Red Team: Adversary Simulation. A team of penetration testers (a red team) is hired to legally break into a facility to test its security.

Since the job of Red Teaming and Penetration Testing, especially physical, which is the focus of this question, involves a lot of traveling, it's hard to pin point a country to apply this question to. If it's absolutely necessary, let's assume US and European laws.

Hypothetical Situation:

The company Blue hires the company Red to do a Red Team engagement on Blue. Here, I'll be discussing only the physical part of the engagement, not social and cyber.

Red successfully infiltrates Blue and gives detailed reports of what was done in the engagement. Example part of the report:

In building A:

At door A101, we picked the lock. Techniques used in picking: Raking, Bump Key.
At door A102, we picked the lock. Techniques used in picking: Raking.

The report includes details of techniques used to exploit and infiltrate.

A week after the engagement is done, Blue is attacked by real criminals and had their data exfiltrated from building A. They didn't have camera footage of every door exploited. Installation of the doors and locks in building A are confirmed to be proper and most likely picked. However, those doors/locks have also been reported to be picked by Red during their engagement the week before.

The problem:

The locks being tested have been picked and exploited by both Red and the criminals. Forensics evidence would likely show traces of both or just Red's engagement. Since red team engagements are to simulate real criminals as accurately as possible, it's hard to differentiate between evidence left by Red and those left by the criminals.

Blue is highly confident that those locks were picked by the criminals, and let's assume they're correct about that. Blue wishes to investigate how exactly the criminals got in and track down those criminals. Additionally, Blue also wants to claim insurance for those locks being picked. (I've heard we can get insurance from the lock manufacturer if the locks are picked and we take damage from that)


How can forensic evident on the locks be used in court (for insurance) and investigation? How should Blue use said forensic evidence to claim their insurance and track down the criminals when it's hard to distinguish between marks left by Red and the criminals?

  • 2
    What’s the legal question as opposed to the investigation question?
    – Dale M
    Dec 3, 2019 at 6:18
  • How should such hard-to-distinguish evidence be used to claim insurance and track down the criminals? Dec 3, 2019 at 8:02
  • Why would an insurance company want forensic evidence - you just make a claim and they pay it. Also, the chances of anyone catching the criminals is virtually nil unless they are incredibly stupid - the police will put the incident on file and leave it at that.
    – Dale M
    Dec 3, 2019 at 11:37

1 Answer 1


It's not really a legal question, but a question of evidence. For an insurance claim, you usually have to show evidence of damage to the company. The damage is likely easy to show, but you'd also have to show evidence that you didn't do it yourself. "I didn't do it because that would be criminal" is often enough evidence. In your situation the insurance might want evidence that it wasn't the invited "red team" that caused the damage.

Worst case, you end up in civil court suing your insurance company, and there you have to demonstrate to a judge that it is more likely that the damage was caused by some criminals than being caused by your "red team". How you prove that is up to you. You also need to check your contract with the insurance, in case that inviting the "red team" somehow invalidated your insurance.

  • Given that the damage is "the exfiltrated data", the red team standing up in court saying "we didn't do it (it would totally kill our business if we did)" is probably enough evidence. Dec 3, 2019 at 18:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .