Understanding the Challenges in Red Team Exercises from Multiple Stakeholder Perspectives

Red team exercises evaluate an organization’s security by simulating attacks based on real-world adversary techniques. Red team exercises typically involve three stakeholders: the red team that conducts simulated attacks, the blue team that defends against them, and the coordination team that oversees the exercise. While several existing studies explored technical approaches to increase the efficiency of red team exercises, such as automating simulated attacks, the challenges faced by each stakeholder during the exercise are not well-studied. This study explores factors hindering the smooth execution of red team exercises through interviews with involved security professionals. In addition to the red team, the interview also targets coordination team members. As a result, we identified not only technical issues (e.g., difficulty in automating tasks), but also new non-technical challenges such as motivation gaps between stakeholders and a lack of adversarial skills and knowledge.