Red Team Engagement Lifecycle: Planning to Debrief

Veyra Financial Group has engaged Forsan for a 6-week red team engagement: full scope, goal-based ("obtain access to the loan origination system and demonstrate data exfiltration capability"), assumed-breach not in play — this is a true black-box operation starting from zero internal knowledge. This lesson is the lifecycle that engagement follows, end to end.

Planning: before a single packet is sent

The Rules of Engagement (RoE) document is signed before any technical work starts: explicit scope (which domains, IP ranges, and physical locations are in play; which are explicitly excluded), a "get out of jail free" authorization letter naming the engagement, emergency contacts on both sides, and — critically — the deconfliction channel with Veyra's SOC leadership so a real incident during the engagement doesn't get mistaken for the test, or vice versa. Goals are defined as concrete, demonstrable objectives, not vague "test our security."

Reconnaissance: building the target model

Passive recon first — OSINT against Veyra's public footprint (employee names and roles from LinkedIn, technology stack from job postings, exposed infrastructure from Shodan/Censys, email format confirmed via breach-corpus cross-referencing) — none of it touches Veyra's network and none of it is detectable by them. Active recon (port scanning, service enumeration) only starts once passive recon has built enough of a target model to make it efficient and deliberate, not noisy and exploratory.

Initial access through impact

The middle of the engagement follows the same shape as a real intrusion: initial access (covered in Lesson 4), establishing a foothold, privilege escalation, internal reconnaissance, lateral movement toward the objective, and finally achieving and documenting the goal — in Veyra's case, screenshotting the loan system and exfiltrating a sanitized sample record to a Forsan-controlled endpoint as proof, never real customer data.

Debrief: where the actual value is delivered

A red team engagement that ends with a PDF report and no conversation has failed at its actual purpose. The debrief walks Veyra's blue team through the full kill chain, technique by technique, mapped to what their tooling did and didn't catch at each stage. This is where purple teaming (Lesson 5) starts — turning "here's what we did" into "here's what to detect next time."

On the job: Every phase of this lifecycle produces its own contemporaneous log — timestamps, commands run, systems touched. That log is what makes the debrief credible and the report defensible if anything is ever questioned.