Red team exercises: the eight engagement shapes and the five-phase playbook

A red team exercise is an authorized adversary simulation: someone the organization is paying acts the part of someone who isn’t, and tries to break in by the same methods a real attacker would use. The goal is to find the vulnerabilities and process gaps the defender’s existing security program hasn’t surfaced, and the value lives in the realism. A vulnerability scan tells you what bugs are in the OS; a red team engagement tells you whether a determined attacker can chain those bugs (plus the phishable users, plus the misconfigured AD, plus the conference-room Ethernet jack with no 802.1x) into something that gets to the crown jewels.

The discipline has a small canon: a handful of engagement types organizations actually buy, a five-phase methodology that structures most operations, a standard tooling stack at each phase, and a handful of well-documented case studies that get cited so often they’ve become shorthand. What follows is a tour through all of those, from an operator’s perspective in 2026, with corrections for the AI-spun versions of these claims that have started showing up in newer security writing.

The eight engagement shapes

#

What gets sold as a “red team engagement” actually covers eight distinct shapes of work, each with different scope, different deliverable, and different price point. The labels matter because the scope of work clauses matter; a client who buys a “network penetration test” and expects a “full-spectrum red team” is going to be unhappy with what arrives.

Network penetration testing (external and internal)

#

The bread-and-butter engagement: enumerate the network, find vulnerabilities, demonstrate exploitation. External sees the perimeter from outside (public IPs, web apps, exposed services); the operator starts with no credentials and works inward. Internal assumes the attacker is already through the perimeter (compromised laptop, malicious insider, breached VPN); the operator starts on the user VLAN and works toward the crown jewels. Scope is usually a defined IP range and a list of in-scope assets. Strict pentesting is technical only and doesn’t include phishing or physical work.

Social engineering engagements

#

Tests the human layer specifically: phishing email campaigns, vishing (phone calls posing as IT or vendors), smishing (SMS), pretexting (showing up as a contractor), baiting (USB drops in the parking lot). The deliverable is usually a click-through rate, a credential-capture rate, and a list of process gaps that let the operator escalate from those captures into actual access. Cialdini’s six principles of influence (plus Unity as the seventh) cover most of the psychological side; the technical side is just making the lure look real enough.

Physical penetration testing

#

Tests doors, badges, receptions, and tailgating. Operators try to get into the building, into the data center, into the executive offices. RFID cloning with a Proxmark3 or Flipper Zero. UART and JTAG attacks on badge readers. Network dropboxes left in conference rooms. Covered in detail in the physical security testing post , including the Coalfire Iowa arrest, which is the case study every operator needs to know before walking onto a target site.

Red vs blue exercises

#

Classic adversarial format: the red team attacks in real time, the blue team detects and responds, and both teams write up what happened afterward. Communication between teams is typically restricted during the exercise to simulate the real world. The deliverable for the red team is the attack narrative; the deliverable for the blue team is the detection-and-response timeline. Both feed into the post-exercise debrief, which is where the actual learning happens.

Purple teaming

#

The collaborative version. Red and blue work together in real time: red executes a technique (a specific MITRE ATT&CK ID, say T1059.001 PowerShell execution), blue checks whether their SIEM picked it up, both teams tune the detection rules, and they move to the next technique. Faster feedback loops than red-vs-blue, less drama, and the deliverable is a detection-coverage matrix mapped against ATT&CK rather than a “we won / they won” narrative. Purple teaming has eaten a meaningful slice of the red team market over the past five years because mature security programs get more from it than from adversarial exercises.

Multiscenario engagements

#

A red team campaign that combines vectors: network plus phishing plus physical, executed as a coordinated operation rather than as separate workstreams. Tests the organization’s ability to correlate signals across domains. Higher operator effort and longer engagement window than single-vector work; usually six to twelve weeks rather than two to four.

Full-spectrum engagements

#

Everything is in scope and the objective is concrete: “exfiltrate the IP for product X,” “obtain access to the SCADA system at facility Y,” “place a Beacon on the CFO’s laptop without being detected for thirty days.” Operators use any technique a determined adversary would use, including techniques that would normally be out of scope (zero days, custom implants, multi-month dwell). This is what FedRAMP-high environments, defense primes, and critical-infrastructure operators buy when they want to know whether a nation-state attacker can actually get in. Expensive; typically six-figure engagements with multi-month timelines.

Tabletop exercises

#

No live attacks. Stakeholders gather around a table (real or virtual) and walk through a hypothetical scenario: “ransomware lands on the finance share, what happens next?” The facilitator drives the discussion through detection, containment, eradication, recovery, legal disclosure, communications. The deliverable is a list of process gaps and decisions that nobody had a documented answer for. Cheap, fast, and the best way to find the policy holes before a real incident finds them.

The five-phase methodology

#

Most engagements run through a structured methodology with five phases. The exact names vary by source. PTES uses seven phases including Pre-Engagement and Threat Modeling. NIST SP 800-115 uses four. The Lockheed Martin Cyber Kill Chain uses seven different ones aimed at the defender side. But the operator-side work generally maps to the five below. Worth knowing the Kill Chain too: reconnaissance, weaponization, delivery, exploitation, installation, command-and-control, actions on objectives. The Kill Chain is what the blue team’s detection program is structured around.

1. Reconnaissance

#

Information gathering before touching the target. The bulk is OSINT: LinkedIn for employee names and the organization chart, the company blog for office locations and tech stack, GitHub for accidental credentials in public repos, Shodan and Censys for exposed services, DNS records and certificate transparency logs for subdomains nobody published, the company’s job postings for the security tooling they’re hiring people to administer (“must have experience with CrowdStrike Falcon and Tenable” tells the operator what’s on the network).

The discipline is patience. The operator who spends a week on recon before touching the target gets a much higher hit rate during exploitation than the one who skips ahead. Standard tooling: theHarvester, amass, subfinder, Maltego for graph analysis, recon-ng as the framework, plus a paid account on Shodan and a Hunter.io subscription for email format discovery.

2. Scanning

#

Active probing of the live network. Nmap is still the default for port scanning and service detection. For vulnerability scanning, Nessus is the commercial standard, OpenVAS the open-source alternative; both produce noise that any modern EDR will catch, so operators tune scans for stealth (slower timing templates, reduced parallelism, decoy IPs) when the engagement requires it.

Web application work is its own subdiscipline. Burp Suite Professional is the operator’s standard; OWASP ZAP is the free alternative. Both proxy the browser, intercept requests, replay them with modifications, and run automated scanners against the request space. SQL injection, XSS, SSRF, IDOR, broken access control, and the rest of the OWASP Top 10 are what the scanners flag; the operator’s job is to chain them.

3. Exploitation

#

Gaining initial access. Three main paths:

• Software vulnerabilities. Unpatched CVE in an exposed service, command injection in a web admin, deserialization bug in a Java app. Metasploit’s exploit database covers the well-known ones; custom exploits are written when nothing public exists.
• Credentials. Password spraying against M365 or Okta with a list of usernames from LinkedIn and a short list of likely passwords (“Summer2026!”, the company name, “Welcome123”), or replaying credentials from prior breaches via Have I Been Pwned.
• Phishing. Crafted email with a malicious attachment or a credential-capture link. The most successful initial-access vector in published incident data; the Verizon DBIR has tracked it consistently as a top vector for years.

Modern Windows defense means most exploitation paths require EDR evasion (AMSI patching, ETW bypass, indirect syscalls), which is covered in the Covenant post along with the equivalent tradecraft for Sliver, Mythic, Havoc, and the commercial frameworks.

4. Post-exploitation

#

The phase where the engagement actually proves its worth. Initial access on a single workstation is not the goal; the goal is whatever the engagement letter said the goal was (domain admin, the CFO’s laptop, the SCADA system, the production database). Getting there requires:

• Persistence. Registry run keys, scheduled tasks, WMI event subscriptions, malicious LSA providers, modified service binaries. The defender’s detection coverage on these varies wildly; the operator picks based on what’s likely to survive a reboot and what’s unlikely to be alerted on.
• Privilege escalation. UAC bypass, kernel exploits, credential reuse, token impersonation, AlwaysInstallElevated misconfigurations, vulnerable services with weak permissions. On Linux, sudo misconfigurations and SUID binaries are usually the first checks; LinPEAS and WinPEAS automate the enumeration.
• Internal reconnaissance. BloodHound (or its modern successor, BloodHound CE ) maps Active Directory trust relationships and finds attack paths from the compromised user to domain admin. Once you’ve seen a BloodHound graph turn six AD permissions into a one-click path to enterprise admin, you stop being surprised that nation-state actors keep getting in.
• Lateral movement. PsExec, WMI, DCOM, WinRM, SMB exec, RDP with captured credentials. Impacket’s psexec.py, wmiexec.py, smbexec.py, and secretsdump.py are the operator-side toolkit; NetExec (the active community fork of the archived CrackMapExec) automates the credential spraying and lateral pivot work.
• Credential access. Mimikatz for LSASS, DPAPI vault extraction with SharpDPAPI, browser credential extraction with SharpChrome, Kerberoasting and AS-REP roasting via Rubeus. The credential layer is what makes lateral movement cheap once you’re inside.
• Data identification and staging. Finding the data the engagement is supposed to demonstrate access to, packaging it, and (depending on the engagement scope) optionally exfiltrating a small marker file to prove the access.

5. Reporting

#

The deliverable. A report nobody reads is a report nobody fixes anything from, so the operator’s job is writing reports that get read.

Standard sections: executive summary (one page, business language, no jargon), engagement scope and timeline, the attack narrative (chronological, with screenshots), the findings table (each finding tagged with CVSS or owner-defined severity, plus reproduction steps), specific remediation recommendations per finding, and an appendix with the technical artifacts (commands run, hashes captured, dwell-time analysis). The narrative is the most important section; “we got in via the SharePoint server, pivoted to the file share, found the AWS keys in a config file, and from there had full access to the production environment” is what the CISO is going to remember, and what’s going to drive the actual remediation budget.

The debrief is where most of the actual learning happens. A live walkthrough with the client’s security team, then a separate one with leadership. The blue team sees the attack from the operator’s perspective and gets to ask questions; leadership sees the business impact narrative and decides what gets fixed first.

Tooling by phase

#

What’s actually in the operator’s bag in 2026, organized by where it gets used in an engagement. Tool churn in this space is constant; expect any specific tool to be replaced by a successor within a few years (CrackMapExec to NetExec, Empire to BC-SECURITY’s Starkiller, etc.).

Reconnaissance

#

• Maltego (Maltego Technology): graph-based OSINT link analysis. Visualizes relationships across domains, IPs, people, emails. Community Edition is free with limits; Pro and Enterprise are paid.
• theHarvester : email, subdomain, and employee enumeration from public sources. Christian Martorella’s tool.
• amass and subfinder : subdomain enumeration via multiple sources (cert transparency, passive DNS, search engines).
• Shodan and Censys : banner-grab search engines for internet-connected devices. Paid accounts get the full result counts and historical data.
• Google dorks: site:, filetype:, intitle:, inurl: operators against the target’s published surface. Still useful for finding indexed files that shouldn’t be public.
• dig / nslookup: DNS reconnaissance. Pair with crt.sh for certificate-transparency-based subdomain discovery.

Scanning

#

• Nmap : still the default for port and service discovery. nmap -sV -p- target for thorough enumeration; -sC runs the default NSE script library; -sn for host discovery without portscanning.
• Nessus (Tenable): commercial vulnerability scanner. Heavy on the wire, noisy in any decent SOC. Use for compliance-driven engagements.
• OpenVAS / Greenbone: open-source equivalent. Less polished but free, useful for lab work.
• Burp Suite (PortSwigger): web application proxy and scanner. The Professional edition’s active scanner finds most of the common web vulnerabilities; the Community edition is free but lacks the scanner. The reference toolkit for any web app pentest.
• OWASP ZAP : free alternative to Burp. Less polished but completely capable for most engagements.

Exploitation

#

• Metasploit (Rapid7): the public exploit framework. Thousands of modules across exploitation, post-exploitation, and auxiliary scanning. Heavily signatured by EDR, so production engagements use it mostly for the auxiliary scanners and the credential-spray modules; the exploit modules themselves rarely land against modern targets.
• Cobalt Strike (Fortra): the commercial standard for enterprise red team C2. Originally authored by Raphael Mudge, sold to HelpSystems in 2020 and folded into Fortra after the 2022 rebrand. Heavily detected by every major EDR, which means working operators run heavily modified Beacon configs, custom Malleable C2 profiles, and userdefined reflective loaders to land it.
• Sliver (Bishop Fox): the open-source Go-based C2 that ate Empire’s lunch after Empire’s 2019 archive. Cross-platform, actively maintained, less heavily signatured than Cobalt Strike.
• Mythic (Cody Thomas): plugin-based C2 framework with a Docker-deployed architecture and a growing library of agent types (Apollo for Windows .NET, Poseidon for cross-platform Go, Athena, Apfell). Now the operator-side standard for engagements that need custom payloads.
• Hashcat and John the Ripper : password cracking. Hashcat is GPU-accelerated, faster for most modern hashes; John is more flexible for unusual formats. Both work against captured NTLM, Kerberos, and AS-REP hashes from the post-exploitation phase.
• Hydra : protocol-aware online brute-forcing. Useful for SSH, RDP, SMB, HTTP, and the long tail of legacy protocols. Loud.
• Social-Engineer Toolkit (SET) (TrustedSec, Dave Kennedy): phishing campaign builder. Sets up cloned login pages, generates payloads, runs the credential capture infrastructure.
• Evilginx (Kuba Gretzky): adversary-in-the-middle phishing toolkit that proxies the target through to the real M365 / Google / Okta endpoint and captures the session cookie after MFA. The standard tool for defeating phishable MFA in 2026.

Post-exploitation

#

• Mimikatz (Benjamin Delpy): the credential-dumping reference. LSASS extraction, DPAPI vault decryption, Kerberos ticket manipulation, DCSync. Every defender has it signatured; operators reach for in-memory variants and the C# port (SafetyKatz) instead.
• Rubeus (GhostPack, Will Schroeder): C# Kerberos abuse. Kerberoasting, AS-REP roasting, S4U2Self abuse, golden tickets. Pairs naturally with the Covenant / Sliver / Mythic in-memory loader patterns.
• BloodHound CE (SpecterOps): Active Directory and Entra ID attack-path analysis. The community-edition rewrite of the original BloodHound; the legacy versions are still in use but deprecated.
• Impacket (Fortra, originally SecureAuth): Python implementations of every major Windows network protocol. psexec.py, wmiexec.py, smbexec.py, secretsdump.py, GetUserSPNs.py, getNPUsers.py. Operator-side toolkit for AD attacks from a Linux operator host.
• NetExec : the active community fork of CrackMapExec, which was archived in 2023. SMB / WinRM / SSH / RDP / MSSQL credential spraying and remote command execution. The single most useful AD post-exploitation utility in the toolkit.
• SharpDPAPI and SharpChrome : GhostPack’s C# tooling for extracting DPAPI-protected secrets and Chromium browser credentials.
• Empire (BC-SECURITY fork) : PowerShell and Python C2 framework. The original (Veris Group) was archived in 2019; BC-SECURITY’s fork is the actively maintained version and pairs with the Starkiller web UI.
• PsExec (Mark Russinovich, Sysinternals / Microsoft): the historical lateral-movement tool. Now heavily signatured; operators use Impacket’s Python port or DCOM/WMI alternatives instead.

Command and control

#

In rough order of how often the operator reaches for them in 2026:

• Sliver (open source, Go, cross-platform): the default for engagements that don’t need Cobalt Strike’s polish.
• Mythic (open source, Docker, polyglot agents): the default for engagements that need custom payloads.
• Cobalt Strike (commercial): the default for engagements where the client expects the report to name it specifically.
• Havoc (open source, C5pider): the polished newer entrant. Modern C2 with a Qt-based client.
• Brute Ratel C4 (commercial, Chetan Nayak / Dark Vortex): the operator-favorite alternative to Cobalt Strike for high-end engagements.
• Nighthawk (commercial, MDSec): the other operator-favorite alternative. Less common than Brute Ratel but well-respected.
• Covenant (open source, .NET, archived): still useful as a lab framework, not for active engagements. Covered separately in the Covenant post .
• Metasploit Meterpreter (open source): heavily signatured; mostly used for the auxiliary scanners and the initial-foothold scenarios where stealth doesn’t matter.

Worked-through examples

#

Two real grounding points and a methodological note. (The “Pentagon’s red team gained access within minutes via a public-facing website” claim that appeared in earlier drafts of this post couldn’t be sourced to a specific documented incident, so it’s been replaced with case studies that have actual public reporting behind them.)

DoD Cyber Flag

#

Cyber Flag is U.S. Cyber Command’s annual force-on-force cyber exercise, running since around 2011 and held at locations including Suffolk, Virginia. Each iteration involves hundreds of participants from across the Department of Defense, partner agencies (FBI, DHS), and allied military services. The exercise builds a custom network range, deploys realistic target systems and attacker infrastructure, and runs multi-team simulations of contested cyber operations over several days.

Cyber Flag isn’t a single attack-and-defend exercise; it’s structured as multiple parallel scenarios, each testing different aspects of cyber defense (industrial control system attacks, enterprise network compromise, infrastructure disruption). The blue team’s job is detection, attribution, and response; the red team’s job is hard enough to make the blue team work for it. The post-exercise debrief drives changes in DoD doctrine and training, and the participants take what they learned back to their own services.

The operator takeaway: Cyber Flag is the canonical “professional military red team exercise” reference, and the structural choices (live ranges, parallel scenarios, structured debrief, multi-organization participation) are the model that mature commercial red team programs increasingly use for their internal training.

Attack patterns from the Verizon DBIR

#

The Verizon Data Breach Investigations Report (DBIR) is the most-cited public data source on actual breach patterns. Each year it analyzes thousands of confirmed breaches from contributors including law enforcement agencies, forensics firms, and incident response shops. The methodology and the sample size make it a reasonable proxy for what’s actually happening in the wild.

Two findings the operator can use to prioritize engagement scoping:

• The human element dominates initial access. In recent DBIR editions, breaches involving a human element (phishing, social engineering, credential misuse, errors) have consistently accounted for around three-quarters of the analyzed incidents. The implication for red team scoping: if your engagement doesn’t include a social engineering component, you’re not testing against the most common attack pattern.
• Stolen credentials are a top vector across multiple years. Reuse of credentials from prior breaches, password spraying, and credential phishing keep showing up as primary initial-access methods. The implication: MFA coverage, AiTM-resistant authentication (FIDO2/passkeys), and identity-side monitoring are higher-impact controls than most organizations weight them.

The exact percentages move year to year and you’ll want to pull the current edition’s numbers when writing a scope document or briefing a client, rather than quote a number from a single year’s report.

A methodological note: the DoD has its own taxonomy

#

Civilian red teaming and military “cyber operations” use overlapping vocabulary that doesn’t quite line up. The U.S. military’s joint doctrine talks about offensive cyber operations (OCO) and defensive cyber operations (DCO); within DCO, there’s a sub-category called DCO-IDM (Internal Defensive Measures) which is what most civilians would call “incident response.” Red team work in the military context is conducted by specific units (Marine Corps Cyber Operations Group, USCG Cyber Protection Team, Air Force 67th Cyberspace Operations Group, etc.) under standing operational authorities that don’t directly translate to commercial engagement contracts. If you’re moving from commercial pentesting into a DoD red team role, expect to spend a year learning the doctrine before any of the actual work starts feeling familiar.

What this comes down to

#

Red team work is the discipline of being a paid adversary to your client. Done well, it produces findings the client’s defense program couldn’t have surfaced on its own, and the client’s security posture improves measurably afterward. Done badly, it produces a generic vulnerability scan output and a six-figure invoice. The difference is the operator’s craft, the structure of the engagement, and the quality of the report.

Eight engagement shapes, five-phase methodology, a tooling stack that turns over every few years as the defenders catch up to the attackers. The work is unglamorous, mostly involves typing in front of a screen, and produces fewer movie-style moments than the marketing copy of any commercial red team firm would suggest. But on the engagements that go well, the operator gets to see exactly how a real attacker would have gotten in, and the client gets to fix it before that attacker shows up.