How red team works
Unlike a penetration test that aims to list as many vulnerabilities as possible, a red team pursues a specific objective, such as reaching sensitive data or taking control of a domain. Operators combine reconnaissance, phishing, exploitation, privilege escalation and lateral movement while avoiding detection.
Engagements usually run for weeks, with a small group aware of the test. Results show how far the team got, which activities were detected and how defenders responded, followed by a debrief and recommendations. Operators often use custom tools and social engineering, mimicking specific threat actors.
Why it matters for Canadian organizations
Red teaming tests people and processes as well as technology. It reveals whether the SOC notices a stealthy intruder and whether escalation paths work, something checklists and scans cannot show.
Canadian financial institutions and critical infrastructure operators are increasingly expected to run advanced threat-based testing, and OSFI B-13 sets expectations for technology risk testing. Mature organizations in any sector can use red teaming to validate their investment. Findings are framed around attacker objectives rather than a list of individual vulnerabilities.
How to implement it
Be ready first. Red teaming is most valuable once basic controls, monitoring and response exist. Define objectives, rules of engagement, off-limits systems, emergency stop procedures and legal authorization, and keep the circle of informed staff small.
After the engagement, run a joint debrief, fix gaps in detection and prevention, and consider a purple team session to replay techniques. Repeat periodically with new objectives to track progress. Share the findings widely, without assigning blame, so every team learns from the exercise. Remediate quickly, then retest the same objectives to confirm improvement.
Frequently asked questions
What is the difference between a red team and a penetration test?
A penetration test seeks to find and exploit as many vulnerabilities as possible within a scope. A red team pursues a specific objective stealthily over a longer period, testing detection and response too. A penetration test is broad; a red team is targeted and covert.
What does a red team do?
It emulates attacker tactics, such as phishing, exploiting weaknesses, moving laterally and escalating privileges, to reach agreed goals while avoiding detection, then reports what worked and what was noticed. Results show what defenders did and did not detect.
Is a red team the same as ethical hacking?
Red teaming is a form of ethical hacking. Ethical hacking is the broader practice of authorized security testing, including penetration tests and vulnerability assessments. It is appropriate once basic defenses and monitoring exist. Ethical hacking includes penetration tests and assessments.
Related service: Red team operations