Skip to main content

Configurable role profile

Emulate the adversary — inside authorized boundaries.

Red Team pathways develop authorized adversary emulation: planning an operation against declared targets, executing techniques under agreed Rules of Engagement, and reporting findings a defender can act on. Practice happens only in isolated range environments with explicit target allowlists, default-deny egress and an independent emergency stop. Assessment weighs the quality and reproducibility of findings and adherence to the Rules of Engagement, not the volume of activity generated.

CLIP · Red Team role profile

Illustrative view
  1. 01 · Mission outcomeTest assumptions and expose weaknesses through controlled adversary emulation against declared targets.
  2. 02 · CompetenciesReconnaissance · Attack planning · Exploitation · Lateral movement
  3. 03 · Exercise activityWeb application intrusion
  4. 04 · EvidenceTechnique trace mapped to the emulation plan
Versioned profileExplicit permissionsAssessment criteria

Team-colour terminology varies by organization

CLIP maps each label to an approved, versioned role profile with explicit responsibilities, permissions, Rules of Engagement and assessment criteria. The colour itself never establishes authorization.

Mission intent

The role's purpose and its boundaries.

Test assumptions and expose weaknesses through controlled adversary emulation against declared targets.

Activity is confined to declared assets bound to the exercise authorization context
Tooling and capability tokens are least-privilege and time-bounded
Production addresses, credentials and datasets are rejected by the platform

Core competencies

What this pathway develops.

Competencies are versioned and mapped to organizational, NICE, relevant SKKNI or custom frameworks without duplicating the underlying evidence.

  • 01Reconnaissance
  • 02Attack planning
  • 03Exploitation
  • 04Lateral movement
  • 05Objective execution
  • 06Reporting

Learning pathway

Progressive difficulty, evidence at every step.

  1. 01FoundationStructured learning and prerequisites.
  2. 02Guided labSupervised practice with checkpoints.
  3. 03Team labCoordination and handoffs within the role.
  4. 04Integrated exerciseMulti-team scenario under exercise control.
  5. 05AssessmentObserved performance and assessor adjudication.

In sequence: Foundation knowledge leads into a guided laboratory, then a team laboratory, then an integrated multi-team exercise, and finally an assessment that produces competency evidence.

Representative scenarios

How the pathway is exercised.

  • Web application intrusion

    A controlled intrusion against a synthetic application, correlated with Blue Team detections on one timeline.

  • Assumed-breach campaign

    Starting from a granted foothold to test detection and response depth rather than initial access.

  • Segmented-network objective

    Reaching a declared objective across segmentation boundaries to validate control effectiveness.

Tools and environments

Capability categories, not a tool list.

Specific tooling is selected per deployment after security, licence and air-gap review. The categories below describe what the pathway needs to work.

  • Isolated range topologies with declared target allowlists
  • Adversary emulation and command frameworks under exercise policy
  • Reporting and finding-management workspaces

Evidence of competence

What observable behaviour supports readiness.

A readiness claim for this role must trace back to these artifacts. Evidence freshness is tracked separately from current competence, so an expired record never silently counts as a current one.

How readiness is calculated
  • Technique trace mapped to the emulation plan
  • Objective result with supporting artifacts
  • Rules of Engagement compliance record
  • Finding quality and severity rationale
  • Reproducible report another operator can follow

Collaboration

Upstream and downstream handoffs.

No role operates alone. These are the relationships that make this pathway useful to the wider mission.

  • Findings flow to Blue Team through Purple Team validation

  • Engineering defects are routed to Orange Team for root cause and redesign

  • White Team authorises scope and can pause or stop the exercise at any point

Metrics

Operational and learning measures.

What the platform can measure for this role. Targets are baselined with each organization rather than claimed in advance.

  • Authorized objective completion
  • Technique coverage against the emulation plan
  • Findings accepted after review
  • Rules of Engagement violations (target: zero)

Map your roles to CLIP.

We will work from your approved role definitions and competency framework, not from ours.

Red Team Training Pathway | CLIP