Red Team Engagement Lifecycle: Planning to Debrief

A red team engagement is not a penetration test with a cooler name — it's an adversary emulation exercise scoped against specific objectives (a "crown jewel" system, a detection capability, an incident response process) rather than exhaustive vulnerability coverage. The lifecycle matters: scoping and rules of engagement (what's explicitly out of bounds, who holds the "get out of jail free" authorization, how to handle unexpected discoveries like evidence of a real prior compromise), threat intelligence-driven planning (which real adversary are you emulating, and why), execution, and — critically — the debrief.

An engagement that ends with a report nobody acts on has failed regardless of how many objectives were achieved. The debrief and purple-team session is where the actual security improvement happens.