Red Teaming: What Happens When You Give Ethical Hackers Permission to Act Like Real Attackers?

October is Cyber Security Awareness Month, making it a good time for organisations to consider how their defences would perform against a realistic attack. This article looks at how red teaming works, how it differs from penetration testing and what organisations can learn from a controlled, objective-led exercise.

You arrive at work and somebody you do not recognise walks through a secure door behind you carrying a laptop bag and a coffee. Would you challenge them, or assume they belong there?

This simple scenario illustrates why red teaming can provide organisations with a different view of their cyber security. Cyber attacks do not always begin with an attempt to exploit a technical vulnerability. An attacker may research employees online, send a convincing phishing email, make a fraudulent phone call, exploit an exposed service or try to gain physical access to a building.

A red team engagement is designed to explore these possibilities in a controlled and agreed way, allowing ethical hackers to behave more like a real attacker while working towards a defined objective.

What Is Red Teaming?

Red teaming is a form of authorised security testing in which a team attempts to achieve an agreed objective using realistic attacker techniques.

Rather than being given a defined list of systems to test, the red team will usually be given a broader goal. This might involve demonstrating whether it is possible to gain access to a corporate environment, reach a sensitive system, obtain protected information or test whether suspicious activity is detected and contained.

Depending on the agreed scope, the exercise may combine technical testing with social engineering, physical access attempts, reconnaissance and the use of publicly available information.

How Is Red Teaming Different From Penetration Testing?

Penetration testing and red teaming both involve authorised security testing, but the focus is different.

A penetration test will usually concentrate on a defined system, application, network or environment, with the aim of identifying vulnerabilities and demonstrating where weaknesses could potentially be exploited.

Red teaming takes a broader, objective-led approach. Instead of focusing on one system, the team considers different routes towards an agreed outcome and tests how the organisation’s controls work together under realistic conditions.

The purpose is not simply to find vulnerabilities. It is to understand whether the organisation can prevent, detect and respond to realistic attacker behaviour.

What Might a Red Team Engagement Involve?

Every engagement is different, and the scope, objectives and permitted activities need to be agreed carefully in advance.

Depending on the organisation and scenario, a red team exercise could involve:

• open-source intelligence and reconnaissance
• phishing or vishing
• attacks against external infrastructure
• credential attacks
• physical access testing
• attempts to exploit technical vulnerabilities
• movement through the internal environment if access is achieved
• attempts to reach a specific agreed system, asset or piece of information

This allows the organisation to see how its people, processes and technical controls perform together, rather than testing each in isolation.

For example, strong perimeter security may be undermined by weak physical access controls, publicly available information or an employee responding to a convincing social engineering attempt.

The Red Team Does Not Have to Succeed

A successful exercise does not necessarily mean the ethical hackers reach their objective.

If reception challenges an unfamiliar visitor, an employee reports a suspicious email or the Security Operations Centre identifies and contains unusual activity, those are all positive findings because they demonstrate that controls are working as intended.

The value lies in understanding what happened, which controls were effective and where improvements may still be required.

Sometimes the Simplest Route Is the Most Effective

Red teaming can involve sophisticated technical techniques, but real-world attacks do not always depend on complex vulnerabilities.

A secure door may be left open, an employee may hold it for someone they do not recognise, or publicly available information may make a social engineering attempt significantly easier.

These situations demonstrate why cyber security needs to consider human behaviour and physical processes alongside technology.

What Happens After a Red Team Exercise?

The value of a red team engagement comes from the findings and the action taken afterwards.

The exercise should explain which attack routes were attempted, which controls worked, where weaknesses were identified and where improvements could be made.

This may lead to changes in technical security, employee awareness, monitoring, physical security or incident response. It can also confirm where existing controls are already effective.

The aim is to give organisations a realistic understanding of their security posture and a clear basis for prioritising improvements.

When Should Organisations Consider Red Teaming?

Red teaming is particularly useful for organisations that believe they already have strong security controls in place and want to test whether those defences would stand up to a realistic attack.

Rather than focusing on basic weaknesses, a red team exercise challenges the organisation as a whole and looks for gaps that may only become apparent when different controls, processes and behaviours are tested together.

There is no particular organisation size that makes red teaming appropriate. AJC can carry out red team exercises for both large and small organisations, with the scope tailored to the environment, risks and objectives involved.

This makes red teaming a useful option for organisations that want greater assurance that their existing defences are working as intended and to understand where a real attacker might still find a route through

How AJC Can Help

AJC helps organisations assess whether their cyber security controls work effectively in practice.

Our cyber security specialists can support organisations with red team engagements designed around agreed objectives and tailored to the organisation’s environment, risks and level of security maturity. Depending on the scope, this can include reconnaissance, social engineering, technical testing and physical access testing.

AJC also provides penetration testing, vulnerability assessments, phishing and social engineering exercises, Cyber Essentials and Cyber Essentials Plus support, and wider cyber security and resilience services.

Following an engagement, we provide clear findings and practical recommendations to help organisations understand what worked, where weaknesses were identified and what actions should be prioritised.

If you would like to discuss whether red teaming could help test your organisation’s cyber resilience, please contact AJC on 020 7101 4861 or email info@ajollyconsulting.co.uk

Sources:

National Cyber Security Centre, Cyber Security Toolkit for Boards. National Cyber Security Centre

National Cyber Security Centre, Penetration Testing. National Cyber Security Centre

CISA, Red Team Assessment Fact Sheet.

Image accreditation: Towfiqu barbhuiya (June 2021) from Unsplash.com. Last accessed on 27 October 2026. Available at:
https://unsplash.com/photos/person-typing-on-laptop-in-gloves-em5w9_xj3uU