Glossary
Red Team
A red team attacks a system the way a real adversary would, rather than reviewing its design on paper — attempting to bypass authorization, escalate privileges, or find a path a threat model didn't anticipate. This surfaces a category of problem that design review tends to miss: gaps that only become visible once someone is actively trying to exploit them, rather than reasoning abstractly about what might go wrong.
A red-team exercise is only as useful as what happens to its findings afterward. Findings that get fixed, tracked, and re-tested compound in value over successive exercises; findings that are noted and left open make the exercise mostly theater.