Red teaming tests endpoint security by simulating a real adversary against your laptops and servers, then measuring what your tools blocked, what they only logged, and what nobody noticed. Define one objective, agree rules of engagement, map each step to MITRE ATT&CK, and record detection results for every technique.
What is a red team exercise, exactly?
NIST defines a red team exercise as a simulated adversarial attempt to compromise organizational missions or business processes, run under real-world conditions, to give a comprehensive assessment of security capability. The key word is organization. A vulnerability scan asks "what is broken?" A red team asks "can someone reach the thing we care about, and would we see them?"
That makes it different from a penetration test, which NIST SP 800-115 treats as one technical testing method among several. SP 800-115 describes penetration testing as a phased activity of planning, discovery, attack and reporting, and it is written for finding vulnerabilities and verifying compliance. A red team borrows those phases but is judged on outcomes and on how well defenders respond.
What should the objective be?
Pick an outcome, not a tool. Good objectives are specific and checkable:
- Read a file from the finance share starting from a standard user laptop.
- Obtain a credential that works against the build server.
- Run code on a server that is supposed to be reachable only from the jump host.
Here is a constructed example. A company with 400 laptops sets the objective "reach the HR file share from a phished user account without triggering a high-severity alert." That single sentence tells the team what to try, tells defenders what to watch, and gives leadership a pass or fail they can read in one line.
How does ATT&CK help?
MITRE ATT&CK is a public knowledge base of adversary tactics and techniques, organized by what an attacker is trying to achieve, such as reconnaissance, initial access and credential access. For a red team it works as a shared vocabulary. Each action in the exercise is tagged with a technique, for example phishing for initial access or credential theft after that.
For the defense team it turns the report into a coverage table. Instead of "we caught some things," you can say "we detected 6 of the 9 techniques used, blocked 2, and missed 3." Those counts come from your own exercise, so they will differ for every organization.
What rules of engagement matter most?
Write them down before anything starts. The ones that prevent real damage:
- Scope: which networks, device groups and accounts are in bounds, and which are never touched.
- Safety limits: no destructive actions, no real customer data exfiltrated, agreed handling for any data the team does see.
- Contacts: a named person who can stop the exercise at once, reachable out of hours.
- Deconfliction: a way to tell a red team action from a real incident if the SOC raises one mid-test.
- Authority: signed approval from someone who can authorize testing on those systems.
Decide too whether the defenders know the exercise is running. Announced tests measure tooling. Unannounced tests also measure people and process, but they need tighter deconfliction.
How do you measure the endpoint results?
For every technique, record three outcomes: prevented, detected but not prevented, or not seen. Then ask what the telemetry looked like. An endpoint tool that blocked a payload but wrote no alert is worth fixing, because the next attacker will try a variation.
Track time as well. How long from the first malicious action to the first human looking at it? How long to isolate the host? Those are response numbers a plain scan never produces.
How to check or apply this
- Write one objective and one success statement before the first test.
- Get written authorization and a stop contact, and agree the scope list.
- Choose techniques from ATT&CK that match the threats you care about, not every technique.
- Run the exercise and log each action with a timestamp and technique ID.
- Score each technique as prevented, detected or missed, and note the telemetry that existed.
- Fix the gaps, then rerun the same techniques to confirm the fix.
Safeguard does not run red team exercises for you. It can reduce the easier paths an attacker might use, such as known vulnerable dependencies in the software your endpoints run, through dependency scanning and reachability analysis. That is a hygiene step before the exercise, not a replacement for it.
Quick check
Is a red team the same as a penetration test?
No. A penetration test looks for exploitable weaknesses in a defined scope. A red team pursues an objective the way a real adversary would and also evaluates how defenders detect and respond.
Do we need ATT&CK to run a red team?
No, but it gives every action a common name and makes detection coverage countable. Without it, results are harder to compare between exercises.
Sources
- NIST CSRC glossary: red team exercise
- NIST SP 800-115, Technical Guide to Information Security Testing and Assessment
- MITRE ATT&CK
Last reviewed: 18 October 2026.
