Topic starter
18/08/2026 2:24 pm
TL;DR: Red team exercises reward cloud initial access, privilege escalation, and endpoint credential access more than the stages real attackers often spend time on, according to Expel. That mismatch can leave cloud and endpoint testing focused on dramatic compromise instead of the controls most likely to fail.
Editorial analysis by NHI Mgmt Group, based on content published by Expel: “When red teams go off the rails, who’s at fault?”.
Key questions
Q: Why do cloud and endpoint red-team scenarios often miss the most important attack stages?
A: Because many engagements reuse familiar playbooks instead of matching current attacker behaviour.
Q: What are the signs that a red team programme is not giving an accurate view of organisational risk?
A: A red team programme is likely missing the mark when it runs only occasionally, relies on manual effort, and produces findings that do not reflect current exposure.
Q: What breaks when red-team exercises are scored mainly on penetration success?
A: They start rewarding visible compromise over realistic attacker behaviour, which pushes teams toward initial access and privilege escalation at the expense of discovery, persistence, and exfiltration.
Practitioner guidance
- Realign exercise scope to observed attacker TTP frequency Use incident and threat telemetry to decide which tactics deserve the most testing time, then update red-team objectives when attacker behaviour shifts.
- Prioritise discovery and defensive evasion scenarios Make cloud reconnaissance, endpoint stealth, and early-stage detection explicit red-team objectives so defenders can prove they can see the attack before damage occurs.
- Test persistence and exfiltration as first-class outcomes Include scheduled tasks, long-lived footholds, and data movement attempts in endpoint exercises so the team can validate containment after initial access rather than only before it.
Bottom line: Red-team value drops when exercises reward dramatic compromise more than realistic attacker paths.
Glossary terms: Red Team Scoping, Discovery Phase, Persistence, Rules of engagement
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
18/08/2026 3:15 pm
Engagement scoring is shaping red-team behaviour more than threat realism. When a team is rewarded for visible penetration, it will naturally optimise for the easiest proof points, not the most representative attacker path. That is Goodhart’s Law applied to security testing: the metric becomes the target, and the target becomes distorted. Practitioners should treat red-team success criteria as a governance control, not a procurement detail.
A question worth separating out:
Q: How should organisations balance realistic red-team scope with safe exercise boundaries?
A: Set rules of engagement that preserve safety but still allow the team to test the stages attackers actually use, including discovery, stealth, persistence, and data movement. The goal is not unrestricted harm, but a credible simulation that tells defenders where their controls are most likely to fail.
👉 Read our full editorial: Red team activity is drifting from real attacker behaviour