c4.11 Establish a red team
A red team thinks like an adversary: it tries to exploit vulnerabilities, expand laterally, and measure how far an attacker could get — then explains how, so the gaps get fixed. This is a core component of cyber resilience.
Implementation guidance
Think like an attacker
To find weaknesses before adversaries do, a red team of specialists attempts real exploitation — not just running scanners. They exploit vulnerabilities, analyze impact, and move laterally to see how far an attacker could reach, then explain to the defenders how they did it so the vulnerabilities and misconfigurations are remediated. Red teams often build components that emulate malware behavior and deploy them in the target environment. The name comes from military exercises where a "red" force plays the enemy.
Being clear-eyed about what could happen if your organization is targeted is essential preparation — the same mindset as resilience planning. The red team strengthens cyber resilience: the ability to keep operating despite attacks.
AWS-aware attack simulation tools
- Amazon GuardDuty Tester — generate findings to validate detection.
- AWS CloudSaga — simulate documented AWS CIRT security events.
- Stratus Red Team — granular, cloud-native attack techniques.
- Pacu — an open-source AWS exploitation framework.
Commercial breach-and-attack-simulation platforms (for example AttackIQ, SafeBreach, Cymulate) are also available. Always run these in non-production or isolated environments and within AWS penetration testing policy.
How to validate
- Do you have a red team (or engage one) that attempts real exploitation, not just vulnerability scanning?
- Are findings fed back to defenders and remediated?
- Do you exercise detection and response with AWS-aware attack simulation tools in safe environments?
Threats addressed
- Without adversary emulation, exploitable attack paths and the true blast radius of a compromise stay unknown until a real attacker finds them.
AWS services
Amazon GuardDuty