A Complete Overview of Red Team Exercises

Red Team exercises (or Red Team operations) are drawing more and more interest across the cybersecurity field. Yet the concept often stays fuzzy, and it is not unusual to see it confused with other practices such as penetration testing or more traditional security audits.

A Red Team exercise, though, answers specific objectives and draws on methodologies inspired by intelligence work and the simulation of real attacks.

1. What a Red Team exercise is

Definition and objectives

A Red Team exercise is an advanced attack simulation carried out by cybersecurity experts, with one clear purpose:

Assess an organization's real ability to detect, contain and respond to an intrusion.

Unlike a traditional penetration test, the approach here is broad and realistic. The Red Team acts like a genuine group of attackers: it combines a range of techniques (reconnaissance, phishing, vishing, physical intrusion, and so on) to reach a strategic objective, for example accessing sensitive data or proving that a production line could be halted, all without being spotted.

The point is not simply to find flaws, but to test human reflexes, detection, coordination and the organization's overall resilience in the face of a credible threat.

Military origins of the term

The term Red Team comes from the military and strategic world. In simulation exercises, the Red Team stood in for the enemy, tasked with testing the plans and defenses of the opposing side. The idea is simple: anticipate the tactics of a credible adversary to find internal weaknesses before they are actually exploited.

In cybersecurity, the concept was borrowed to describe friendly offensive teams that simulate an advanced attack. They stand opposite the Blue Team, whose job is to defend the systems.

In some contexts, a Purple Team facilitates collaboration between the offensive and defensive teams, so that both sides build up their skills faster.

Differences from pentests and audits

A Red Team exercise is often mistaken for other types of security assessment. Yet it stands apart on several levels. The table below lays out the differences across a number of criteria:

Where the Red Team sets itself apart is that it combines several of the skills from those other services into one coherent scenario, realistic and, above all, unannounced. It draws on:

• intrusion techniques (reconnaissance, external, internal, exploitation, privilege escalation, lateral movement);
• social engineering expertise (targeted phishing, manipulation);
• intelligence capabilities (OSINT, environment analysis, impersonation);
• and sometimes physical capabilities (on-site access, badge access bypass, hardware implants).

In short, the Red Team relies on the full offensive spectrum to test the organization's real resilience under real conditions.

APTs

Red Team exercises take their cue from real threats to simulate attacks. They often model themselves on APT groups (Advanced Persistent Threat), known for operations that are stealthy, targeted and sustained over time. These groups, sometimes tied to nation states or criminal organizations, have substantial resources and pursue espionage, data theft or sabotage. Among the best known are:

• APT28 (Fancy Bear) - Russia
• APT29 (Cozy Bear) - Russia
• APT10 (Stone Panda) - China
• Charming Kitten - Iran

Red Teams reproduce their TTPs (Tactics, Techniques and Procedures) using frameworks such as the MITRE ATT&CK matrix, in order to build realistic scenarios aligned with current threats.

The MITRE ATT&CK framework

The MITRE ATT&CK framework (Adversarial Tactics, Techniques & Common Knowledge) is a public, regularly updated knowledge base that describes in detail the known behaviors of attackers in real environments.

It lets Red Teams:

1. model an attacker's behavior by phase (initial access, execution, persistence, and so on),
2. choose techniques relevant to their scenario,
3. and document the exercise using a shared, recognized vocabulary.

MITRE ATT&CK also makes the post-exercise dialogue with Blue Teams easier, since it allows a structured account of the techniques used (for example T1059.001 - PowerShell, T1566.001 - spear phishing, and so on).

---

Now that we have framed the topic of Red Teams, let us turn to how these exercises actually unfold.

2. Preparing your Red Team exercise

The success of a Red Team exercise rests largely on the quality of its preparation. Rigorous scoping raises the value of the exercise, limits operational risk and aligns every stakeholder around clear objectives.

Clarify the objectives and KPIs

First of all, it is essential to be clear about what you are trying to test. The exercise can serve several purposes:

• Validate the effectiveness of a SOC or a detection unit;
• Assess the ability to respond to a real incident;
• Make decision-makers (executive committee, IT leadership) aware of the impact of a stealthy attack;
• Or identify the technical and organizational blind spots in the security chain.

To give these goals a measurable dimension, you should pair them with performance indicators (KPIs), for example:

• MTTD (Mean Time To Detect): the average delay between the offensive action and its detection;
• MTTR (Mean Time To Respond): the average delay between detection and remediation;
• Automatic correlation rate of alerts;
• MITRE ATT&CK coverage rate before and after the exercise.

These indicators provide a common reference for the offensive and defensive teams and make it easier to report back to leadership.

Define a scenario

Two models dominate for Red Team scenarios:

1. Threat Emulation: the Red Team reproduces the tactics of a known group (an APT), drawing on frameworks such as MITRE ATT&CK. It is a realistic approach, grounded in threats observed in the real world.
2. Threat Simulation: the attack is entirely scripted around your environment, your business lines and your potential vulnerabilities. It offers more flexibility for addressing specific cases.

That choice is completed by the approach used to run the tests (the starting conditions):

• Full Scope: the offensive team operates from the outside, with no prior access;
• Assume Breach: a minimal internal access is taken as the starting assumption.

The combination of "scenario model / initial state" determines the technical reach, the expected duration and the workload.

Set the scope

A Red Team exercise rests on a contractual scope that is explicitly defined:

• Included systems: internal networks, cloud environments, remote sites, OT infrastructure;
• Excluded or protected systems: high-availability production lines, health data, environments subject to particular regulatory constraints;
• Technical boundaries: permitted or prohibited use of encryption, ability to pivot through the internet, deployment of code in production, and so on.

This mapping reduces operational risk, ensures regulatory compliance and preserves the trust of the business lines.

Governance and rules of engagement

Three categories of players are involved on the audited side:

• The white cell (CISO, DPO, security leadership), responsible for oversight and decision-making;
• The target teams (IT, SOC, business lines), kept out of the loop to guarantee realism;
• A backup point of contact, available around the clock to trigger a suspension of the exercise if a critical incident occurs.

On the audit company's side, the Red Team manager or project lead acts as the go-between linking the white cell and the Red Team operators / auditors.

All of these roles, along with the required level of stealth, the technical limits imposed and the emergency communication channels, are recorded in the Rules of Engagement (RoE).

Planning and resources

Planning an exercise is typically structured as follows:

The internal effort for the client organization averages between five and seven person-days, drawing mainly on the CISO, SOC and legal functions. Before the operational launch, it is essential to confirm that: the objectives are validated, the scenario is set, the scope is approved, the RoE are signed and legal compliance is attested. This preliminary check is what guarantees that an offensive exercise takes place under the best possible conditions.

3. Immersion: how an attack unfolds

This section takes you inside the typical flow of an exercise, highlighting the main phases of an attack orchestrated by a Red Team. The aim is to better understand the operational logic behind each stage, from information gathering all the way to the compromise of critical assets.

The attack cycle

In the specialist literature on Red Team operations, you find a consistent attack cycle, split into several interdependent stages. These phases are not just technical operations; they fit into a clear offensive strategy: compromise an environment, keep access to it, spread through it, and reach predefined targets such as sensitive data or high-privilege accounts.

Each strategic objective maps to a specific operational phase:

In the following sections, we will give an overview of the actions taken to reach each of these objectives.

Phase 1: Initial access

Getting into an information system often rests on a multi-vector approach combining information gathering (OSINT), technical exploitation and social engineering.

The first step is to collect as much information as possible about the target. This passive reconnaissance phase draws on open sources (social networks, job postings, DNS, search engines) to identify potential attack surfaces: domain names, exposed services, IP addresses, technologies in use, or compromised credentials found in data leaks. Every piece of data, technical or organizational, is gathered and analyzed to define the best possible attack strategies.

The external intrusion generally relies on exploiting known vulnerabilities, misconfigurations, or the use of compromised credentials. When no conventional access vector is exploitable, attackers may turn to zero-day vulnerability research, meaning flaws that are not publicly documented, which reinforces the advanced and targeted (APT) character of the attack. In some cases, password spraying attacks against exposed services (such as VPN or email) are also used.

In parallel, social engineering techniques such as targeted phishing make it possible to trap users through malicious email campaigns, phone calls or infected devices (Rubber Ducky). Finally, in the most complete exercises, physical intrusion (access to the premises, tailgating, dropping malicious hardware) extends the initial attack surface.

Phase 2: Maintaining access and C2

Once access is established, the attacker looks to make their presence permanent within the information system. This persistence phase is essential for staying operational even in the event of partial detection or an eviction attempt.

Persistence makes it possible to:

• Keep a reliable entry point, even after a reboot or a patch.
• Diversify access (multiple backdoors).
• Avoid having to re-run detectable attacks.
• Prepare long-term actions (observation, exfiltration, internal pivots).

To drive the attack remotely, a Command and Control (C2) server is deployed. This infrastructure centralizes communication with the implants: it lets the operator send commands, retrieve data, and adjust operations according to defensive reactions. The protocols used vary (HTTP(S), DNS, SMB, and so on), and tools such as Cobalt Strike, Sliver or Brute Ratel are frequently used.

Several persistence techniques on Windows are commonly used:

• Task Scheduler: scheduled execution of malware at regular intervals.
• Startup Folder: adding shortcuts to the startup folder.
• COM Hijacking: hijacking Windows components to run arbitrary code.

These methods, while simple, remain effective when they are hidden inside an operating environment.

Phase 3: Propagation and reaching the objectives

The final goal of a Red Team attack is rarely the compromise of a single isolated machine. The attacker looks to extend control across the internal network, reaching strategic systems, critical databases or privileged accounts.

This lateral movement phase begins with network reconnaissance. Various tools make it possible to map hosts (via DNS), query Active Directory (via LDAP), or identify high-value groups and users.

Token impersonation, often through tools such as Rubeus, makes it possible to reuse other users' identities and act on their behalf. In parallel, extracting secrets from memory (LSASS), the Windows registry (SAM, LSA) or local files yields hashed or cleartext passwords. Kerberos tickets are collected as well.

Attacks specific to the Active Directory environment (Kerberoasting, AS-REP Roasting, misconfigured delegations) are particularly effective for escalating privileges and compromising high-level accounts. Internal PKIs built on ADCS are also a prime target, given the many recent vulnerabilities affecting these environments.

Finally, network shares, MSSQL servers or exposed configurations can serve as a springboard for pivoting from one system to another and reaching the company's critical resources.

Once an operator holds sufficient privileges, they can work toward objectives that depend on the context of each mission. That might be a credential granting access to a database, taking control of a critical server to simulate its shutdown, gaining access to the payroll system to make transfers, and so on.

4. Results and deliverables

A Red Team exercise shows its full value at the debrief: that is where raw data turns into actionable lessons, for the executive committee as much as for the SOC.

Contents of the deliverable

The final deliverable usually includes:

• An executive report, accessible to non-technical readers (CISO, IT leadership, executive committee), highlighting the simulated impacts, the critical weak points and the areas for improvement;
• A summary of the operations carried out, presented chronologically: initial access, privilege escalation, lateral movement, simulated exfiltration, and so on;
• The key moments where detection would have been possible: a missed network alert, abnormal behavior on a workstation, an attempt to access critical systems;
• The TTPs used, mapped to the MITRE ATT&CK matrix, to make it easier to feed them back into the defensive tooling;
• Targeted recommendations, to strengthen detection, fix the exploited vulnerabilities, or rework certain organizational processes.

In practice: the C-level reads the summary, the SOC replays the timeline, the PMO launches the projects.

Actionable indicators

To turn a Red Team exercise into a program of continuous improvement, you should track a few simple but telling indicators. The first is the Mean Time To Detect (MTTD): the time between the attacker's initial action and the first qualified alert. The shorter it is, the earlier your sensors and your SOC catch weak signals. Next comes the Mean Time To Respond (MTTR), meaning the time needed to contain and eradicate the threat after detection; it reflects how smoothly your playbooks run and how effective the crisis unit is.

To these two speed metrics you add a coverage measure: the MITRE ATT&CK detection rate. By mapping every tactic and technique used by the Red Team, you get the percentage that was actually detected; this score exposes the blind spots and guides the creation of new SIEM or EDR use cases.

Finally, because a report only matters if it leads to action, you track the percentage of "quick wins" implemented at D+90. Three months after the debrief, what share of the quick fixes has actually been deployed? This figure closes the loop: it measures your ability to turn the simulation into concrete actions and sets the baseline for the next exercise.

5. Who is it for? Why do it?

You might think Red Team exercises are reserved for very large companies or sensitive institutions. In reality, any organization that already has a minimum level of cybersecurity maturity can benefit from one to go further in assessing and strengthening its defensive posture.

Eligible organizations

Common use cases

A Red Team exercise can answer several operational or strategic objectives:

• Verify the effectiveness of the SOC and of detection tools (SIEM, EDR, XDR).
• Assess the IT and security reflexes when an intrusion goes (almost) unnoticed.
• Challenge the incident response procedures: IR plan, crisis unit, communication.
• Reveal the organizational blind spots: silos, ignored alerts, unclear responsibilities.
• Raise awareness among leadership / the executive committee through a concrete, quantified scenario.
• Strengthen compliance (ISO 27001, NIS2, DORA, and so on) with operational evidence.

Strategic benefits

A Red Team exercise goes well beyond a simple technical test. It gives an overall view of the organization's resilience against a credible threat. Its contributions are many:

• Anticipate rather than endure: uncover your flaws in a controlled setting, before a real attacker does.
• Measure the real effectiveness of your defenses, under field-like conditions.
• Smooth collaboration between security, IT, crisis management and decision-makers.
• Feed continuous improvement with concrete, prioritized data.
• Rally and convince: a realistic scenario speaks louder than a dashboard.

6. Duration, frequency and cost: what to expect

The duration of an exercise varies with its scope and complexity. In general, expect between 4 and 12 weeks, split across several phases: scoping, reconnaissance, execution, analysis and debrief. Some more targeted scenarios can be run in 2 to 3 weeks, but full exercises need a little more time to stay realistic and stealthy.

In terms of frequency, a mature organization runs this kind of exercise every 12 to 24 months, often alongside more traditional regular tests (pentest, audit, awareness training). Red Teaming is part of a long-term approach, not a one-off.

On budget, engagements vary with the scope, the duration, the attack surface and the objectives: typical ranges run from €20,000 to €100,000, and higher for critical or multi-site environments. But beyond the cost, it is the strategic investment that counts: a well-designed exercise can prevent major losses in the event of a real attack.

7. Conclusion

A Red Team exercise is far more than a simple security test. It is an advanced simulation tool, built to confront an organization with realistic scenarios in a controlled setting.

Key takeaways:

• The Red Team simulates a real attack, with precise objectives, to test the company's ability to detect and react.
• It differs from traditional approaches (pentest, audits, scans, and so on) through its organization-wide, stealthy, multi-vector approach.
• It draws on a broad range of skills: offensive, intelligence, social engineering, adversarial tactics, and more.
• It is aimed at mature organizations (advanced SMBs, mid-caps, large groups, operators of vital importance) that want to concretely validate their security posture.

Why is it a strategic investment?

Because it is no longer only about fixing flaws, but about making sure the teams and the tools can stand up to a modern, targeted and stealthy attack. A Red Team exercise reveals what procedures do not show, and speeds up the teams' skill-building, while producing concrete, actionable and often very impactful feedback.

Ready to take action?

Do you want to assess your ability to detect and respond to a realistic attack? Are you looking to test your SOC, your procedures, or to raise awareness among your decision-makers?

Get in touch with the HELX teams to scope a first Red Team exercise tailored to your organization.

FAQ - Frequently asked questions