“Absolutely not,” my manager at the time said about my Red Team Strategy. The presentation was supposed to outline the direction I planned to take the team under my leadership. Unfortunately, it was a mixture of technical jargon and graphics that could only be understood by a Red Teamer. She followed up with “You cannot show this to an executive audience.” I was lacking any information that truly told the story of the path I would walk with my team. I was not only lacking storytelling, but I had absolutely no clue what that even meant.

Storytelling, by my own definition, is the conversion of information (frequently large amounts) into a format that can be understood by a general audience. It’s important to remove all information that isn’t necessary for the receiver to understand why they should care. I’ll give an example: Coca-Cola commercials are not comprised of videos and information depicting how the product is made in the factory. Instead, they present us with a cold product dripping with condensation, in a fun atmosphere where people are smiling and enjoying life. The story they’re telling the audience is that Coca-Cola will increase your enjoyment on any occasion. None of the ingredients are listed, nor is the process of creating it even mentioned.

So what should happen in between a deeply technical process and delivering the final product to the audience? I call this the “Communication Gateway” mentioned in my previous brief, because traffic is traveling between one network, “technical,” and another, “executive.” During this process, you need to uplevel the information from the Red Team exercise and translate it for executive audiences. If this is done well, the outcomes of your Red Team exercises can have a significant impact. When this is not done well, you will lose the positive momentum from your efforts, which can be used to drive a significant change in the organization.

So how do you acquire these storytelling skills? Personally, I was strongly encouraged to take a certification from IDEO U called Communicating for Impact, which consists of two classes: Storytelling for Influence and Impactful Presentations. However, these are by no means the only classes on this topic, and I encourage you to explore your options. What I took away from this certification was life-changing for how I create presentations, speak, and write about Red Team work. You’re probably wondering what the outcome of my story is. I uplevelled the Red Team Strategy, presented it to my audience, and was rewarded with the trust and support to carry the team forward.

You can look forward to more content about Red Team storytelling in the future…

For the past 10 years, I’ve worked on Red Teams as a member, a lead, and a builder. I chose to continue in this career path for so long because I believe that Red Teaming is the best way to identify, assess, and ultimately reduce risk. The demonstration of risk through simulation outperforms all forms of theoretical security (where we review how “an attacker could”). After witnessing Red Team testing where accompanying recommendations are implemented, I cannot be convinced otherwise. When lacking certainty is too risky, removing assumptions is necessary.

The best parallel to this is how car manufacturers crash test their vehicles before they’re sold to minimize the risk of physical injury or death. Although crash testing incurs costs, the lessons learned are worth it because they’re implemented to increase safety. The risk is too high for the company to wait until the car is crashed on the road to determine its safety level. The overall outcome is a safer driving experience with benefits for both the customer and the company. In Cybersecurity (though not life or death), the risk is too high to wait until you’re under attack to know how well you can respond.

Regardless, we as Red Teamers still struggle to convey our ideas at every stage of the team’s lifecycle. I call this the “communication gateway” because traffic travels between one network, “technical,” and another, “general audience”. As a result, it’s difficult for organizations to understand the value gained from Red Teaming. This can leave them confused when answering questions such as “Do I need a Red Team?”, “How do I build a Red Team?”, and “How do I know if my current Red Team is functioning correctly?” I’ve spent the last few years intentionally growing my knowledge and experience in answering these questions and tackling this unique problem space.

My intended audience for these briefs is the following:

• Red Teamers (Operators, Managers, and Leads) who intend to uplevel their ability to convey results to Security Leadership (CSO, CISO, VP, and Directors)
• Security Leadership (CSO, CISO, VP, and Directors) who seek to understand the outcomes of Red Teams that exist within their Security organization
• Security Leaders (CSO, CISO, VP, and Directors) who do not have a Red Team in their security organization and are seeking to learn more about the benefits
• Individuals or teams who work with Red Teams and want to gain a better understanding of them to achieve greater collaborative outcomes
• Individuals who’re interested in the topic of Red Teaming

I hope to provide value to all these audiences so we can improve our ability to defend organizations from modern-day threats. It’s critical that we, as Red Teamers and Security Leadership who intend to reduce real risk, challenge ourselves to improve our communication. I intend to bridge that gap by publishing content to connect our different worlds. Ignoring or misunderstanding this necessary function is no longer an option for organizations facing sophisticated adversaries. I welcome you to join me on this journey and look forward to shaping the conversation.