Lesson 3.35: Threat-led red teaming
A penetration test looks for vulnerabilities in a scope; a threat-led red team test asks whether real attackers, behaving like real threat actors, can reach the company's most important functions without being detected. Frameworks such as TIBER-EU (from the European Central Bank) structure this into a preparation phase, a testing phase driven by threat intelligence, and a closure phase where red and blue teams replay the attack together. In the lab you read the threat-intelligence scenarios, check who knew about the test, read results against the crown jewels, find what went undetected, and plan the closure.
20 min
You will learn to
- Tell a threat-led red team test from a penetration test
- Explain TIBER-EU phases and teams
- Read results against crown-jewel flags
- Find attack paths that went undetected
- Plan a purple-team closure
Key terms
- Threat-led red team test
- A covert test that imitates realistic attackers against critical functions, based on threat intelligence.
- TIBER-EU
- European framework for threat intelligence-based ethical red teaming, published by the ECB in 2018.
- White team
- The small control team that knows about the test and manages its risk.
- Flag
- An agreed target that proves an attacker reached a critical function.
- Purple teaming
- Red and blue teams working together to replay attacks and build detections.
← Testing a control: sampling and evidence · All lessons · Communications under pressure: one set of facts →