Building Red Team Capability
summary
Red teaming is an operational capability that emulates true attackers: no scripted scope, objective‑focused attempts to gain access, and checks whether defenses actually detect PowerShell and C2 techniques that bypass EDR/Defender. Success metrics are concrete: time to detection and time to remediation measured across repeated engagements, ideally via a scorecard. Build blue capability first, then a diverse red team (3–7 people minimum, up to ~12) or hire external testers and move to continuous red teaming.
AI-written summary · about
chapters (5)
- 0:00WHAT'S THE BENEFIT OF A RED TEAM?
- 14:0802 WHEN DOES IT MAKE SENSE TO BUILD A RED TEAM?
- 16:0103 WHAT DOES SUCCESS LOOK LIKE? WHAT ARE THE KEY METRICS?
- 26:08WHAT ARE CRITICAL INGREDIENTS FOR SUCCESS?
- 30:46WHERE WOULD YOU START?
related talks
44mChallenges, Facts, and Myths About Building Red Team Competencies in Organizations
40mFantastic Red-Team Attacks and How to Find Them
25mUse red teams to challenge orthodox thinking on your software dev. ...
12mIntroduction To Red Team Tooling And Opsec
49mTraining for Incident Response: The Red, the Blue, and the Ugly
53mAtomic Red Team: Where Adversary Emulation and EDR Testing Meet
52mBuilding the Always-On Purple Team
42mRed vs. Bank: Surviving a Three Year Red Team