Red teaming is an authorized exercise in which a group of specialists emulates a real adversary’s tactics against an organization. The aim is to show the impact a successful attack could have and to test how well the defenders, often called the blue team, detect and respond.

How it works

• Scope and rules: leadership agrees on goals, such as reaching a sensitive system, and on what is off limits.
• Emulation: the red team uses realistic techniques, often mapped to MITRE ATT&CK, including phishing, stolen credentials, lateral movement and evasion.
• Detection test: defenders are usually not told the timing, so the exercise measures real detection and response.
• Debrief: findings and the attack path are shared, and fixes are agreed.

Red teaming differs from penetration testing, which aims to find as many flaws as possible in a defined scope. In purple teaming, attackers and defenders work side by side to improve detections step by step.

Why it matters for dark web monitoring

Real attackers often start with what is already exposed: leaked credentials, old data breaches and information about staff. Red teams that use the same outside-in view produce more realistic tests. Dark web findings about an organization are a useful input for scenario planning, and frameworks such as threat-led penetration testing under DORA build on this idea.

Sources: NIST CSRC Glossary: red team, CISA AA23-059A: CISA Red Team Shares Key Findings