Red teaming

A red team runs a goal-driven attack simulation: a small group of ethical hackers emulates the behaviour of a realistic adversary and works towards one agreed objective, such as reaching the payment system. The question is not how many vulnerabilities exist, but whether the organisation notices the attack.

What it means

That makes red teaming fundamentally different from a pentest. A pentest is coverage-driven: within a defined scope it looks for vulnerabilities as thoroughly as possible, and the report lists what was found. A red team exercise is goal-driven: the team takes the path of least resistance towards that single objective, using whatever a real attacker would use, from phishing and social engineering to physical access and weak cloud configuration. Completeness is explicitly not the aim; staying unnoticed is.

Two opposing sides give the exercise its shape. The blue team is the defence: the security operations centre, the administrators and the incident-response team who are supposed to detect and repel attacks. In a purple team setup, both sides work together while the exercise runs. The red team says what it is executing, the blue team checks straight away whether detection fires and tunes its rules. That teaches faster, but it no longer measures how the organisation reacts to a genuine surprise.

Why it matters

A red team exercise reveals what no vulnerability list can show: how long an attacker can operate undisturbed, which step finally triggered an alert, and whether anyone acted on that alert. It therefore tests people and processes, not just technology.

In the European financial sector this approach is formalised as TIBER-EU (Threat Intelligence-based Ethical Red Teaming), the framework published by the European Central Bank and modelled on the Dutch central bank’s TIBER-NL programme. National implementations such as TIBER-DE follow the same model: a specialist provider builds realistic scenarios from current threat intelligence, an independent red team executes them against production systems, and only a handful of people inside the organisation know it is happening. Since DORA began to apply on 17 January 2025, such a threat-led penetration test (TLPT) has been mandatory, as a rule every three years, for financial entities their supervisor designates. TIBER-EU was updated in February 2025 to match DORA’s rules for these tests.

Example

An insurer gives a red team the objective of getting a payment instruction approved. The team sends a targeted phishing email to the finance department, takes over a workstation and moves laterally to the application servers. The blue team misses that first sign-in, but raises an alert once an unusual administrator session appears. The report then describes not only the vulnerabilities that were abused, but also, step by step, whether and when each one became visible.