What needs to be finished first
A strategy, plan, architecture or solution exists in reviewable form so the Red Team can attack concretely.
First risk hypotheses are available so the Red Team can start from real weak points.
What needs to be ready before start
Complete documents for the artifact (strategy, architecture, plan); whiteboard or Miro with attack table (attack vector, effect, probability, mitigation); STRIDE/PASTA templates for security if needed.
One Red Team (3-5 people), ideally external to the original team; one original-team representative for understanding questions (not defense); one moderator; one scribe.
Provide artifact 2-3 days before workshop; clarify context and assumptions; known attack patterns in domain (security: OWASP; business: competitor moves); time limit for Red Team preparation.
1-2 days (1 day preparation, 4-8 h workshop)
Red Team works autonomously on attack strategies before workshop. Workshop has clear rules: original team does not defend, but listens and notes. Q&A only after complete presentation.
The one question this method answers
Which attack vectors, weaknesses or entry paths overcome the artifact, and which of these vectors are likely enough to justify mitigation?
Marker: Phase
| Step | Duration | Action | Hint |
|---|---|---|---|
1Phase 1: Red Team preparation | 4-8 h | Red Team studies the artifact. Generates attack tree or list. Per attack: vector, required capabilities, effect, probability, existing mitigation. | Red Team needs time and distance. Without preparation, Red Teaming becomes discussion round. External people are often more creative than internal ones. |
2Phase 2: Context and rules | 30 min | Moderator briefly presents artifact. Red Team and original team ask understanding questions. Rules clear: original team listens, answers facts, does not defend. | Defense reflex is the most common method error. Clear rule: discussion only in Phase 4. |
3Phase 3: Attack presentation | 2-3 h | Red Team presents attacks systematically. Per attack: vector, scenario, effect. Original team asks only for understanding, not rebuttal. | If original team interrupts and defends, moderator interrupts back. Presentation must be complete before evaluation starts. |
4Phase 4: Evaluation and prioritization | 90 min | Per attack, evaluate effect, probability and mitigation effort. Original team adds context that changes probability. Top attacks go to risk register as risks. | Probability is subjective. Consensus is not required, but rationale must be documented. |
5Phase 5: Mitigations and follow-ups | 60-90 min | Sketch mitigation per top attack (prevention, detection, response). Owner and deadline. Log changes to artifact. | Mitigation must be concrete. "More monitoring" without detail is not mitigation. Owner mandatory. |
What comes out at the end
Red Team report with artifact description, attack list (vector, scenario, effect, probability, mitigation effort), prioritized risks and mitigations with owner and deadline. Supplemented by methodology notes and open questions.
One entry per Red Team session with date and artifact version. Mitigations tracked separately over time. New Red Team run for major changes to artifact.
Compact working template for Red Teaming with challenge scope, attack points, findings, and mitigations.
Challenge assumptions, expose weak spots, and strengthen the plan, strategy, or design.
When and for what do we use this method?
Which data, observations, decisions, or materials are available?
Owner, date, and success signal.
Concrete filled scenario, fictional example
Concrete filled scenario, fictional example
Red Team: 3 external architects + 1 internal security champion. Preparation 6 h.
Top attack vectors
Further attacks (excerpt, without immediate mitigation): cache invalidation bug, compliance audit findings in eu-west region, auth service downtime.
Follow-up: Top 3 into risk register Booking API, ADR-014 adjusted, reviews in 30 days.
Recognize symptoms and steer against them
Presentation becomes discussion, Red Team cannot get through attack list.
Moderator interrupts. Clear rule: understanding questions yes, defense no. Evaluation only in Phase 4.
Attacks are generic, do not hit artifact.
Preparation time mandatory. Red Team must have artifact 2-3 days beforehand. If time window is short, postpone.
Red Team and original team share assumptions, blind spots remain.
Bring external people into Red Team, ideally with different perspective. If impossible, at least another department.
Long attack list, nobody takes mitigation ownership, list gathers dust.
Top attacks require mitigation, owner, deadline. Other attacks as watchlist with next review date.
Red Team is used to fight internal conflicts, attacks are hidden career moves.
Independent moderator. Attacks relate to artifact, not people. Moderator interrupts personalization.
Done signals checkable in under a minute
Go to the profile for purpose, similar methods, and sources or continue to the next method in the catalog.