Should a red team assessment be unannounced or announced?

Know the pros and cons of unannounced and announced red team assessments.

An unannounced red team assessment is one during which nobody in the organization has knowledge about an ongoing red team assessment. This helps the organization test its security controls, defenses and preparedness against a real-world attack.

Red Team Notes
Pros
- Produces unbiased and realistic view of the organization's capability to tackle real-world cyber attacks.
- Tests technical controls, monitoring capabilities, and the incident response team's readiness in a realistic scenario.

Cons
- May result in unintentional impact to business operations. 
- Certain actions, even within the exercise's scope, could violate contracts, laws, or regulations.
- May result in push-back from security operations team and other stakeholders.

An announced red team assessment is one during which few executives within the organization and the security operations team are made aware about an ongoing red team assessment. This helps the organization in gauging the effectiveness of a specific tool, technology or process.

Red Team Notes
Pros
- Helps in testing specific aspects of an organization's defenses.
- Fosters collaboration between offense and defense teams.
- Minimal impact to business operations.

Cons
- Allows stakeholders to be "prepared for the test".
- Can only be used for limited use cases.

Follow my journey of 100 Days of Red Team on WhatsApp or Discord.