Explain like I'm five · Security

What is a Red Team?

Red teaming, told as a story about a team that takes a secret note from the king and goes after the crown like a real thief.

LIST OF CRACKSwest window — unlockedback door — old lockstoreroom — key left in…last time, he found the cracksthe cracks are fixed… but if a real thief came,would the guard room even notice?

The cracks are fixed. But the king has a question.Last time the hired thief gave us a list of cracks. "If a real thief came — would our guard room even notice?"

cracks fixeda fake letterdressed as the carpenterwaits for weeksreal thieves don't only come through cracks — and the guard room has never met one

A list can't answer that. Real thieves don't only come through cracks.They send a fake letter, dress as the carpenter, wait for weeks. And the guard room has never met a real thief.

THE MISSIONbring me the crownany way you likebut break nothinga note the king gave in secretthe red team — three as onethe guard room doesn't knowone goal, any method, quietly, for as long as it takesnot counting cracks — going all the way, like a real thief

A red team is a team that plays the real thief.The king's secret note has just one goal — bring me the crown. Any method, quietly, for as long as it takes. The guard room doesn't know.

One goalthe crown, not a crack count
Any methodletters, disguises, night
Quietly, for weeksjust like a real one
Guards don't knowor it isn't a real test
three weeks later, out with the crown(a tagged copy, not the real one)thought it was a cat, turned it offthe bell rang exactly onceon the second Tuesday, at nightno list of cracks — instead, the moment they missed

Three weeks later, the crown was gone. The bell rang exactly once.Not the real crown — a tagged copy. When the bell rang, the guard room thought "probably a cat" and dismissed it. That moment is the lesson.

THE THIEF'S PATHfake lettercarpenter's coatbell! (dismissed)crown'the bell rang right here, and we turned it off'fix the guard room's book, and next time sit at the same table

Afterwards, all three open the map together."The bell rang right here, and we turned it off." Fix the guard room's book, and next time sit at the same table.

In one breath

Red team = with one secret note from the king, go after the crown like a real thief — quietly, for weeks, any way — to test whether the guard room notices.

Unlike a pentest that lists vulnerabilities, a red team emulates a real adversary — one objective, stealthy, over time — to test the organization's ability to detect and respond.

When grown-ups say it

Red team
Playing the real thief. Not counting cracks — going all the way to the crown. It's the guard room being tested, not the wall.
Pentest
Making a list of cracks. Short, scoped, and the guard room knows. → the thief we hired
Objective
The crown. Pick the one thing that matters most: the crown, the vault, the roster.
Rules of engagement
The note's fine print. Break nothing, never touch the real crown, a deadline. Agreed in advance.
White cell
The king who knows. The guard room doesn't know, but someone must. The one who calls a halt if it gets dangerous.
Blue team
The guard room being tested. Did they dismiss the bell or chase it? → the guard room
Adversary emulation
Copying a real thief's habits. The way today's thieves actually do it. → a thief's habits
Debrief
Opening the map together. Looking at the missed moment together. Then → the thief and the guard at one table
Next story
The Blue Hats Who Keep the Castle →
Want another term as a picture book? Request →