The red seat

The offensive side of the loop earns its place by thinking the way an attacker does, which is rarely the way a defender expects. An attacker takes the path of least resistance: a weak password beats a clever exploit, a legitimate admin tool beats custom malware, and human trust gives way before technology does. An attacker can afford patience, since low and slow evades more than loud and fast. An attacker adapts, needing only one way through where the defence has to hold every door. And an attacker is fixed on the objective, not the technique: stolen credentials that reach the target beat root on a box that does not.

What the red seat brings to a session is not the full engagement but the honesty of a real move. The depth, the reconnaissance, the tooling, the tradecraft, lives in the red repo. Here the question is narrower: which move, run for real against live defences, shows the most.

That choice has a few shapes. Emulating a named adversary that actually targets the sector tests whether the defences catch the threats the organisation is likely to meet rather than a generic one. Starting from assumed breach, after the foothold is already granted, tests the part many exercises skip: what the defence sees once the attacker is already inside, where visibility is usually thinner than at the perimeter. Full scope, nothing excluded within the rules, is the most realistic and the most expensive, and it surfaces the uncomfortable findings that narrower tests never reach. Focused testing, one control or one detection as the subject, buys detailed feedback on a single investment at the cost of saying nothing about how it sits with the rest.

None of it is honest without boundaries agreed first. Written authorisation, not a verbal nod, however senior the nod. A named scope, with everything outside it off-limits whatever the engagement turns up. Rules for the data encountered, a stop signal known to everyone, and a line, never crossed, between simulating harm and causing it: real fraud, real destruction, real harm to people stay criminal whatever the objective on the board says. Those conditions are what let the red seat press hard without the work becoming the thing it imitates.

Last updated: 4 July 2026