Topic starter
11/08/2026 3:23 pm
TL;DR: Offensive security only creates value when it is aligned to business risk, crown jewels, and realistic attacker objectives, according to Bishop Fox, with mature programs using tiered testing, multiple scenarios, and continuous coverage for high-value environments. The practical shift is from checklist penetration tests to measurable adversary emulation that exposes exploitable weakness, detection gaps, and strategic control failures.
Editorial analysis by NHI Mgmt Group, based on content published by Bishop Fox: “What Does “Good” Look Like in Red Teaming”.
Key questions
Q: How should organisations scope red team exercises so they produce useful risk decisions?
A: Start with the business assets, identities, and pathways that would matter most if compromised.
Q: Why do compliance-driven penetration tests often miss the risks that matter most to defenders?
A: Compliance-driven tests often miss the risks that matter most because budgets and hours get consumed by narrow, mandated scope.
Q: What are the signs that offensive security coverage is not working?
A: The clearest sign is when testing produces long reports, many findings, and little change in architecture or priorities.
Practitioner guidance
- Define crown jewels before choosing test scope Map the 20 most critical systems and services first, then build red team scenarios around the ones whose compromise would change business decisions.
- Separate compliance testing from adversary emulation Keep annual compliance penetration tests distinct from red team objectives so you can measure real attack paths, not just checklist completion.
- Test identity and secrets failure paths Include credential reuse, privileged access paths, and weak secrets management in scenarios that target escalation toward crown jewels.
Bottom line: Red team coverage only changes decisions when it is tied to business risk, critical assets, and realistic attacker objectives.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 9 hours ago by NHI Mgmt Group
11/08/2026 3:33 pm
Red team value collapses when the exercise is not anchored to business risk. Offensive security only changes decisions when it is designed around the systems, identities, and data that would hurt the organisation most if compromised. In practice, that means testing should be shaped by crown jewels, adversary objectives, and operational dependencies rather than by calendar-driven compliance. The practitioner conclusion is simple: if the scenario would not affect investment choices, it is not strategic coverage.
A question worth separating out:
Q: Should red team findings be treated as a security operations issue or a governance issue?
A: Both. Red team results often expose a technical weakness, but the reason it persists is usually governance: unclear asset ownership, weak prioritisation, or controls that are not tied to business risk. The best programmes use the findings to coordinate SOC, IAM, PAM, and leadership decisions, rather than treating the report as a one-team remediation task.
👉 Read our full editorial: Red team coverage that changes risk decisions, not just compliance
This post was modified 9 hours ago by NHI Mgmt Group