Red team activity is drifting from real attacker behaviour

At a glance

What this is: Expel’s annual threat analysis finds red team exercises are concentrated in cloud and endpoint techniques that do not match the attack stages most often seen in real incidents.

Why it matters: IAM, SOC, and security leaders should care because unrealistic red-team scope can misdirect remediation effort away from the controls that actually reduce attacker dwell time and impact.

Context

Red teaming is supposed to validate defensive assumptions by showing how an attacker would move through a real environment, but the exercise only works when the test reflects actual threat behaviour. In this analysis, the governance problem is not whether red teams are useful, but whether their incentives and scorekeeping are pushing them toward visible compromise over realistic attack paths.

Expel’s comparison across cloud infrastructure and endpoints shows that exercise patterns can diverge sharply from observed attacker activity. That matters for identity and access governance because the controls most likely to fail in a real intrusion are often discovery, persistence, and evasion paths, not the first foothold that makes for a good report.

Key questions

Q: What breaks when red-team exercises are scored mainly on penetration success?

A: They start rewarding visible compromise over realistic attacker behaviour, which pushes teams toward initial access and privilege escalation at the expense of discovery, persistence, and exfiltration. The result is a testing programme that looks effective on paper but can miss the stages that most often determine whether a real attacker succeeds.

Q: Why do cloud and endpoint red-team scenarios often miss the most important attack stages?

A: Because many engagements reuse familiar playbooks instead of matching current attacker behaviour. Cloud attackers frequently emphasise discovery and opportunistic abuse of existing access, while endpoint attackers may focus on evasion and persistence. If those patterns are not in scope, defenders are not testing the controls most likely to fail in practice.

Q: What are the signs that a red team programme is not giving an accurate view of organisational risk?

A: A red team programme is likely missing the mark when it runs only occasionally, relies on manual effort, and produces findings that do not reflect current exposure. If the exercise is too infrequent, it will not keep pace with daily attacker activity, changing assets, or new exposures. That leaves surveillance, detection, and response assumptions untested against the current attack surface.

Q: How should organisations balance realistic red-team scope with safe exercise boundaries?

A: Set rules of engagement that preserve safety but still allow the team to test the stages attackers actually use, including discovery, stealth, persistence, and data movement. The goal is not unrestricted harm, but a credible simulation that tells defenders where their controls are most likely to fail.

Technical breakdown

Why red teams over-index on initial access and privilege escalation

Red teams are typically measured on whether they can demonstrate successful compromise, so they gravitate toward techniques that produce clear proof of entry. Initial access and privilege escalation are easy to narrate and easy to score, especially when the exercise is designed to show impact within a limited engagement window. The problem is that this optimises for visibility, not realism. In cloud environments, attackers often do not need the same chaining pattern that a human red team uses to prove compromise. When exercise design rewards penetration milestones, it can underweight the stages that actually determine whether a real attacker can stay hidden and achieve a goal.

Practical implication: Score engagements on whether they mirror observed attacker stages, not just whether the team can get in.

Discovery, persistence, and exfiltration are the stages defenders should care about

The article’s strongest signal is that real attackers spend more time in discovery, defensive evasion, persistence, and impact, while red teams often omit or underplay those phases. Discovery in cloud environments is especially important because a single credential can expose a broad infrastructure footprint, and that visibility creates multiple opportunities for detection. Persistence is equally material on endpoints because attackers who survive initial containment can keep returning without repeating the original intrusion. Exfiltration matters because it shows whether the attacker can convert access into loss. If those stages are not tested, defenders may overestimate their true readiness.

Practical implication: Build exercise objectives around attacker dwell, stealth, and data movement rather than only first compromise.

Cloud lateral movement playbooks can be the wrong model for cloud risk

One of the clearest mismatches in the article is that lateral movement appeared in red team cloud exercises but not in the real attacker data. That does not mean lateral movement is irrelevant in general, but it does suggest some teams are importing endpoint playbooks into cloud scenarios where they are less representative. Cloud attackers may instead rely on discovery and opportunistic use of whatever access the initial credential already provides. For identity governance, this is a useful reminder that cloud access paths should be evaluated by what an attacker can accomplish from one compromised identity, not by whether a classic internal movement pattern is possible.

Practical implication: Use cloud-specific attacker data to calibrate scenarios and avoid transplanting endpoint assumptions into cloud exercises.

NHI Mgmt Group analysis

Engagement scoring is shaping red-team behaviour more than threat realism. When a team is rewarded for visible penetration, it will naturally optimise for the easiest proof points, not the most representative attacker path. That is Goodhart’s Law applied to security testing: the metric becomes the target, and the target becomes distorted. Practitioners should treat red-team success criteria as a governance control, not a procurement detail.

Discovery is the under-tested control plane in both cloud and endpoint security. Real attackers often need to map what exists before they can monetise access, while many red-team reports skip that phase because it is less dramatic. That is a governance gap, not merely an exercise preference, because discovery is where detection and response can still interrupt the attack chain early. Teams should prioritise scenarios that test whether monitoring can catch reconnaissance before impact.

Endpoint playbooks do not automatically translate into cloud resilience. The article’s cloud data suggests some red teams are overusing lateral movement and privilege escalation patterns that are more common in endpoint-centric intrusion narratives than in cloud abuse. For identity governance, the specific lesson is that the first compromised identity in cloud often matters more than a synthetic internal movement path. Practitioners should align cloud test cases to the real blast radius of one credential or one workload identity.

Persistent access and exfiltration are the stages that reveal whether controls are actually holding. Red teams often stop once they have demonstrated access, but real adversaries are usually trying to stay present or move data. That means exercise design should test whether endpoint hardening, alerting, and containment can disrupt persistence and exfiltration, not only initial compromise. Leaders should judge red-team value by the controls it exposes, not by the drama of the intrusion.

What this signals

Exercise realism is now a governance issue, not just a testing preference. When red-team incentives reward access over fidelity, leaders can end up funding the wrong gaps. Security programmes should treat scope design as a control decision that influences where engineering time gets spent.

Discovery and persistence deserve more attention than they usually get. Those stages are where real attackers are most likely to reveal themselves before the business feels impact. Teams that can detect reconnaissance, stealth, and foothold maintenance are better positioned to reduce dwell time and contain loss.

Cloud and endpoint testing should be separated by actual attacker behaviour, not by convenience. A cloud engagement that looks like an endpoint compromise can produce misleading confidence. Practitioners should calibrate test cases to the environment, the identity type involved, and the way attackers really chain access in that environment.

For practitioners

• Realign exercise scope to observed attacker TTP frequency Use incident and threat telemetry to decide which tactics deserve the most testing time, then update red-team objectives when attacker behaviour shifts. This makes the engagement reflect current adversary pressure instead of inherited playbooks.
• Prioritise discovery and defensive evasion scenarios Make cloud reconnaissance, endpoint stealth, and early-stage detection explicit red-team objectives so defenders can prove they can see the attack before damage occurs. Do not stop at proof of entry.
• Test persistence and exfiltration as first-class outcomes Include scheduled tasks, long-lived footholds, and data movement attempts in endpoint exercises so the team can validate containment after initial access rather than only before it.
• Tune cloud scenarios to cloud-native attacker behaviour Replace endpoint-style lateral movement assumptions with cloud discovery, access enumeration, and workload abuse scenarios that reflect what attackers actually do once inside a cloud environment.
• Separate exercise realism from reportability Define how the organisation will reward a red team when it finds realistic low-noise gaps, even if those gaps do not create a dramatic penetration narrative.

Key takeaways

• Red-team value drops when exercises reward dramatic compromise more than realistic attacker paths.
• The article shows real attackers spending more time on discovery, evasion, persistence, and impact than red teams usually test.
• Leaders should treat exercise design as a governance decision and align it to observed TTP frequency.

Key terms

• Red Team Scoping: Red team scoping is the process of defining what an exercise will test, where it will operate, and which attacker behaviours count as success. In security programmes, scope determines whether the exercise validates realistic threat exposure or only proves that a team can perform a scripted compromise.
• Discovery Phase: The discovery phase is the initial stage of a security leadership transition, focused on understanding the organisation, its stakeholders, and its current security environment. It relies on interviews, listening, and review of existing processes to build context before any formal prioritisation or redesign begins.
• Persistence: Persistence is the ability to retain memory, state, or goals across sessions and time. In NHI governance, persistence matters because retained context can influence later access decisions, create hidden privilege, and extend the impact of a prior task beyond its intended window.
• Rules of engagement: The commercial and operational boundaries that define who can pursue, own, and support an opportunity. In identity programmes, these rules matter because unclear ownership can create remediation gaps, split accountability, and inconsistent customer support during deployment.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is a practical way to strengthen the identity controls that underpin modern security programmes.