Offensive Security Strategies — Red Teaming and Adversarial Readiness | Security Boulevard Podcast Ep. 14

Welcome to Security Boulevard, the cybersecurity podcast from the Futureum Group. Our episodes explore a variety of topics within cybersecurity and the technologies that drive it. com, the Security Boulevard, YouTube channel, text on tv, and all of your favorite podcast platforms.

Before we begin, let's meet today's panel, starting with Fernando. Fernando, it's good to see you again. I'm good to see you, sir.

Happy New Year. Uh, uh, so Fernando Edra, I'm, I, I, I lead cybersecurity research over at here at Switzer Earth. So, Awesome.

And also joining me on this happiest of New Year's is Mitch Ashley. Mitch, it's good to see you as well. Best way to start off 2026 with a podcast.

Gotta go for that. So, Mitch Ashley, uh, I lead the software lifecycle engineering practice at the Futurum Group. Awesome.

And of course, I'm Tom Hollingsworth event lead for all things related to security at Tech Field Day. Let's jump into today's episode, because one of the things that I thought was kind of interesting is we've seen a rise over the last few months in more targeted offensive style security. Like we, we, when we think of security, you know, we still have maybe that old school mentality of a castle walls with a moat and some alligators, and we're gonna keep the bad people out.

But we've also seen, in a way, uh, kind of an expansion of that, whether it's the red teaming of our own assets to make sure that we're being hacked by friendly people, or in some cases, uh, researchers who said, you know what? I'm just gonna take the war to the bad people out there, or who I perceive to be the bad people. So I wanted to spend a little bit of time talking with the guests today about that, because I think it's a fascinating way to look at it way when we play on the defensive a lot, it, it feels good, right?

Because we, we defeat these attacks. We make sure that people aren't able to get inside of our organization and steal data, cause chaos, whatever. But let's take it from the red team perspective.

Now, why is it important in your mind, to have a group of people inside your organization that's dedicated to, you know, trying to pick the locks and guess the passwords and expose the areas that are maybe appealing to folks who would wanna do harm? Uh, where do we begin? Uh, um, I would argue that this is one of the things that personally attracts me so much to cybersecurity as a topic, which is this notion that I can't think of another technology topic where there is adversarial intent, right?

Uh, you, it's not as if one database, uh, is going to, if, uh, an external is going to log in and reconfigure your database because they don't agree with the settings that you've done for your arding or something, right? Cybersecurity is that area where I, I, you know, how analysts hate the word unique. I can't think of another area in technology where there is adversarial intent, uh, uh, that there isn't, there is an intelligent adversary on the other side of this trying to do bad things or trying to do things that you don't want done to your environment, right?

And, and this is fascinating because it then introduces, uh, a dynamic that it's not, it, it's about you getting ready for what you think that badness looks like, and then testing it to make sure, right? Uh, the, the, the thing I used to, I mentioned that many years and many pounds and, and, and better knees ago, I used to do martial arts, right? And in martial arts, one of the things is that we learn not just to hit, we learn to defend.

But you know what, at some point you get tested, someone is going to kick your face, and if you're, and if you're not there, you're gonna to get kicked. Same thing happens here, right? So, uh, there, there's a few more things, but I don't wanna monopolize the conversation as usual, and that'll bring economics in a little bit.

But What's the phrase Is every plan's great until you get kicked in the face or Entice it? Everybody has a plan until you get punched in the mouth. That's what it's, yeah.

Um, just kind of thinking about this, both from a, having been a practitioner and, uh, run red teams before, and also from an analyst perspective, the, I think one of the best things about doing red teams, and now we can, you know, use this with ai, uh, in addition to help us do this, but it puts our ourselves in the, in the head space of an attacker and trying to think of novel ways or validating our, do our procedures as our technology is, uh, is our automations, all the things that we think we have in place that are gonna be great when a hurricane comes. Well, let's pretend we have a hurricane so that we can see when it really does happen, or we think it, it, the unexpected happens. Let's try to think of those unexpected novelty kinds of attacks and situations that we might run into.

So it, it's extremely valuable because it's not just saying, okay, we built the walls and the moats and all the things we think are gonna protect us. Let's just wait and see what happens. You know, it's kinda like you gotta read the play while it's happening during the game.

So let's practice some of those situations so that when it comes up, we're ready for it, or at least we think we're ready for it. And usually that'll help us in our response. So I think it's extremely valuable to do, and I think more mature security teams do.

The red teams, not just with themselves, but also with software teams, platform engineers, et cetera. So this really is a cross-functional activity. And let's just add one more nuance here that, uh, uh, I think that you, you're absolutely spot on, and we can say that there is a continuum of offensive suit.

There's a continuum of testing, right? Uh, uh, Tom brings up the, the, the red team. So red teaming is, okay, you have people in your organization whose mandate is break in, right?

Or, or or under whatever, under whatever rules of engagement they have, right? Uh, one of the things we've observed in the markets in the past little while is the, the rise in, uh, breach and attack simulation and the rise. Uh, uh, some people refer to it as integrated security testing as well, right?

Uh, it bleeds into control validation, right? Do I have, uh, do I have the right controls deployed the right way, right? Uh, um, they're a vendor, like a discern security or safe or, or, uh, or others, right?

And the notion here being that, okay, you said you did it right. How well did you do it? Right?

And, and I think that red teaming is a phenomenal aspect, but it's just one of those, sorry, that cough. So I like this idea of the red team in theory, where I tend to fall down with it is it's either too restricted or it's too chaotic. And, and Fernando, you bring up this really good point about rules of engagement, right?

Like, like sometimes you kind of have to set these baselines, and if you've ever listened to, uh, Jack Reciters Darnet Diaries, like every once in a while he'll have like a tails from penetration testers and some of the stuff that they kind of get up to. But like, you know, for me, you know, a an easy ground rule is you can't use your employee credentials to do things like access the data center, right? Like, why would I be able to get that unless I was able to obtain it from like, lifting somebody's key card in a bar or something like that.

But I also think that if you set the rules of engagement too narrow, then you're basically what you're doing. 'cause I've seen this in, in print in a lot of other places, it's like, well, you're only allowed to test our security at the gate, and you're only allowed to go through this gate, and you're only allowed to go through the gate between these two hours. When I have my best security people working, it's like, yeah, but what if I wanna come in at three in the morning when the guy's half asleep?

Like, like that? That's kind of one of those things where you're like, wait a minute, this is not how a real person would would think. But on the flip side, you cannot let it be too chaotic.

'cause it's like, oh, yeah, well, I just, you know, uh, broke out a window in the data center and snuck in, and the therefore your physical security sucks. It's like, yeah, but the data center was on the sixth floor. Like, nobody would, somebody would've seen you, or like, you, you have to kind of play by a certain set of rules because what you're really trying to do do is you're trying to improve things.

Like, like I think of the scene in the matrix where, you know, where Morpheus is beating up Neo, but it's not because he's trying to win the fight, it's because he's trying to make him a better fighter. It's like, you know, do you really think that's area you're breathing? Like, to me, that's the punchline of a red team.

It's like, did you not think that I would bring a set of lock picks with me? Hmm. Well, our teams don't have to be just a, a wild game of chaotic game of capture the flag.

Um, I think you're right. There is a set of scenarios that you run wanna run and a set of things that you wanna test. Now, you may end up testing things you didn't plan to in some of those scenarios, but I think that's also a place where you can use AI to feed in your scenarios.

We're testing in our red team, what are we not thinking of? So try to think of those things that we're, we aren't, that are, are areas that would be important to test, but you may be interested in response, time of incident response, you may be are instead, are we collecting the right data? So when we have to diagnose and, and investigate what is happening, we can actually do that.

And where are there gaps in our visibility into it? Is it things that might be in our observability system? Is it things that might be in our governance or, uh, other aspects of how you operate?

So it's as much a test as the operations, the policies, as it is the people in the process and the technology. So, so I think that we're, we're diverging here. Uh, like I, I think that there's a nuance here.

What we've been describing so far, I agree, uh, is basically a penetration test, right? It's bound, uh, or it, it, it has boundaries, right? Uh, and red teaming, at least from my perspective, is more, is a little more free flowing, right?

It's look inside our organization, let's say that I have a security team of, of, of 20 people, right? And I say, okay, the three of you are my red team, right? If you remember, um, uh, world War Z or that, I mean Canada, right?

Remember that, that the, they have the, the, the, the odd man out in the group, right? The, the, the, they, they talk about who's thinking about stuff that we're not thinking about, right? That's the mentality I think about for a red team.

It's like, okay, the 17 of us, we're building defensive and, and, and we're doing all these things. The three of you, you tell us where we're wrong, you tell us where we're breaking, what we're missing. And in that mentality, I would rather have those three people with as much freedom as possible.

It's different than a penetration test, which might be a checkbox element, or maybe not just a checkbox might be a, a, a, a critical step in a proj, in a, in an implementation process where, okay, this thing needs to be validated before the project gets shipped, right? I, I see red teaming as being a little bit more free flowing. So Tom, I would politely disagree that you can't use internal credentials.

It's, look, assuming that somebody has internal credentials, what can they do? Right? And then you go from there.

So the, the, the, the boundary between where does a red team, where does a penetration test, a vulnerability assessment, a penetration test, and the red team, uh, it's a continuum. I would say. I, I, I can see your point.

I, I, I think that, you know, a lot of people tend to use that terminology in, in interchangeably, and they shouldn't, you know, they think that a vulnerability assessment is a red team performing a penetration test, but in fact, it's, there's subtle nuance, right? You are, you are attempting, you know, here I'm testing a specific thing. Whereas, you know, maybe in general, the, the offensive sides idea is to constantly be on alert to, you know, check things.

I, you know, like the, the Netflix Chaos Monkey, right? I'm always looking to break things to see how well you've built them to make them survivable. But when you get to that point, you know, in the case that it's somebody that's employed by a company, it almost kind of falls over into the other part of offensive security, which is, if I know that I'm being hacked by somebody, or if I know there's a group that's targeting people like me, why don't I go after them?

And that's kind of one of the things we've seen towards the end of 2025 was, you know, some talks that are being given by people at overseas, uh, conferences where it's like, yeah, I, uh, I basically went out and collected a whole bunch of information on un SAB individuals, and I'm gonna give it to the FBI and, and, and then I'm gonna delete everything that I did so that, you know, nobody can get ensnared by it. But like, you know, we, we've seen that before, right? Like, um, was it Marcus Hutchins was, was one of the greatest offensive, um, people of all time because he effectively black hole and exploit before it could break wide by registering a domain name that was a kill switch.

Of course, when he did that, that led to a whole bunch of other problems, which is usually what happens to these offensive security researchers is they have to tow a very fine line between I'm doing this for the right reasons, and now I've become an enemy to the people that I'm attacking. And if that's a state sponsored organization, well, now you're on somebody's list. Like, like where is that line for people?

When does the red team for my company become, well, now I'm just gonna go attack people that are the bad guys. Well, I think you have to be very cautious about going and attacking the bad guys. Mm-hmm.

Right? I mean, in nation states can do that. They have the infrastructure, they have the wherewithal to do it.

You as an corporation or enterprise or whatever entity you are, you really wanna go sort of poking the bear. And now, because they're gonna respond, right? If you really do something, are gonna do something serious, you're like to get a response.

So I, I'd be very, I'd be very thoughtful about how I would coach Tackle, but Mitch gets you the headlines that that's the thing, right? Is I wanna be hacker famous, I wanna be the one who brought down the, you know, fancy gummy bear team this time that was like, you know, stealing Bitcoin from people. Um, like that, that's, how can you avoid the, the lure of that, Meanwhile, while you're fixing your credit report and everything else that, uh, they compromised because you got their attention, you know, it isn't worth it.

True. Yeah. This is where, let's bring in economics.

This is where the, the Dunning Kruger effect comes to mind, right? That's the, the thing that in the context that I think that I, I, I wholeheartedly agree with Mitch, that you need to be exceedingly thoughtful about this, and you need to, uh, because the expectation that you are going to bring down a massive state sponsored, uh, campaign, um, seems, um, ambitious, right? And, uh, I think that there is a, um, uh, yes, that, that, I I think that, that going after, uh, going after, uh, malicious actors, uh, yourself does have benefits in terms of yes, you're, you're, you're attacking, uh, someone who is doing harm to your, to you or your community.

You are learning potentially new techniques, but be very careful about what you're doing because you are stepping into, uh, a world that you may not be ready for to bring my favorite movie quote from, uh, untouchable 1987. You are bringing a knife to a gunfight, right? Uh, we wanna be exceedingly careful with that.

I, I would, uh, this is the kind of thing where we, where we talk with, with more junior practitioners, Hey, should I be doing this? This is one of the areas where I'm like, you really, really wanna think this through many times over? And then probably the answer should be no.

But that's, I be, Might be bringing a knife to it. Rpg Yeah. Fight.

So be careful Today's, well, not only that, but if you're doing it on behalf of a company, you've opened that company up to liability. That's why you typically see these groups, if they're anybody, it's usually single people or, uh, like their own little collective, if you will. Um, simply because, like, they may not be able to shut you down and ruin your credit to Mitch's point, but they can have their government file a, you know, a lawsuit on your behalf against the company that you're working for.

Like, and that's one of those weird things of like, you know, where does the problem actually lie? Because I, look, we've all looked at the firewall logs, like, why is this guy in, in, uh, some eastern European country trying to SSH into my server? I know I'll do this to 'em.

It's like, no, you can't do that. Or you, you have to think about the rules of engagement for that, because it can escalate very quickly. And, and I think that most people, they, they love the idea of punishing someone.

They do not like the idea of getting punished. And, and that's usually what happens is, is you will, you will turn around like, Hey, take that energy and use it to defend yourself better. Like, like, take what you're doing and turn it on your own firewall and go, okay, I'm gonna find all of the little problems in here and, and you'll, you'll be better off for it.

But yeah, once you've poked the, the bear or the fancy whatever it is this week, like you are in for a world of hurt, I mean, to, to reference that point that the hacker Martha Root, the reason why they appeared on stage at this conference in a Pink Power Ranger outfit was 'cause they really didn't want people knowing who they were, because it doesn't take much for you to figure that out and start causing all kinds of havoc. You know, one things I wanted to bring up is red teams can also, I, I, I'm sure you're thinking about this, Fernando Red teams can also look ahead and say, Hey, I know we're using AI right in these productivity tools with 365, and, but we're also, maybe we're doing some experimentation with LLMs, maybe we're building some early agents, maybe we're really going gung-ho on doing some of those things. And you can use your red team of like, well, let's, let's take a break from the day to day.

Let's talk about new things that we're doing and what that attack surface looks like, and how would we attack it based on what we know? And maybe that'll surface some shortcoming, some big things we need to address now. So maybe you need to go to the agent control plane and see if that's something you can thwart the guardrails, maybe the kill switch there.

You need to kill switch for certain kinds of agents. Um, you know, of course. And then there's prompt injection and prompt poisoning and all kinds of good things to go examine that also educates you, but you gets you thinking ahead of before somebody in leadership says, Hey, now we need a policy for X, Y, and Z with a ai.

Well, we've already been working on that, you know, we're, we're ahead of the game there, at least we're, we're partially ahead of the game. Whatcha thinking about in that space, Fernando? Yeah.

Well, I, I think it's Tuesday. I'm thinking it's Tuesday. Like, okay, we're not recording on a Tuesday, but I think it's a Tuesday, right?

In the context of yes, it's now part of the organization's attack surface where I would be, um, where, and, and I, and I think you are right, that red teams need the, they need the skills and the knowledge to know their, their environment and attack their environment with current tech against current, uh, expected threats, but also against, Hey, what else is going on out there? To your point, ai, right? And the, the, the thing that I would be, um, I would be cautious of is to go back to Tom's point, rules of engagement, right?

If, if the, the, the, the red team, if the, the, if the red team is attacking an AI environment, right? And is highlighting all kinds of flaws about that AI environment, right? But that AI environment is not in production yet, right?

That's kind of like a of, of, uh, being not a very good team player. I'm not sure how much we can use, uh, uh, expletives in, in, in this podcast, right? But, uh, uh, it, it, it's one thing for organizations to have an understanding of the, the, the threat environment for what they're building.

It's another thing when once they put it into production, right? Which brings up the, one of my, the things that I think people should pay particular attention to, which is threat modeling, right? So, uh, uh, when you think about rules of engagement, right?

I think that one of the key contributors to that, to the, to that set of rules is what is our threat model? What it's, that we're concerned about from one perspective. And that threat model might be, uh, might be guiding what we're doing.

That threat model might be incomplete. And this is where the knowledge from the red team and others about, Hey, look, your threat model worries about A, B, C doesn't worry about D through Z, right? Uh, um, that's an very important contribution that I think red teams can, can, can have an insight on, but at the same time, they should only, uh, uh, do the red teaming stuff in the system that is expecting that, right?

I think that, uh, that, uh, to go back to martial arts, like if I'm, if I'm just practicing a simple block, right? And someone, uh, complains that, look, you're not, uh, you're not protecting, again, you're not protecting your shins, whatever. Look, no, I'm, I'm practicing my blocks, right?

Let's, we'll deal with that later. So yes, I agree with you a hundred percent, uh, with the caveat that people should be nice to each other. I, yes, there has to be kind of that assumed, like, I'm not doing this to be malicious thing, but at the same time, going back to something that I learned late last year from our friends over at Microsoft, this idea of using graphs to do this, like graphs are the way that people think, right?

So when I land on a system and I examine all the ways that I can move off of it, like what if my extranet provider has an INSECURED link? Like, is it my responsibility to report that with the hope that they're gonna fix it? Or should I probe it to see how far I can get?

Because a lot of times that's what happens, right? It's like, oh, well, I found out like I, it's basically a telenet connection or something stupid like that, and I can get a whole lot of access to your systems that I shouldn't. Well, why were you doing that?

You should have, you should have not told us. And we see that a lot with like vulnerability reporting and bug bounties, right? It's like, you know, why I reported this six months ago?

Why haven't you patched it? Oh, well, it's not a low priority for us, but soon as you make it go live on the internet, suddenly, you know, know, oh, you're in trouble because you disclosed this and you shouldn't have, like, you, you, you've gotta play within the rules, but sometimes you have to break or bend some of those rules to affect change. I also don't, I think you don't wanna blur the lines between hiring someone to do penetration testing versus doing your red teams.

In other words, you're not, you're not the internal version of an outside group trying to, uh, trying to penetrate somebody else's stuff. To your point, Fernando, about, um, doing things above board, right? You, you may want to do some testing against a application that's getting ready to go into production, but you pro that probably ought to be at the request of or in cooperation with the folks that are getting it ready, right?

That's part of your security readiness process. Um, but the, the advantage of an external team is they don't know what, you know, you know, you, it's an advantage of all the stuff you know about your systems and infrastructure, everything else. But that's also a, that's also a liability because you're stuck in a framework of how you think about those systems and how they're secured versus someone who doesn't know that they're gonna find the things that you're not thinking about.

So I think we need to separate the why you use an external penetration pen testing group versus what a red team is doing. It's not to supplant that external function. I, it, it, it's interesting that, uh, I see it as, uh, if I agree liability and, and the benefit, I see the benefit more than the liability in the context that, okay, I know that this particular system was connected to that old project, but you know what?

That, that, that project stakeholder, they, they left the company, right? Hmm. I wonder what's going on with that, uh, with, I wonder who's managing that project now?

And then off you go and you find an area that that is not being observed, and things blow up from there, and, and you are able to, to successfully do that. The, the thing that I, I worry a lot is, is when you cross that boundary between I am testing something that belongs to my organization, I'm testing something that belongs to somebody else, right? And this blows up in many, many ways.

I'm, I'm thinking here about those two pen testers from, uh, that were arrested and, and, uh, trying to physically break into a courthouse under the, the auspices of a, like they had rules of engagement except that the, the, the organization that contracted them apparently didn't have the, the rights to, to do that. Like, it was, it, it's like a, uh, uh, me pen testing a building when I'm just a renter at the building, right? So that was, I think that was the, the, the crux of the problem.

So you run into those things with professional pen testing as well. So I think that the guideline for of security for an organization should be mind your own stuff out. I'm also reminded of, and again, these things come all the time, but the, there was an incident where someone found a, an issue on a public website where they could, uh, enumerate thousands of, of, of, uh, IDs, and they did, right?

Well, you should have probably stopped at two or three IDs just to prove the point that you can enumerate and not do all of them, right? So do you, do you remember which one I'm talking about? And forget which, which city it was.

But, um, these are all these kinds of problems where now take this one step further. Oh, I'm going to go after against bad state, state sponsored, uh, group that does that. They're not going to complain about you to your employer.

They're not going, no, no, no, no, no. They're going to try something more nefarious. Again, exceedingly careful people and just in, in all, like, uh, uh, unless there's an exceedingly good reason, stay stick with, stick within your organization kind of thing.

I, I think that that's probably the thing we should take away from this, right? Is there have to be rules of engagement. And if there are no rules of engagement, you have to start asking yourself what kind of battle you're fighting, because I don't think you're fighting the battle you want to fight.

You're picking on somebody that will not hold back from attacking you. And so if you have clear rules of engagement, you understand the objectives and you understand the purpose behind it, I think you're probably gonna be a little bit better off on the offensive security side. But let's be honest, the people who are really going offensive are probably not listening to podcasts like this.

They're probably getting ready to write their own. So I think we'll go ahead and wrap it up there. Um, and, and this is the thing, I just wanna say one thing.

Like I don't want people to miss. There are times when this is necessary, right? And, and here I'm thinking about all the, the, the offensive security that goes on, uh, in the defense of Ukraine, for example, right?

All that they've done with, with, with drones over there, right? That's a different scenario. Like we we're, we're talking war fighting here, right?

Uh, that's, that's different than, oh, I'm gonna go after these kind of criminals and see what I can get about them, right? Let, let's, let's, let's keep those things in perspective. Yeah.

Perspective is, is what's important. Um, speaking of perspective, uh, Mitch, what are some things you've got working, uh, now here at the beginning of 2026 that people should be checking out? Well, we're kicking off a whole, whole series of things here.

Fernando and I have been working on predictions for our respective areas and, uh, and planning for our, also for our relative practices. So there's a bunch of writing that I'm doing. Uh, we have videos that are coming out.

We have, uh, predict 2020 that's happening, I think on the 17th of January, if I remember right, somewhere along the line in a, in a few days, not too far down the road. So we're recording some of those things. So it's a lot, a lot about looking ahead for the rest of the year and taking the lessons of last year of maybe I need to be a little more aggressive in some of my predictions and things are moving pretty dang fast, uh, at least in the area of, of ai, but also, uh, where there areas of collaboration of not just in the practitioner world, but also us looking at it from an analyst perspective.

So doing podcasts and things like this. Maybe collaboration on some reports. I'm working on some ideas for two different new signal reports.

So there's a lot of planning setting the stage for this year, and I think we're gonna get even a lot more done than we did last year. It was a great year, 2025 for us. Awesome.

Fernando, what have you got? I concur. Uh, one of the things that I have is that, uh, I'm not sure when people are listening to this, but we're just putting the final, final touches on the, the cybersecurity decision maker, uh, surveys that, that we conducted in, in the second, in, in fourth quarter 25, that data for, for, for term subscribers, that data is now live on the platform.

I don't think it's been, uh, uh, I don't know if the press release went out yet, but that, so we have both Market Chi and, uh, and user sentiment, uh, data out now, which is really cool. I love this about my job, right? And, uh, as Mitch said, I mean, predict 2026 is coming up.

Uh, we have, uh, uh, where things are going and, um, there is a lot going on, right? And, and the, the, the stakes on cybersecurity keep rising, right? Uh, this is foundational to modern society, right?

And that's what we're seeing impact in many, many, many places. Correction, it's January 15th is the date of 98 and Easter. Well, we've also got a lot of stuff going on over at Tech Field Day.

If you wanna check out some of that cool stuff, including, we're gonna be at RSA for the, uh, first time RSA 2026. We already have a page up. We have some great presenters that are getting ready to be there, and we'll be adding more information about some more great presenters in the list and the delegates who will be joining us there.

com is the place to check that out. We wanna thank you for listening to this episode of Security Boulevard podcast. If you enjoyed this conversation, you know what to do, head over to YouTube or your favorite podcast application of choice, hit the subscribe button.

We don't want you to miss any of the episodes. We also appreciate it if you'd leave a rating, a review, and a comment that helps the show grow and reach new audiences. com in the RUM group.

com, text strong tv website or the Text Strong TV app, which is available on pretty much every smart device, whether it's a tv, phone, tablet, you name it, it's there. Follow Security Boulevard on X, Twitter and LinkedIn at security BLVD that has all the content you could ever hope for. Thanks for tuning in, and we'll see you all next week.