Red team
red teaming · red team exercise · TLPT · threat-led penetration testing · TIBER-EU · adversary simulation
An exercise in which a team of authorised attackers imitates a realistic adversary over several weeks to test the organisation’s ability to detect and respond to an attack.
In practice
Where a penetration test looks for as many flaws as possible within a scope, a red team pursues a specific goal (reaching payroll data, for instance) by every authorised means: technical attacks, phishing, sometimes physical intrusion. Defenders are usually not told in advance, which measures their real detection capability. Like any offensive test, the exercise requires written authorisation from the system owner (Article 323-1 of the French Criminal Code) and precise rules of engagement, known only to a small circle of senior management.
In finance, the EU’s DORA regulation requires entities designated by their supervisor to carry out threat-led penetration testing (TLPT) at least every three years. The TIBER-EU framework, published by the European Central Bank in 2018 and updated in 2024 to align with DORA, sets out the method: threat intelligence first, then a simulated attack on production systems.
