Red Team Programme Health Check
Vulnerability Management
S4 Applications can help your business review its ability to protect assets and respond to cyber threats.
Work through each question honestly from your current programme’s perspective.
How to use this Assessment:
[FLAG] = Indicators commonly associated with offensive programmes hitting the EDR Detection Wall (early-stage telemetry triggers, immediate payload burn, or static/behavioural flags).
[CONSIDER] = Key tactical or operational areas worth reflecting on with your team or external partners.
Use the flagged items as a conversation starter during your next team debrief or strategy alignment session. Use the results as a starting point for a conversation or REFLECTION with your team, or with us.
Where to start?
To get the most out of your Red Team programme health check we have combined four pillars to help identify the automated processes, responsibilities, priorities and integration needed to ensure nothing gets missed.
The Four Pillars:
- Engagement outcomes
- Toolset & Tradecraft
- Understanding the defensive environment
- Programme alignment and Stakeholder confidence
It might also help if you read our blog when you are going through the checklist “Is your Red Team getting burned on arrival?”
The 4 pillars of our Red Team programme health check
Pillar 1 - Engagement outcomes:
FLAG
- Our red team engagements regularly end with detections at the initial access or execution stage, before any lateral movement occurs.
If this is a recurring outcome, the toolset, not operator skill is likely the limiting factor.
FLAG
- Engagement reports repeatedly identify the same early-stage detection findings and rarely surface risks beyond initial access.
Shallow findings often indicate the simulation isn’t surviving long enough to test what matters.
CONSIDER
- We struggle to demonstrate to leadership what the red team programme has validated about our real security posture.
If findings don’t reach business critical assets, the question the board is asking goes unanswered.
CONSIDER
- Our read team hasn’t been able to simulate the full attack lifecycle, initial access through to objective in the past 12 months.
A programme that never reaches objectives is not producing the intelligence it was commissioned to deliver.
REFLECTION
- We have clearly defined what “success” looks like for a red team engagement beyond “did we get flagged?”.
Objective based success criteria drive more meaningful engagements.
Pillar 2 - Toolset & Tradecraft:
FLAG
- Our standard toolset relies on widely-used community offensive tools that haven’t changed significantly in the last two years.
Tools that are well-known to red teamers are equally well-known to EDR vendors and threat intelligence teams.
FLAG
- We primarily manage detection evasion through obfuscation, payload variation, or packing — rather than changing the underlying execution behaviour.
Modern behavioural detection sees through surface-level variation; the execution pattern is what gets caught.
FLAG
- Our C2 framework is deployed with default or near-default configuration profiles.
Default C2 configurations are among the most thoroughly documented detections in major EDR platforms.
CONSIDER
- We haven’t formally assessed our toolset against the specific EDR platform(s) deployed in our target environments.
- We haven’t formally assessed our toolset against the specific EDR platform(s) deployed in our target environments.
Toolset validation against the target’s actual defences should be part of every engagement preparation.
REFLECTION
- We regularly review and update our offensive toolset based on the maturity level of target environments, not just operator preference.
Toolset selection should be driven by the defensive environment, not habit or familiarity.
Pillar 3 - Understanding the defensive environment:
CONSIDER
- We understand which EDR platform our target environment uses and how it’s configured (prevention vs. detection mode).
- We understand which EDR platform our target environment uses and how it’s configured (prevention vs. detection mode).
The same toolset behaves very differently against different EDR platforms and configurations.
FLAG
- We treat each target environment as essentially the same in terms of toolset selection and execution approach.
A one-size-fits-all approach to tooling doesn’t reflect how a real adversary would adapt to the specific environment
REFLECTION
- We regularly benchmark our tradecraft against the detection capabilities of the EDR solutions our clients or target environments deploy.
Ongoing benchmarking is what separates programmes that stay ahead from those that don’t.
Pillar 4 - Programme alignment and Stakeholder confidence:
CONSIDER
- Our team understands the difference between signature-based, behavioural, and memory-based detection — and how each affects our execution approach.
Understanding detection methodology is a prerequisite for making informed toolset decisions.
CONSIDER
- Security leadership understands what the red team programme does and doesn’t test for.
- Security leadership understands what the red team programme does and doesn’t test for.
Misaligned expectations between programme capability and stakeholder assumptions create risk.
FLAG
- Our red team findings are used to make genuine security investment decisions not just to satisfy audit or compliance requirements.
Programmes that exist primarily for compliance rarely produce the depth of findings that drive real improvement.
REFLECTION
We can demonstrate that our red team programme tests our defences against adversary tradecraft, not just known tool signatures.
The difference between testing against known tools and testing against sophisticated behaviour is significant.
CONSIDER
- We’ve had a conversation in the past 6 months about whether our current toolset is right for the environments we’re testing.
Toolset review should be a standing item on the programme agenda, not a reaction to failed engagements.
Next Steps
Once a team reviews their FLAG and CONSIDER items, the following are some actionable next steps structured by immediate, operational, and strategic horizons:
Immediate Next Steps (Triage)
Calculate Your Flag Ratio: Count the total number of FLAG items selected. If 3 or more are checked, your initial access pipeline is vulnerable to instant EDR burn. Map Flags to Execution Phases to identify exactly where in the kill chain the detection wall is strongest.
Operational Next Steps (Team & Process Adjustments)
Reflect on the results with an internal workshop with your red team to determine whether your team is currently constrained by the Custom R&D Drain or the Public Tooling Trap.
Strategic Next Steps (Management & Tooling)
Evaluate Commercial vs. In-House Tradecraft (Buy vs. Build) to assess whether continuing to engineer custom evasion in-house is cost-effective, or if adopting specialised, commercial offensive tooling (like Outflank Security Tooling / OST) would allow you to bypass the EDR detection wall without sacrificing operational hours.
If you are interested in seeing a product that could help with any or all of the above 4 pillars, then we would love to talk with you.
To learn more about our products and their key features talk to an expert at S4 Applications.