What Is Red Teaming? How Red Team Assessments Work

Red teaming is a goal-based simulation of a real attacker that tests whether your people, processes, and security tools detect and stop a breach before it reaches something that matters. The red team agrees on an objective with two or three sponsors, then works toward it the way a named threat actor would, using current tactics while almost no one on the defending side knows the exercise is running. Success is measured as one proven path to a crown jewel plus an honest timeline of what your defenders saw and when. This guide covers how red team assessments work, the rules that keep them legal, what they cost, how long they take, and how to tell when you are ready for one instead of another penetration test.

Red teaming, defined

A red team is an authorized group that emulates a specific adversary to measure an organization's ability to detect and respond. The US government glossary states it directly: a red team is "a group of people authorized and organized to emulate a potential adversary's attack or exploitation capabilities against an enterprise's security posture," with the objective of improving defense by demonstrating the impact of a successful attack and showing what works for the defenders. That definition, published in the NIST glossary from CNSSI 4009-2022, carries two ideas that separate red teaming from every other security test. The engagement is organized around an adversary and an objective, and the point is to measure response, not to count flaws.

The objective is usually a crown jewel: the handful of assets whose compromise would hurt the business. A crown jewel is domain administrator rights, the source code signing key, the production customer database, the ability to move money, or the clinical system that cannot go down. The red team picks one or two of these with the sponsors, agrees what proof of reaching them looks like, and then earns that proof the way an intruder would. Everything else in the engagement serves that goal.

How red teaming differs from penetration testing and vulnerability scanning

The three tests answer different questions, and buying the wrong one wastes budget on real work that misses the point. A vulnerability scan asks what known weaknesses exist. A penetration test asks whether those weaknesses can be exploited across a defined scope. A red team asks whether your defenders would notice an attacker pursuing a goal. The table sets the differences side by side.

Our separate guide on red team versus penetration testing works through the choice in depth. The short version: buy coverage first with a penetration test, and run a red team once you want the truth about detection. If you want to understand how red, blue, and purple teams divide the work, read red team versus blue team versus purple team.

Rules of engagement, authorization, and the white cell

A red team runs on written authorization and a tightly controlled set of rules, because the activity would otherwise be a crime. In the United States, accessing a computer "without authorization or exceeding authorized access" is the core offense under the Computer Fraud and Abuse Act, 18 U.S.C. 1030. The authorization letter, signed by someone with the authority to grant it, is what makes the engagement lawful. It names the targets, the objective, the time window, the techniques that are in and out of bounds, and the people who can call a stop.

The white cell, also called the white team or control group, is the small group that knows the exercise is running. The same government glossary describes two jobs for it: a few people with "prior knowledge of unannounced Red Team activities" who "act as observers" and keep the test inside its boundary, and the group that "enforces the rules of the exercise" and referees. In practice the white cell holds the deconfliction line. When a defender spots activity and starts to respond, the white cell can confirm in real time whether that activity is the red team or a genuine intruder, so the organization never stands down a real incident by mistake. Deconfliction is the procedure that makes secrecy safe.

The phases of a red team engagement

A red team engagement moves through phases that map cleanly to the adversary tactics in MITRE ATT&CK for Enterprise, the industry reference for attacker behavior. ATT&CK version 20, released October 13, 2026, organizes technique into 15 tactics, including the recent split of Defense Evasion into Stealth and Defense Impairment. Mapping each phase to these tactics is what lets the final report say exactly which behaviors the blue team caught and which it missed.

The red team records mean time to detect at each phase, so the deliverable is a stage-by-stage account of detection rather than a flat score. That is the measurement a penetration test cannot produce, because the defenders know a penetration test is running.

Types of red team engagement

Red team engagements come in a few shapes, and the right one depends on the question you need answered and the time you can give it. Picking the shape up front sets the scope, the cost, and the realism.

Assumed breach has become the common default, because most organizations will be breached at some host eventually, and the useful question is what happens next. Testing AI systems is a newer scope with its own methods, from prompt injection to agent permissions, and it is a specialty of its own.

Threat-led red teaming in financial services

Banks and financial market infrastructures run a stricter form of red teaming set by regulators, and the frameworks are worth knowing even if they do not apply to you, because they define the current standard of rigor. Three matter.

In the United Kingdom, CBEST has been part of the Bank of England's supervisory toolkit, alongside the Prudential Regulation Authority and the Financial Conduct Authority, since 2014. The current CBEST implementation guide describes an "intelligence-led penetration testing approach that mimics the actions of cyber attackers" against live systems, run with accredited threat intelligence and penetration testing providers under a firm-side control group.

In the European Union, the European Central Bank published the TIBER-EU framework, short for threat intelligence-based ethical red-teaming, in May 2018, and updated it on February 11, 2025 to align with the Digital Operational Resilience Act. The ECB's TIBER-EU framework renamed the white team the control team to match the regulation and made purple teaming mandatory. DORA itself, in Article 26 of Regulation (EU) 2022/2554, requires in-scope entities to "carry out at least every 3 years advanced testing by means of TLPT" against live production systems that support critical or important functions. The regulatory technical standard that governs how these tests run, Commission Delegated Regulation (EU) 2025/1190, was adopted on February 13, 2025, published in the Official Journal on June 18, 2025, and entered into force on July 8, 2025. Its Article 11 sets a floor: the active red team testing phase "shall last for at least 12 weeks."

BD Emerson runs red team engagements and penetration tests. We do not hold CBEST, TIBER-EU, or CREST accreditation, and we say so plainly; a regulated threat-led test in those regimes must use accredited providers. We build engagements to the same rigor those frameworks demand.

Where red teaming is required: FedRAMP and NIST SP 800-53 CA-8(2)

Inside US federal cloud programs, red teaming is a named control, not a nice-to-have. NIST SP 800-53 Revision 5 defines control enhancement CA-8(2), Red Team Exercises, as the requirement to "employ red team exercises to simulate attempts by adversaries to compromise organizational systems in accordance with rules of engagement." The enhancement sits on top of CA-8 Penetration Testing and CA-8(1) Independent Penetration Testing, both published in NIST SP 800-53.

FedRAMP applies these controls through its 2026 Consolidated Rules. In the current ruleset, CA-8, CA-8(1), and CA-8(2) apply to Class C and Class D offerings, the higher-assurance classes that align loosely with the former Moderate and High baselines, as set out in the FedRAMP control reference. FedRAMP also folds penetration testing into its vulnerability detection and response rules. The rules took effect for widespread adoption on July 4, 2026, and new Rev 5 certification applications must follow them from January 1, 2027. We break down the control itself in the FedRAMP red team requirement. One boundary matters: BD Emerson performs the red team and readiness work, but it is not a 3PAO, and an independent assessor validates the result.

When are you ready for a red team?

You are ready for a red team when a penetration test would no longer surprise you and your real worry is detection. The practical test is simple. If your last penetration test still found critical, easily exploited issues on the perimeter or in your applications, buy more penetration testing first, because a red team against a soft environment proves nothing you did not already know and burns the one advantage a red team has, which is that it works best against defenders who are watching. If your recent tests came back thin and the open question is whether your security operations function would catch a patient attacker, that is the moment for a red team. A red team also assumes you have a detection and response capability to measure. Without logging, alerting, and someone to answer the alert, there is nothing for the exercise to grade. For teams that are not there yet, a tabletop exercise is a cheaper way to rehearse response before you test it for real.

How long does a red team engagement take?

A full red team engagement typically runs four to ten weeks of active work, with scoping and reporting on either side. The active phase is where the red team earns access, moves, and reaches the objective, and it is deliberately slow, because a real adversary is patient and a rushed test loses realism. Threat-led regimes codify this: the DORA technical standard sets a floor of 12 weeks for the active red team phase. Shorter assumed-breach engagements against a defined internal scope can finish in two to three weeks. Add roughly one to two weeks of scoping and threat intelligence before the active phase and one to two weeks of reporting and the purple team replay after it, and a first red team program commonly spans two to four months end to end.

How much does a red team assessment cost?

As a BD Emerson planning range, a full red team engagement runs roughly $45,000 to $150,000, with the position in that range set by six drivers: scope, the number and difficulty of objectives, the length of the active phase, whether social engineering and physical intrusion are in play, whether a purple team replay is included, and whether the work maps to a regulated framework. The arithmetic is worth seeing. A skilled offensive operator bills at a day rate that our penetration testing cost analysis puts at $1,500 to $2,500 per day. A four-week assumed-breach engagement for one operator is about 20 billable days, which lands near the bottom of the range, while a ten-week full-scope program with two operators, social engineering, and a purple team replay runs toward the top. These figures are planning ranges for budgeting, not a quote; a scoped proposal replaces them once we map your environment and objectives.

What a red team delivers

The deliverable from a red team is a story with evidence, not a spreadsheet of findings. A strong report has four parts. The attack narrative walks the path the team took to the objective, step by step, with the proof captured at each step. The detection timeline sets that narrative against what the blue team saw and when, so you can read where detection happened late or not at all. The ATT&CK coverage map shows which tactics and techniques the team used and which of your controls caught them. The prioritized remediation names the specific fixes that would have broken the path earliest, in the order that buys the most defense for the least effort. The best programs then replay the successful techniques with the defenders watching, a purple team session that turns the narrative into durable detections and re-measures time to detect.

Questions to ask when choosing a red team provider

The fastest way to tell a real red team from a penetration test wearing a premium label is to ask how the engagement is run and measured. Four questions separate the two.

• How many of our people will know the exercise is running, and how do you deconflict with a live incident?
• What objective are you working toward, who agreed it, and what counts as proof of reaching it?
• How do you report mean time to detect by stage, and how do you map activity to MITRE ATT&CK?
• Do you run a purple team replay afterward so our detections measurably improve?

A provider who answers the first question with "your whole security team will know" is selling a penetration test. A provider who cannot describe deconfliction should not be inside your network under secrecy. Ask for a sample report with the client details removed, and read whether it carries a detection timeline or only a findings list.

Frequently asked questions

What is the difference between a red team and a penetration test? A penetration test asks whether a defined scope can be exploited and produces a ranked list of findings with fixes. A red team asks whether your defenders would detect and stop an attacker pursuing a goal, and produces one proven attack path plus a timeline of what your team saw and when. Buy penetration testing for coverage, and a red team for the truth about detection.

How much does a red team assessment cost? As a BD Emerson planning range, a full red team engagement runs roughly $45,000 to $150,000. The position in the range depends on scope, the number and difficulty of objectives, the length of the active phase, whether social engineering and physical components are included, and whether a purple team replay is part of the work. A scoped proposal replaces the range once we map your environment.

How long does a red team engagement take? The active phase typically runs four to ten weeks, with one to two weeks of scoping before it and one to two weeks of reporting and purple team replay after. A first red team program commonly spans two to four months end to end. Threat-led regimes such as DORA set a floor of 12 weeks for the active red team phase.

Is red teaming legal? Yes, when it runs on written authorization from someone empowered to grant it. In the United States, unauthorized access is an offense under the Computer Fraud and Abuse Act, 18 U.S.C. 1030, so the authorization letter and the rules of engagement are what make the work lawful. The letter names the targets, the time window, the allowed techniques, and who can stop the exercise.

What is a crown jewel in a red team engagement? A crown jewel is an asset whose compromise would hurt the organization, such as domain administrator rights, a code signing key, the production customer database, the ability to move money, or a clinical system that cannot go down. The red team and the sponsors agree on one or two crown jewels as the objective, and reaching one with proof is how the engagement measures success.

Does FedRAMP require a red team? Yes, for higher-assurance cloud offerings. FedRAMP applies NIST SP 800-53 control CA-8(2), Red Team Exercises, to Class C and Class D offerings under its 2026 Consolidated Rules. BD Emerson performs the red team and readiness work, and an independent assessor validates it, because BD Emerson is not a 3PAO.

If you are weighing whether a red team or another penetration test is the right next step, our offensive security team can read it from your last test report and scope the engagement that answers your actual question.