Beyond probabilistic forecasting. We've retired the site, but we're still active professionally.
U.S.A.
Joined August 2012
- Tweets39
- Following34
- Followers5.1K
- Likes23
Red Team Journal retweeted
I think we've crossed an important threshold
ARTEX, Cairn and similar frameworks can now automate substantial parts of real intrusions. And as models become cheaper and more capable, the number of attacks is no longer constrained in the same way by human skills, time and attention
I wrote about what changed, why this is different from traditional automation, and what I expect to happen next
medium.com/@cyb3rops/the-tip…
Red Team Journal retweeted
Honestly, if you read just one thing today, please read the annual report from @NCSC
In a sea on hype, this is an honest, sensible view of the world! A great job from the team!
#UK #Cyber #NCSC #DefendAsOne #Security #AI
ncsc.gov.uk/collection/annua…
Red Team Journal retweeted
Here’s the thing about agentic attacks - the current incarnation won’t score on you with some l33t zero day…but they will check every possible “door handle” to see which one you forgot to lock
How many red team assessments has your organization gotten where they searched some internal knowledge repository/file share…etc and found reams of creds/secrets/tokens…and your organizational response was a collective shrug 🤷♂️ and nothing got fixed/improved to prevent it from happening again?
Agentic attack often target the security tech debt of every organization that has always been there - but just hasn’t been abused by an external attacker yet
A Learning Gap?
AI may let attackers learn from both detections and evasions, while defenders learn mainly from the attacks they see. That raises the possibility of improving defenses built on an increasingly incomplete picture of the threat.
gravel-anagram.com/a-learnin…
Whatever became of Red Team Journal's accumulated knowledge base?
It evolved and migrated.
gravel-anagram.com/the-ga-qu…
You might call this site 2026's spiritual successor of Red Team Journal's original ethos. Different time, different topic, similar lens.
gravel-anagram.com/
Why does it feel like not much decent strategic red teaming has been happening since we last engaged here? Anyone remember our Red Teaming "Law" No. 1?
We say we want to be challenged, but the hesitation often starts before a stress test or red team even takes off. People hold back, answers get polished.
Anyone else notice how quickly the temperature shifts when the real questions enter the room? Curious what you've seen.
I'm starting the week with one of our original cards (2014):
Red Teaming "Law" 26 ("Sneer"): Never regard your adversary with contempt. No good can come of it. The superiority you feel is never worth the surprise that invariably follows.
Keep on red teaming, my friends!
ALT Red Teaming Law 26 ("Sneer"): Never regard your adversary with contempt. No good can come of it. The superiority you feel is never worth the surprise that invariably follows.
Here's the first new Red Team Journal "law" card in a few years!
Watch for a new card weekly. If the response is positive, we might even open a version of the site just to host the cards, which, incidentally, will need to be renumbered as we likely drop some and renumber others.
ALT Red Team Journal Red Teaming "Law" Card 55 ("Endgame"): The naïve player doesn't realize the game was over four moves ago. Checkmate? Impossible! I still have a knight and a queen on the board!
If you remember the old Red Team Journal "Laws" and Cards, chime in. Would you be interested in some new ones?
(It feels like we don't get much traction on this platform, but then again, we don't engage much here anymore.)
And "Law" no. 1 often leads to no. 26 ("Sneer"): "Never regard your adversary with contempt. No good can come of it. The superiority you feel is not worth the surprise that invariably follows."
Yes, we retired the site. Yes, we have thoughts about what's going on now. And yes, Red Teaming "Law" no. 1 still retains its top position:
"The more powerful the stakeholders, the more at stake, the less interest in red teaming."
(4/5) The 5-Point Risk Scan (in reverse order):
4. The Warning: If this goes amiss, what's the first sign?
(5/5) Something from the old days of Red Team Journal that never goes out of style . . .
The 5-Point Risk Scan (in reverse order):
5. The Penalty: What's the downside if we're wrong?