Nobody wakes up in the morning and says to themselves, “You know what would add value to my organization? Red Teaming.” That’s not to say Red Teaming has no value, but organizations have countless priorities they think about first. It’s not a revenue-generating activity, and the security community communicates the risk reduction it provides poorly. I can’t blame people for resisting the idea, but I think it’s because we haven’t level-set on why you would want to do a costly, time-consuming activity. But let’s be clear: you do have the problem that red teaming solves.

Can you systems be exploited?

If I asked any organization whether it was 100% confident it could not be exploited, I highly doubt any would say yes. Waves of vulnerabilities and AI-driven advantages for adversaries have left us less confident than ever. Almost everyone would agree their systems could be exploited directly or through phishing. We all have to acknowledge that at some point even a well-managed public attack surface will experience active exploitation. However, few organizations, beyond assumption, can tell you how impactful such exploitation would be to their environment beyond a vulnerability rating.

Can your critical assets be compromised?

We can all agree that almost all organizations, under the right circumstances, can be exploited. That raises the question: can that exploitation lead to the compromise of your most critical assets (intellectual property, customer data, or payment information)? Most organizations have a vague idea of what would happen after exploitation. A fundamental misunderstanding of the security of the internal attack surface makes this even more of a question mark for many organizations. Most organizations would not want their most critical assets compromised but have almost no understanding of how that risk presents itself.

“People don’t want to buy a quarter-inch drill. They want a quarter-inch hole!”

– Harvard marketing professor, Theodore Levitt (1974)

Red Teaming is the solution

So you have the problem Red Teaming prevents, but you’re being shown the “what,” not the “why.” You don’t want to be Red Teamed; you want to avoid breaches. Avoiding breaches reduces loss to your organization; however, most people aren’t confident about whether they’ll be exploited or what the impact of that exploitation will be on their environment. So are you choosing to be a sitting duck? In this scenario, the drill is performing Red Teaming, and the hole is preventing a breach. We can all agree we don’t want a breach for our organization, but we haven’t connected the dots or chosen to exercise the solution: Red Teaming.