The business case against Red Teaming#

Let’s talk straight: most organizations can’t survive a real Red Team exercise! So what’s the business value of purchasing one? When we expect the Red Team to break down all the doors and take over the network, how do we evaluate success?

One common definition of success in a scenario like this would be to successfully defend the network against the Red Team. Another possible definition of success could be to minimize the damage that the Red Team does once they are inside the network. If the goal is to maintain operations for as long as possible, then minimizing the impact of the attack and continuing business-as-usual is a measure of success.

Red Team exercises provide value beyond improving an organization’s security posture; they help cultivate a security-conscious culture. This in turn can have a greater impact on organizational security than any individual technical improvement.

By building a culture of security, an organization can create an environment in which employees are more aware of security risks and are more likely to take precautions to protect themselves and the organization’s data and ICT systems.