Topic starter
18/08/2026 2:24 pm
TL;DR: Red teams concentrate on cloud initial access, privilege escalation, and endpoint credential access, while real attackers spend more time on discovery, defensive evasion, persistence, and impact, according to Expel’s annual threat report. The gap suggests exercise incentives are rewarding penetration theatre over the attack stages that most often determine real risk, per Expel.
Editorial analysis by NHI Mgmt Group, based on content published by Expel: “When red teams go off the rails, who’s at fault?”.
Key questions
Q: What breaks when red-team exercises are scored mainly on penetration success?
A: They start rewarding visible compromise over realistic attacker behaviour, which pushes teams toward initial access and privilege escalation at the expense of discovery, persistence, and exfiltration.
Q: Why do cloud and endpoint red-team scenarios often miss the most important attack stages?
A: Because many engagements reuse familiar playbooks instead of matching current attacker behaviour.
Q: What are the signs that a red team programme is not giving an accurate view of organisational risk?
A: A red team programme is likely missing the mark when it runs only occasionally, relies on manual effort, and produces findings that do not reflect current exposure.
Practitioner guidance
- Realign exercise scope to observed attacker TTP frequency Use incident and threat telemetry to decide which tactics deserve the most testing time, then update red-team objectives when attacker behaviour shifts.
- Prioritise discovery and defensive evasion scenarios Make cloud reconnaissance, endpoint stealth, and early-stage detection explicit red-team objectives so defenders can prove they can see the attack before damage occurs.
- Test persistence and exfiltration as first-class outcomes Include scheduled tasks, long-lived footholds, and data movement attempts in endpoint exercises so the team can validate containment after initial access rather than only before it.
Bottom line: Red-team value drops when exercises reward dramatic compromise more than realistic attacker paths.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:15 pm
Engagement scoring is shaping red-team behaviour more than threat realism. When a team is rewarded for visible penetration, it will naturally optimise for the easiest proof points, not the most representative attacker path. That is Goodhart’s Law applied to security testing: the metric becomes the target, and the target becomes distorted. Practitioners should treat red-team success criteria as a governance control, not a procurement detail.
A question worth separating out:
Q: How should organisations balance realistic red-team scope with safe exercise boundaries?
A: Set rules of engagement that preserve safety but still allow the team to test the stages attackers actually use, including discovery, stealth, persistence, and data movement. The goal is not unrestricted harm, but a credible simulation that tells defenders where their controls are most likely to fail.
👉 Read our full editorial: Red team activity is drifting from real attacker behaviour