Red Team

Summary of Red Team

1. 1

   The Day the Warnings Went Unheard

   

   00:00

   00:00

   A small team within the Federal Aviation Administration spent years before 9/11 doing something extraordinary: they smuggled fake bombs past security screeners, slipped into restricted areas, and boarded aircraft undetected. They documented every vulnerability, filed every report, and sounded every alarm. No one listened. When the 9/11 Commission later investigated, they delivered a devastating verdict: this wasn't a system failure-it was a system designed for failure. The information existed. The warnings were clear. But institutional blindness proved fatal. This pattern isn't unique to aviation security. In 2014, General Motors recalled millions of vehicles with faulty ignition switches linked to at least 119 deaths. Employees had flagged the issue years earlier, but GM's culture encouraged watered-down language that obscured safety concerns. The problem wasn't missing information-it was an organization incapable of hearing bad news. Whether preventing terrorist attacks or avoiding market failures, institutions consistently fail to identify their own weaknesses. Red teaming offers a structured way to challenge plans, systems, and assumptions by adopting an adversarial perspective. Through stories of over 200 practitioners-from CIA directors to ethical hackers-we discover how organizations can overcome blind spots before disaster strikes.

2. 2

   You Cannot Grade Your Own Homework

   Start Listening

   Organizations cannot objectively evaluate their own failures. The CIA's post-9/11 detention program was evaluated by the same personnel who designed it, perpetuating years of ineffective, ethically questionable practices despite requests for independent analysis. Cognitive biases prevent leaders from identifying critical shortcomings. Mirror imaging makes us assume others think like we do. Confirmation bias favors information supporting existing beliefs. The Dunning-Kruger effect compounds this - the least competent are worst at judging their own performance, creating a feedback loop where incompetence breeds overconfidence. Organizational culture deepens these biases. Employees get "captured" by their environment, unconsciously adopting their bosses' preferences. Military officers score significantly lower than the general population on openness to new ideas, showing how certain cultures actively discourage divergent thinking. Despite claiming to welcome dissent, leaders rarely hear it. One Marine officer noted: "Your ability to mind read is more praiseworthy than your ability to think critically." GM employees used euphemisms like "does not perform to design" instead of "dies," contributing to preventable deaths. Red teaming addresses these blind spots through simulations and alternative analyses - helping institutions identify vulnerabilities objectively.

3. 3

   Leadership Support Makes or Breaks Everything

   Start Listening

   Red team success depends entirely on genuine leadership support. Retired Marine Lieutenant General Paul Van Riper states: "Unless the commanders themselves want it, support it, resource it, institutionalize it, and respond to it, it won't matter." Effective buy-in requires leaders to recognize specific vulnerabilities red teaming can address. This often follows catastrophic failure-the FAA created its red team after the 1988 Pan Am Flight 103 bombing. Forward-thinking leaders act proactively: Microsoft regularly employs red teams to probe software releases before launch. Support must cascade throughout the organization. When imposed from above without context, junior leaders "sleepwalk" through the process, treating it as box-checking. Leaders must demonstrate commitment through tangible resources-dedicated personnel, adequate funding, protected time-while avoiding the pitfall of treating red teams as "dumping grounds" for underperformers. Leaders must create environments where red teamers can speak truthfully without fear of retribution. The pre-9/11 FAA red team exemplifies this failure. Despite exposing serious vulnerabilities, leadership systematically undermined them-tipping off airports about inspections, instructing members to omit findings. When frustrated members went public in 2001, they faced retaliation-a tragic leadership failure with catastrophic consequences.

4. Chapter 4

   Outside and Objective, Inside and Aware

   Red teams must balance semi-independence with organizational sensitivity. As former CIA deputy director Jami Miscik warned, they "cannot be a separate back-office group that studies their navels, and isn't engaged with the rest of the building." Three factors guide successful positioning: structure, scope, and sensitivity. Structurally, red teams should be semi-independent, reporting directly to senior leadership. Proper scoping prevents mission drift through clear targets, timelines, and objectives. Red teams should calibrate intensity gradually so lessons can be implemented. They must operate with sensitivity-understanding institutional concerns, regulatory constraints, and available resources. As Charles Henderson of Trustwave Holdings notes: "Our job isn't to break into a computer network or building, it's to improve the security of the client." The CIA Red Cell exemplifies this approach. Created after 9/11 to challenge conventional intelligence thinking, it became a sought-after posting. CIA director Michael Hayden found their work "a little too much like science fiction at times" but read everything they produced because he "wanted to have my mind stirred."

   Chapter 5

   The People Who Make Red Teams Work

   Successful red teams require members who think differently-often self-described "oddballs" inherently skeptical of authority. As Lieutenant Colonel Daniel Geisenhof put it: "In many ways, we are in the land of misfit toys." While most people believe they think outside the box, few actually do. Humans exhibit "existence bias"-assuming current conditions must be correct. Effective red teamers escape these constraints through distinct personality traits, proper training, or semi-independence. Three variables correlate with good red teaming. First, personality: successful red teamers are quick-thinking, adaptive, self-motivated, and fearless in pursuing truth. Former CIA analyst Rodney Faraon notes they're "like method actors" who internalize adversaries' motives. They must balance skepticism with finesse-as Marissa Michel explains: "You can have great ideas, but if you are crotchety nobody will pay attention to you." Second, they often aren't career "climbers"-they prioritize truth over advancement. Military "terminal colonels" no longer seeking promotion make excellent red teamers because they'll speak honestly. Third, experience matters: the best are widely read, have held multiple positions, and communicate through compelling storytelling. Red teaming skills can be taught through metacognition training. However, most serve temporarily to avoid institutional capture. The ultimate goal is to "infect" the organization with red teaming approaches, creating mini-red teamers throughout.

   Chapter 6

   From Insights to Action

   Red team findings must be implemented, not shelved. Organizations often game engagements by denying information access, boosting security during tests, or taking systems offline. One white-hat hacker identified the same network vulnerability at a Fortune 100 firm for over a decade-repeatedly ignored. This resistance explains why the FAA's pre-9/11 red team saw no action despite documenting serious failures, and why the Marine Corps red team in Afghanistan was "almost entirely marginalized"-called "kids at the card table at Christmas." When a Marine colonel presented critical findings to General Stanley McChrystal, he was rebuffed: "It sounds like you're telling me how to run my war." Institutions need absorptive capacity-funding, personnel changes, or procedural adjustments-to implement findings. McKinsey warned of ObamaCare rollout glitches six months before launch, but their findings were disregarded, resulting in political disaster. Frequency matters. Too much red teaming prevents implementing previous recommendations. Optimal frequency depends on environmental dynamics: multinational companies might need external analyses every five years, while cyber-threatened companies might need quarterly tests.

   Chapter 7

   Seeing What We Cannot See

   Red teaming has become both oversold and under-appreciated, with security firms rebranding standard penetration testing to command higher fees. Yet properly executed red teaming inevitably produces two valuable outcomes. First, it delivers novel insights that couldn't emerge organically within institutions-the structural elements that make organizations function smoothly (hierarchy, formal rules, unit cohesion) are precisely what inhibit creative thinking. Second, even when red teaming fails to impact an organization, it reveals something about that institution's thought processes and values. Failures typically stem from leaders believing they would already know about problems or their employees would tell them-both dangerously flawed assumptions. Red teams should challenge conventional wisdom, identify blind spots, reveal vulnerabilities, and consider worst-case scenarios-but never make final decisions. Red teaming isn't a cure-all but rather a conceptual approach with specific tactics for particular challenges. Retired Lieutenant Colonel William "Razz" Rasgorshek uses a combat pilot analogy: Just as night vision goggles create blind spots that pilots compensate for by scanning side-to-side, "there are certainly blind spots in our brains." The solution is educating people how blind spots develop, showing they exist, and teaching them to control the interference. In a world where institutional blindness costs lives, fortunes, and futures, the ability to see our own vulnerabilities before adversaries exploit them isn't just valuable-it's essential. The question isn't whether your organization has blind spots. It's whether you're willing to illuminate them before disaster does it for you.

   Continue Reading