Also known as: red teaming · adversary simulation · purple team
A red team is a group that simulates realistic adversary behaviour against an organisation to test not just its technical defences but its ability to detect and respond to an intrusion in progress.
Red teaming is broader than penetration testing. A penetration test asks whether vulnerabilities exist in a defined scope; a red team engagement asks whether the organisation would notice and successfully respond to a determined adversary pursuing a specific objective.
Purple teaming addresses the main weakness of adversarial engagements — that findings arrive only at the end — by having offensive and defensive teams collaborate in real time, so detection gaps are identified and closed as they are discovered.
MITRE ATT&CK
MITRE ATT&CK is a public knowledge base that catalogues real-world adversary tactics, techniques, and procedures, organised into a matrix that maps how attackers progress through an intrusion.
Penetration Testing
Penetration testing is an authorised, time-boxed assessment in which security professionals attempt to exploit vulnerabilities in a defined target to demonstrate real-world impact and provide remediation guidance.
Threat Hunting
Threat hunting is the proactive search for attackers already present in an environment, driven by hypotheses about adversary behaviour rather than by alerts from automated detection tools.
Security Operations Center
A security operations center (SOC) is the team and function responsible for continuously monitoring an organisation's environment for security threats, triaging alerts, and initiating incident response.
Incident Response
Incident response is the structured process an organisation follows to detect, contain, eradicate, and recover from a security incident, and to learn from it afterwards.