Red Team Framework RTF

Adrian Sanabria introduces the Red Team Framework (RTF), an open methodology developed to bring structure, consistency, and objective-based measurement to adversary emulation engagements and collaborative offensive security operations.

[03:00] Sanabria begins by clarifying foundational industry definitions, distinguishing between vulnerability scanning, compliance penetration testing, red teaming, and purple teaming. He critiques the conventional compliance-focused checklist model, pointing out that automated Nessus scans provide little insight into whether an enterprise can withstand targeted attacks. He argues that red team operations must be driven by business-aligned objectives [17:03], such as evaluating lateral movement restrictions, measuring the time required to pivot from web systems into financial records, or assessing domain controller defensibility.

[31:06] The presentation outlines the core stages of the RTF, from pre-engagement planning and threat modeling to execution and collaborative debriefing. Sanabria stresses the importance of eliminating the adversarial "gotcha" mentality, advocating that red teams actively partner with blue teams to develop defensive roadmaps and improve detection visibility. He explores key operational metrics [51:28]—including time-to-detection, time-to-containment, and lateral movement friction—and highlights how automated breach-impact assessments [01:03:42] allow organizations to continuously evaluate security postures against evolving adversary tradecraft.

(AI summary — Gemini Flash)