Configurable role profile
Emulate the adversary — inside authorized boundaries.
Red Team pathways develop authorized adversary emulation: planning an operation against declared targets, executing techniques under agreed Rules of Engagement, and reporting findings a defender can act on. Practice happens only in isolated range environments with explicit target allowlists, default-deny egress and an independent emergency stop. Assessment weighs the quality and reproducibility of findings and adherence to the Rules of Engagement, not the volume of activity generated.
CLIP · Red Team role profile
Illustrative view- 01 · Mission outcomeTest assumptions and expose weaknesses through controlled adversary emulation against declared targets.
- 02 · CompetenciesReconnaissance · Attack planning · Exploitation · Lateral movement
- 03 · Exercise activityWeb application intrusion
- 04 · EvidenceTechnique trace mapped to the emulation plan
Team-colour terminology varies by organization
Mission intent
The role's purpose and its boundaries.
Test assumptions and expose weaknesses through controlled adversary emulation against declared targets.
Core competencies
What this pathway develops.
Competencies are versioned and mapped to organizational, NICE, relevant SKKNI or custom frameworks without duplicating the underlying evidence.
- 01Reconnaissance
- 02Attack planning
- 03Exploitation
- 04Lateral movement
- 05Objective execution
- 06Reporting
Learning pathway
Progressive difficulty, evidence at every step.
- 01FoundationStructured learning and prerequisites.
- 02Guided labSupervised practice with checkpoints.
- 03Team labCoordination and handoffs within the role.
- 04Integrated exerciseMulti-team scenario under exercise control.
- 05AssessmentObserved performance and assessor adjudication.
In sequence: Foundation knowledge leads into a guided laboratory, then a team laboratory, then an integrated multi-team exercise, and finally an assessment that produces competency evidence.
Representative scenarios
How the pathway is exercised.
Web application intrusion
A controlled intrusion against a synthetic application, correlated with Blue Team detections on one timeline.
Assumed-breach campaign
Starting from a granted foothold to test detection and response depth rather than initial access.
Segmented-network objective
Reaching a declared objective across segmentation boundaries to validate control effectiveness.
Tools and environments
Capability categories, not a tool list.
Specific tooling is selected per deployment after security, licence and air-gap review. The categories below describe what the pathway needs to work.
- Isolated range topologies with declared target allowlists
- Adversary emulation and command frameworks under exercise policy
- Reporting and finding-management workspaces
Evidence of competence
What observable behaviour supports readiness.
A readiness claim for this role must trace back to these artifacts. Evidence freshness is tracked separately from current competence, so an expired record never silently counts as a current one.
How readiness is calculated- Technique trace mapped to the emulation plan
- Objective result with supporting artifacts
- Rules of Engagement compliance record
- Finding quality and severity rationale
- Reproducible report another operator can follow
Collaboration
Upstream and downstream handoffs.
No role operates alone. These are the relationships that make this pathway useful to the wider mission.
Findings flow to Blue Team through Purple Team validation
Engineering defects are routed to Orange Team for root cause and redesign
White Team authorises scope and can pause or stop the exercise at any point
Metrics
Operational and learning measures.
What the platform can measure for this role. Targets are baselined with each organization rather than claimed in advance.
- Authorized objective completion
- Technique coverage against the emulation plan
- Findings accepted after review
- Rules of Engagement violations (target: zero)
Map your roles to CLIP.
We will work from your approved role definitions and competency framework, not from ours.