You’ve Gained +2 Perception! Leveling Up Your Red Team with a New Maturity Model

The talk opens with an analogy to the SPECIAL stat system in the Fallout games, using it to frame how a red team can plan its own progression deliberately rather than by chance. The speakers, who lead red team and threat simulation work at Humana, explain how a capability maturity model works. They trace the idea from software engineering, where it runs from being able to perform a task, to repeatable outcomes, documented processes, measured performance, and continuous improvement.

The middle of the talk covers their model, which builds on an earlier lightweight red team model and reorganizes it into a common format. It has four categories (people, processes, technology, and program) and 27 subjects. The speakers stress that teams do not need to reach the top level in every area, that the model suits internal staffed teams, and that small teams have to choose where to invest. Examples include relationships with defenders and legal, documenting methods so work is repeatable, building tooling that fits the organization and is tested, and sharing results with leadership.

For implementation, the team described having each member score current and target levels independently, then consolidating the answers and turning the gaps into a prioritized backlog. The practical takeaway is that a maturity model gives a red team a shared picture of its readiness and a common language for reporting to executives. The model and slide template are available on the speakers' GitHub and a companion website.