Test how your organisation responds to an attack.

A red team follows a plausible attack route towards an agreed business objective. For example, could someone starting with an ordinary employee account reach a sensitive finance system, and would the SOC spot and contain that activity in time?

Define a business objective, such as demonstrating whether a simulated attacker could reach a particular service before defenders detect them. Agree with an authorised control team which techniques, environments and people may be exercised, how the team will deconflict real incidents and who can stop the exercise.

Select a realistic route. Use relevant threat intelligence to choose a starting point, such as an assumed compromised account. Specify which identity systems, network segments and business applications are in scope.

Follow the evidence. Test whether that account can acquire additional privileges or reach another system. Record the actions, times and evidence. If a scenario includes a call to the help desk or an attempt to enter a site, agree those activities separately in writing.

Agree the objective

Choose a business action to protect, such as a standard account reaching an agreed test record. The sponsor defines what evidence is sufficient and where the exercise must stop.

Authorise the route

Record the starting position, systems, permissions and exclusions. Telephone, email and physical approaches each need explicit scope. Name the controller who can pause or end the exercise.

Reconstruct the exercise

Log the time and purpose of each permitted action. At the debrief, put this timeline beside alerts, analyst decisions and escalation records to see which activities were visible.

Agree the follow-up

For each missed signal, name the control owner and the expected detection or response. Agree how a focused follow-up would show that the change works.