ESSENTIAL GUIDANCE · RESOURCE HUB · 3 min read
Part of Adversary insights →Red teaming resources for planning testing and follow-through
A practical route through exercise selection, objectives, safe delivery, detection evidence and improvement planning.
A practical route through exercise selection, objectives, safe delivery, detection evidence and improvement planning.
Need an acronym translated?Open the cyber glossary →Choose the assurance question first
A red-team exercise begins with an authorised objective and examines selected paths towards it. It can bring prevention, detection and response into the same discussion. It should not be commissioned merely because a technical assessment sounds too routine. Decide what the organisation needs to learn, whether it can support the exercise safely and what evidence will be useful afterwards.
Compare the available exercise models
Use the complete red-teaming guide for the operating model, the comparison guide for the difference from penetration testing, and the exercise-selection page for the buying decision. A vulnerability-led assessment may be the better first step where basic weaknesses remain unmanaged. Purple-team collaboration can serve a different learning objective from a covert assessment. Keep the purpose visible when comparing proposals.
Prepare a credible and controlled scenario
Relevant threat context can help shape an exercise, but the selected scenario still needs an agreed boundary, assumptions, permitted methods and safeguards. Define the control group, escalation route and stop conditions. Active testing requires explicit written authorisation. Supplier systems, staff interactions and sensitive services need specific permissions rather than being swept into a general claim of realism.
Define detection and response evidence
Agree how the exercise will record control observations and how defensive evidence will be collected without undermining its objective. Distinguish the technical path from what the team saw and did about it. A blocked route can still produce valuable learning. Avoid turning a single outcome into a claim that the organisation is protected from every actor or capable of detecting every future attempt.
Understand framework-specific requirements
A threat-led exercise and a formal framework-governed engagement are not automatically the same thing. TIBER-EU has its own operating framework and stakeholder requirements. Use the dedicated TLPT guide to explore the distinction and confirm applicable requirements with the relevant authorities and exercise owners. A reference to a framework is not a claim that a provider or engagement has been approved under it.
Keep improvement work connected to the exercise
Use the debrief to agree practical changes to controls, escalation, telemetry and operational decisions. Assign owners and define which improvements will be checked. Retain the exercise scope and evidence with the action record. The resources below support a route from planning to learning, rather than treating the final attack narrative as the end of the programme.
This guide covers the essentials. Continue into our technical analysis for a firmer position, practical implications and recommended action.
Read “Internal security is defined by attack paths, not network boundaries” →
