build trust between offensive and defensive teams, replacing the adversarial "gotcha" culture.

The best security programs run both: periodic unannounced red team engagements (to test realistic detection and response under pressure) supplemented by regular purple team exercises (to systematically improve detection coverage). Together, they create a continuous improvement cycle that is far more effective than either approach alone.

The White Team

Often overlooked in discussions of team colors, the white team plays a critical role. The white team consists of senior stakeholders who authorize and oversee the red team engagement. They hold the rules of engagement, serve as emergency contacts if an operation goes wrong, make scope decisions during the engagement, and receive the final briefing. Without a competent white team, red team engagements carry unnecessary organizational risk.

Key Takeaways

• Red teaming tests your security program, not just your systems. It evaluates people, processes, and technology against realistic adversary scenarios.
• Start with pen testing, graduate to red teaming. Organizations need mature defenses before a red team engagement provides value.
• MITRE ATT&CK is the common language. Use it for planning, executing, and reporting red team operations.
• Purple teaming multiplies red team value. Collaborative exercises produce faster, more measurable security improvements.
• The career path is demanding but rewarding. From junior pen tester to red team lead, expect 7-10+ years of continuous skill development.
• Authorization is non-negotiable. The only difference between red teaming and hacking is the signed rules of engagement.

Continue Learning

• Incident Response Plan Checklist — Essential guide for the blue team side of red team engagements
• Cybersecurity Career Paths — Explore offensive security and other career tracks
• How to Get Into Cybersecurity — Starting your journey in the field
• OSCP Certification Guide — The gold standard offensive security certification
• CompTIA PenTest+ Guide — Foundational penetration testing certification
• CEH Certification Guide — Certified Ethical Hacker overview and study tips
• Practice Quizzes — Test your knowledge across security domains