methodatlas
Method guideDecision Making

Red Teaming

A practical method guide: clarify prerequisites and materials, understand the complete process, and look up outputs, pitfalls, and stop criteria.

ComplexityHigh
Time1-4 h
Participants3-8
FormatWorkshop
MaturityEstablished
Plan the work
01

Prerequisite

What needs to be finished first

Complete firstClear working frame

Name the owner, object of challenge, allowed evidence, prohibited actions, stop authority and decision use.

Without a bounded question or checkable evidence, the result will be unclear.
02

Preparation

What needs to be ready before start

Materials

Current decision material, evidence register, scoped authority, independent participants and secure findings handling.

People / roles

Decision owner · independent challenge lead · relevant experts · mitigation owners.

Pre-read

Choose materials, data access and participants to fit the research or decision question.

Time needed

60–240 minutes for a tabletop challenge; remediation and retest need follow-up.

Setup

Open the method-specific structure. Fictional examples are for orientation only; keep the blank worksheet separate from actual findings.

03

Core question

The one question this method answers

How could the plan fail under a credible opposing perspective, and what changes the decision?

04

Flow

Phases with goal, actions, output and pitfall

Red teaming examines a decision, plan, or system from an independent challenge perspective. An authorized brief defines boundaries and stop rules. The investigation challenges assumptions and identifies plausible failure paths.

Red Teaming working record

Fictional example

Method-specific prompts and a fictional worked example; template prompts remain empty.

Set scope and authority

Keep the challenge inside an explicit safe boundary.

**Scope:** Challenge the launch plan using documents and tabletop scenarios only. No live probing or customer data access is authorized.

Build independent perspectives

Add an independent perspective where possible.

**Challenge:** If confirmation is delayed while inventory stays reserved, can support determine the authoritative state?

Challenge the plan

Describe mechanism and consequence without personal criticism.

**Finding:** The plan does not identify a reconciliation owner or user recovery path. This is a planning gap, not a production defect.

Respond and retest

Record a criterion and follow-up date.

**Response:** Product and operations add a procedure and test it in another tabletop.

The U.S. Army handbook is a practitioner source for structured independent challenge. This guide limits exercises to an approved scope.

U.S. Army Red Team Handbook

  1. 1

    Scope

    Set scope and authority

    Goal

    Keep the challenge inside an explicit safe boundary.

    Inputs for this step

    • Name the owner, object of challenge, allowed evidence, prohibited actions, stop authority and decision use.
    • Current decision material, evidence register, scoped authority, independent participants and secure findings handling.

    Actions

    • Name object, allowed evidence, prohibited actions, approval and stop authority.
    • Record Authorized challenge brief with its evidence status, source or open verification need.

    Output

    Authorized challenge brief

    Authorized challenge brief

    Quality check

    Can everyone state what is out of scope?

    Pitfall

    Red team is treated as permission for live probing. Use tabletop evidence unless technical access is expressly authorized.

    Timing: About 10–20 minutes; schedule data or clarification work separately.

  2. 2

    Perspectives

    Build independent perspectives

    Goal

    Add an independent perspective where possible.

    Inputs for this step

    • Authorized challenge brief
    • Current decision material, evidence register, scoped authority, independent participants and secure findings handling.

    Actions

    • Select relevant challenge roles and disclose conflicts or shared assumptions.
    • Record Challenge roles and assumptions with its evidence status, source or open verification need.

    Output

    Challenge roles and assumptions

    Challenge roles and assumptions

    Quality check

    Can the group challenge its own assumptions?

    Pitfall

    The team mirrors decision owners. Invite an independent reviewer.

    Timing: About 10–20 minutes; schedule data or clarification work separately.

  3. 3

    Challenge

    Challenge the plan

    Goal

    Describe mechanism and consequence without personal criticism.

    Inputs for this step

    • Challenge roles and assumptions
    • Current decision material, evidence register, scoped authority, independent participants and secure findings handling.

    Actions

    • Use counterfactuals and failure modes; distinguish evidence, inference and speculation.
    • Record Prioritized vulnerabilities with its evidence status, source or open verification need.

    Output

    Prioritized vulnerabilities

    Prioritized vulnerabilities

    Quality check

    Is each finding plausible and specific?

    Pitfall

    Speculation is presented as fact. Add evidence and uncertainty.

    Timing: About 10–20 minutes; schedule data or clarification work separately.

  4. 4

    Response

    Respond and retest

    Goal

    Record a criterion and follow-up date.

    Inputs for this step

    • Prioritized vulnerabilities
    • Current decision material, evidence register, scoped authority, independent participants and secure findings handling.

    Actions

    • Choose mitigation, acceptance or inquiry; assign owner and retest material changes.
    • Record Decision and mitigation log with its evidence status, source or open verification need.

    Output

    Decision and mitigation log

    Decision and mitigation log

    Quality check

    Can the owner verify risk reduction?

    Pitfall

    Findings have no decision or owner. Assign owner, evidence and due date.

    Timing: About 10–20 minutes; schedule data or clarification work separately.

05

Artifact

What comes out at the end

Sketch: what the artifact looks like

Red Teaming · Adversarial PerspectiveDeliberately attack plan, assumptions, and weaknesses, prioritize findings, and derive countermeasures
Red TeamingThe visual shows plan, red team, findings, defense, and plan-B measures as a structured challenge.Attack a plan deliberately before reality doesRed Teaming separates attack, finding, and response so critique turns into better preparation.challengefindingsconfrontprotectPlan / assumptionlaunch without migration freezeRed Teamattacks logic, data, risksDefenseevidence, trade-offs, limitsPlan Bcountermeasures, triggers, ownersFinding Adependency unclearFinding Brollback missing
Form

Versioned record of question, evidence, result, uncertainty, owners and next review date.

Versioning / ownership

Track date, scope, sources, assumptions and changes; assign an owner and review for ongoing practice or initiatives.

Tool alternatives
  • Paper and pens
  • Whiteboard or simple table

red-teaming-working-template.md

Plan a session or initiative to match the actual scope of work.

Red Teaming: Worksheet

Question

To be confirmed

Desired outcome

To be confirmed

Scope

Prepare the full method Time: 60–240 minutes for a tabletop challenge; remediation and retest need follow-up.

Complete this worksheet on paper or in your own document during the work.

Preparation for this scope

Method setup

  • Materials: Current decision material, evidence register, scoped authority, independent participants and secure findings handling.
  • Roles: Decision owner · independent challenge lead · relevant experts · mitigation owners.
  • Advance information: Choose materials, data access and participants to fit the research or decision question.
  • Overall time needed: 60–240 minutes for a tabletop challenge; remediation and retest need follow-up.
  • Setup: Open the method-specific structure. Fictional examples are for orientation only; keep the blank worksheet separate from actual findings.

Prepare for the work steps

Scope: Set scope and authority

  • Name the owner, object of challenge, allowed evidence, prohibited actions, stop authority and decision use.
  • Current decision material, evidence register, scoped authority, independent participants and secure findings handling.

Perspectives: Build independent perspectives

  • Authorized challenge brief
  • Current decision material, evidence register, scoped authority, independent participants and secure findings handling.

Challenge: Challenge the plan

  • Challenge roles and assumptions
  • Current decision material, evidence register, scoped authority, independent participants and secure findings handling.

Response: Respond and retest

  • Prioritized vulnerabilities
  • Current decision material, evidence register, scoped authority, independent participants and secure findings handling.

Red Teaming working record

Set scope and authority

Keep the challenge inside an explicit safe boundary.

...

Build independent perspectives

Add an independent perspective where possible.

...

Challenge the plan

Describe mechanism and consequence without personal criticism.

...

Respond and retest

Record a criterion and follow-up date.

...

Blank worksheet contains prompts only, with no example data.

U.S. Army Red Team Handbook

Scope: Set scope and authority

Expected artifact: Authorized challenge brief

Authorized challenge brief

Entry:

...

  • Can everyone state what is out of scope?

Perspectives: Build independent perspectives

Expected artifact: Challenge roles and assumptions

Challenge roles and assumptions

Entry:

...

  • Can the group challenge its own assumptions?

Challenge: Challenge the plan

Expected artifact: Prioritized vulnerabilities

Prioritized vulnerabilities

Entry:

...

  • Is each finding plausible and specific?

Response: Respond and retest

Expected artifact: Decision and mitigation log

Decision and mitigation log

Entry:

...

  • Can the owner verify risk reduction?

Open questions and next steps

...

Method guide: https://methodatlas.meierhoff-systems.de/en/methods/red-teaming/run-sheet

06

Example output

Concrete filled scenario, fictional example

Fictional example for orientation. Counts and timings describe this case and are not universal requirements.

red-teaming-beispiel.md

Concrete filled scenario, fictional example

Fictional example: booking launch tabletop

Scope: Challenge the launch plan using documents and tabletop scenarios only. No live probing or customer data access is authorized.

Challenge: If confirmation is delayed while inventory stays reserved, can support determine the authoritative state?

Finding: The plan does not identify a reconciliation owner or user recovery path. This is a planning gap, not a production defect.

Response: Product and operations add a procedure and test it in another tabletop.

Decision use: The launch owner records accept, mitigate or defer rationale.

07

Pitfalls

Recognize symptoms and steer against them

Quick overview, the full text is in the matching phase in the flow

  1. Set scope and authorityRed team is treated as permission for live probing.View in phase
  2. Build independent perspectivesThe team mirrors decision owners.View in phase
  3. Challenge the planSpeculation is presented as fact.View in phase
  4. Respond and retestFindings have no decision or owner.View in phase
08

Stop criteria

When to pause, resolve prerequisites, or choose another approach

Do not proceed without explicit authority, scope and safe findings handling. Stop if boundaries are breached or personal data appears. Red teaming does not certify absence of risk.

Method after Praxisgemeinschaft. The method emerged as a widespread practice and is not clearly attributed to a single originator or organization. Curated with 1 sources.

Sources: U.S. Army Red Team Handbook

Flow, timeboxes, and pitfalls are editorially curated practice recommendations based on the listed sources.

Where to go next?

Paper illustration of a calibrated five-by-five risk matrix with response cards.
Decision Making
Risk Matrix

Sorts the found weaknesses by likelihood and impact.

Paper illustration for Failure Mode and Effects Analysis
Operations
Failure Mode and Effects Analysis

Also assesses each finding systematically by failure mode, effect and risk.

Finished the method guide?

Go to the profile for purpose, similar methods, and sources or continue to the next method in the catalog.

Go to profileMore methods