Preparing your team for a red team exercise

Tell the minimum number of people. A red team that everyone knows about is a tabletop in costume. Brief legal, HR if people-ops are in scope, and a technical control owner who can halt the work.

Decide the objective in a sentence: ‘obtain payroll data’, ‘reach the production Kubernetes control plane’, ‘place a benign beacon on an executive laptop you issue’. Vague objectives produce vague reports.

Prepare detection to learn, not to win. If you secretly white-list our infrastructure, say so — we will mark the exercise accordingly. Cheating waste everyone’s calendar.

Book the debrief before the first day of testing. Purple-team time is where detection engineering actually changes.