Red Teaming: TTP-Based Attack Simulation

A penetration test searches a clearly scoped target system for as many exploitable vulnerabilities as possible within a fixed timeframe; breadth takes precedence over stealth, and the defenders are usually informed. Red teaming is objective- and scenario-driven: it emulates a specific threat actor, operates covertly and primarily measures detection and response capability – the defending blue team is typically not informed in advance. Purple teaming deliberately brings both sides together: testers and defenders work collaboratively to improve detection and response in a targeted way. The three approaches do not compete with each other; they address different maturity levels and different questions.

Red teams structure their operations along the tactics, techniques and procedures of real adversaries. MITRE ATT&CK is the established, publicly accessible knowledge base for this: the Enterprise matrix maps observed adversary behaviour to tactics (the “why” of a step) and, beneath them, to concrete techniques. In version v19 (April 2026), the former “Defense Evasion” tactic was split into “Stealth” (TA0005) and “Defense Impairment” (TA0112); the Enterprise matrix now comprises 15 tactics. ATT&CK serves both the planning of realistic scenarios and the complete mapping of executed actions to detection logic – making the coverage of a test transparent and traceable.

A red team operation follows the lifecycle of an attack: reconnaissance, initial access, privilege escalation and lateral movement, and finally achieving the agreed objectives (often defined as “flags”). Because initial access is resource-intensive and time-critical, it is increasingly replaced by assume-breach scenarios: the test starts from an already compromised point – such as a standard workstation – and specifically examines how far an attacker can spread internally before being detected. This shifts the focus from the perimeter to internal resilience.

Threat-led testing combines red teaming with concrete threat analysis of the entity under test. For the financial sector, the DORA regulation (EU) 2022/2554 makes it mandatory: under Art. 26(1), identified financial entities must conduct a threat-led penetration test (TLPT) at least every three years, and under Art. 26(2) on live production systems supporting critical or important functions. The operational foundation is the ECB's TIBER-EU framework, aligned with DORA on 11 February 2025; in Germany, Deutsche Bundesbank implements it as TIBER-DE (version 4.0, July 2025), while BaFin carries out the supervisory tasks. Delegated Regulation (EU) 2025/1190 of 13 February 2025 specifies scope, methodology and phases – the active red team testing phase must last at least twelve weeks.

The value of a red team exercise is not measured by the number of vulnerabilities found, but by how well the defence responded. Meaningful metrics include time to detection, time to containment, and which of the tactics and techniques exercised actually triggered alerts. By mapping the attackers' actions to MITRE ATT&CK techniques, detection gaps can be made systematically visible. Instead of a snapshot, this produces a robust assessment of the organisation's actual detection and response capability.

A covert red team operation is ideally followed by a purple teaming phase in which testers and defenders jointly walk through the actions performed. This is exactly what Delegated Regulation (EU) 2025/1190 prescribes for the closure phase of a TLPT: the blue team and the testers replay offensive and defensive actions and work through the identified weaknesses in purple teaming exercises. The goal is not to evaluate individuals, but to specifically improve detection rules, processes and response workflows – so that every finding turns into a concrete hardening step.