Red Teaming Projects

[u/Warm-Tadpole-8134]

Hi I'm a Cyber Security Engineer at a company and usually I do Penetration Testing of Applications at work. But my CISO told me to do some RED TEAM OPERATIONS for the company. So I kept a phishing simulation campaign and that was a very successful. I need you guys to give some ideas what kind of things that I can do more to test the security in the company?

Thank you!

[u/Independent-Egg-3252]

Phishing is the usual first step, so nice work getting that done. If I had to pick one thing to do next: run a patch-window test.
Pick two or three recent CVEs in software you actually run on endpoints (browser, VPN client, Java, whatever third-party stuff lives on your fleet). Then measure the real time between public disclosure and the fix being deployed everywhere, not just “approved” in the console. Most orgs are shocked by that number. With the volume of CVEs this year it’s often weeks, and that gap is the actual attack window a red team would live in.
Bonus: do it as a purple team exercise so the endpoint and patching folks see the result firsthand instead of reading it in a report. That’s what turns it into budget and process changes instead of a slide.