Red teaming

A penetration test measures how many vulnerabilities can be found and exploited within an agreed scope; red teaming measures the resilience of the organization as a whole. Success is not counted in findings but in whether predefined objectives are reached — access to a specific data set, to a control room, or to the payment execution system — and above all in whether and when the activity was detected.

The scenario is built from threat intelligence about adversaries that are realistic for that particular organization, and the techniques and procedures are normally mapped to established catalogs of adversary behavior such as MITRE ATT&CK. The exercise runs over an extended period, covertly and incrementally. Only a small group of people, the white cell, is aware of it; they provide oversight, safety limits and deconfliction if the defensive team mistakes the activity for a genuine attack.

In the financial sector there are formalized versions of such threat-intelligence-led testing: the European TIBER-EU framework, while the DORA regulation provides for threat-led penetration testing (TLPT) for entities meeting the criteria. These schemes prescribe participant roles, competence requirements for testers, management of the risks created by the exercise itself, and the reporting format.

The outcome is not merely a list of weaknesses but an attack timeline, compared against the defenders' logs and actions. From it, time to detect and time to respond are derived, blind spots in monitoring are identified, and corrections to detections, procedures and training are defined.