They start rewarding visible compromise over realistic attacker behaviour, which pushes teams toward initial access and privilege escalation at the expense of discovery, persistence, and exfiltration. The result is a testing programme that looks effective on paper but can miss the stages that most often determine whether a real attacker succeeds.
What gets distorted when penetration success becomes the main score?
The metric changes the game. Teams optimise for the easiest proof of compromise, usually the earliest foothold they can show, because that is what gets rewarded. That can make a red-team exercise look sharp while leaving the organisation blind to whether an attacker could stay hidden, move laterally, or actually achieve an objective.
In practice, the score begins to shape behaviour as much as the scenario does. A programme that rewards a single access event can end up measuring demonstration skill rather than adversary realism, which is why the debrief may feel decisive even when the test covered only a narrow slice of the attack chain.
Which attack stages get under-tested?
The main casualty is depth. If the only thing that counts is penetration, the exercise naturally overweights initial access and privilege escalation while discovery, persistence, command and control, and exfiltration receive less attention. That matters because real defenders usually fail, or succeed, at the stages after entry, where visibility and containment are tested more harshly.
It also changes what evidence the team collects. A shallow win can be easier to document than a realistic multi-stage operation, so the exercise may understate how long an attacker could remain in the environment, what data could be reached, and whether security teams would notice the compromise before impact.
When the goal is adversary emulation rather than point-scoring, this is the point at which framework-based threat mapping becomes useful. MITRE ATT&CK keeps the focus on tactics across the chain, not just the first break-in, and the enterprise matrix is a better lens for judging whether the exercise actually exercised credential access, lateral movement, persistence, and exfiltration paths. MITRE ATT&CK Enterprise Matrix and MITRE ATLAS adversarial AI threat matrix are both useful when the exercise also involves automated or agentic behaviour.
How should a red-team programme be judged instead?
A better score reflects whether the test reproduced attacker behaviour that matters to the business, not whether it produced the fastest splashy result. That means judging path quality, stealth, dwell time, privilege gained, business objective reached, and the quality of defensive detection and response, rather than counting only the first successful exploit.
The most useful programmes set a clear primary objective, then record whether the team could progress through the stages required to achieve it. If an exercise reaches a privileged account but never validates detection or post-compromise movement, the score should say that the result is incomplete, not successful.
For modern environments, the same logic applies to automated or delegated actors as well. If an exercise is testing AI agents or other non-human actors, the important question is not simply whether they can get in, but whether they can misuse credentials, exceed delegated authority, or leak data once inside. Red Teaming AI Agents for Identity Abuse is a relevant internal reference when the scenario includes privilege escalation, credential misuse, or exfiltration through an agentic path.
Risk and Threat Considerations
Penetration-only scoring creates a measurement blind spot: it rewards the easiest visible proof of access and can hide whether an attacker would actually be able to persist, escalate, or reach sensitive data. Over time, that can distort priorities, encourage shallow demonstrations, and leave the organisation overconfident in controls that were never meaningfully tested.
Failure mechanism: The scoring model optimises the team for headline compromise, so techniques that are easier to demonstrate become more valuable than the behaviours that determine real attacker success, such as stealth, lateral movement, and exfiltration.
Impact: Defenders may underinvest in detection, containment, and post-compromise controls, while a test report overstates resilience because it never examined the stages where operational damage usually emerges.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK, OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | Tactic/Technique Matrix — Adversary Tactics and Techniques | The question is about attack-chain coverage beyond initial access. |
| Recommendation — Map exercises to ATT&CK tactics so scoring values full attack progression, not just first compromise. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Penetration-only scoring can ignore privilege escalation and overreach in non-human paths. |
| Recommendation — Score whether an exercise exposed excessive privilege that enabled post-entry abuse. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | If red-team targets include agents, the key failure is often misuse of delegated authority after access. |
| Recommendation — Assess whether agent exercises prove abuse of authority beyond initial access. | ||
| NIST CSF 2.0 | DE.CM-01 — Continuous Monitoring | The critique hinges on whether the programme tests detection after compromise, not only entry. |
| Recommendation — Measure whether monitoring would catch post-compromise activity, not just the intrusion. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Depth-based testing should verify whether logs reveal movement and impact after penetration. |
| Recommendation — Validate that logging captures the later attack stages the score would otherwise miss. | ||
Practitioner Guidance
What to verify: Make sure the scoring rubric explicitly values progression beyond entry. If a test only records “got a shell” or “captured a credential,” treat that as an incomplete finding unless the scenario deliberately stops at that point.
What good looks like: A mature programme rewards objective completion, time undetected, lateral reach, and whether the exercise exposed real control gaps. The best debriefs explain how far an attacker could go, not just how they got in.
Common mistake: Treating a single successful intrusion as proof that the control set failed. In many environments, the more important question is whether the team would have been detected or contained before meaningful impact.
Practitioner takeaway: Use penetration success as one signal, not the score itself, otherwise you train both red teams and defenders to value the wrong part of the attack chain.
Related resources from NHI Mgmt Group
- What breaks when AI security testing is done only in scheduled red team exercises?
- What breaks when organisations rely on infrequent red team exercises instead of continuous validation?
- Why do penetration tests and red team exercises often fail to give a reliable view of exposure?
- Why do traditional red team exercises miss so many AI security issues?