What is red teaming?

Red teaming is an authorized exercise in which a team acts as an adversary to pursue an agreed objective and assess the organization’s defenses. The objective might be access to sensitive data, control of a system or a test of how the security team detects and responds to an intrusion.

The rules of engagement define the starting access, permitted targets and actions, stopping conditions and contacts. An adversarial approach still operates within those limits.

How it differs from a penetration test

A penetration test usually concentrates on identifying and demonstrating technical weaknesses within a defined scope. A red team exercise can put those weaknesses in a wider scenario and examine the organization’s response.

There is overlap, and the contract matters more than the label. An engagement can be technical only, or include social and physical scenarios when those are explicitly agreed. NIST’s technical assessment guide covers planning, execution and the limits of different test methods.

Red, blue and purple teams

The red team conducts the attack. The blue team operates the defenses. In a purple team exercise, they share observations and work through the activity together, helping defenders understand what was detected and what was missed.

A technical compromise and a detection are separate results. A team can detect an attack after it has already reached the objective, or prevent a route without recognizing every attempt.

The part AutoAttack performs

AutoAttack's autonomous red team agent pursues a specific objective at machine speed. It executes technical attacks from a Docker container with access to authorized systems, adapts to the credentials and footholds it gains, and reports the attacks behind each access gain.

Combine the technical results with interviews, physical exercises or a review of the response team’s decisions. The agentic red teaming guide explains how software agents participate in an exercise, and the campaign controls page covers deployment limits.