As reported by Dark Reading, RemoteThreat is advancing a methodology that moves red teaming past its traditional boundaries—simulating what adversaries do after perimeter defenses collapse rather than merely proving that compromise is possible. This is a meaningful and overdue shift, and it reflects where the industry's maturity needs to go.
The Problem With Traditional Red Teaming
Most organizations still treat red team engagements as a binary exercise: either the team gets in or they don't. But that framing has been obsolete for years. Initial access is no longer the hard part for motivated adversaries—phishing kits, initial access brokers, exposed credentials, and unpatched edge devices have made that trivially cheap. The real differentiator between organizations that contain breaches and those that become headlines is what happens in hours 2 through 72 after the attacker lands.
Traditional penetration tests, scoped and time-boxed for compliance, almost never evaluate this window. They prove a vulnerability exists, submit a report, and move on. Meanwhile, the adversary is establishing persistence, escalating privileges, collecting credentials, and staging exfiltration—all of which require detection and response capabilities that go untested.
Assume Breach Is Not Optional Anymore
The concept of "assume breach" has been discussed for over a decade, but adoption remains inconsistent. What RemoteThreat is apparently pushing toward—continuous, post-compromise adversary emulation—aligns with how mature security programs actually validate their defenses. The framework that matters here is MITRE ATT&CK, which maps adversary behaviors across the full kill chain, not just the entry point.
Security teams that only test whether they can be breached are testing the wrong assumption. The question isn't 'can someone get in?'—it's 'can we detect and contain them once they're inside?'
What Defenders Should Actually Be Testing
Organizations need to move beyond point-in-time assessments and toward continuous validation of their detection and response posture. This means:
The Skills Gap
What's also notable is that this approach demands a different skill set than traditional pentesting. Post-compromise emulation requires deep understanding of Windows internals, Active Directory abuse, cloud privilege escalation, and detection engineering. Many organizations lack this expertise in-house, which is why the market for adversary emulation and breach simulation services is expanding.
Shield53 Recommendations
- Map your current testing to ATT&CK: Identify which techniques your existing assessments cover and which post-compromise behaviors remain untested. The gaps will surprise you.
- Adopt purple team exercises: Red and blue teams should operate together in real time, not sequentially. The value is in validating detections as they're triggered, not in a post-engagement report.
- Invest in Breach and Attack Simulation (BAS): Tools like AttackIQ, SafeBreach, or Pentera can provide continuous, automated validation of controls against known adversary techniques.
- Test your incident response playbook under pressure: Run tabletop and live-fire exercises that assume the attacker is already inside. Measure mean time to detect (MTTD) and mean time to respond (MTTR)—not just whether a vuln was found.
- Prioritize detection engineering: Every red team finding should produce or validate a detection rule. If a technique was used and no alert fired, that's a detection gap, not just a security finding.
The industry has spent two decades proving that perimeter defenses can be bypassed. The next decade needs to be about proving that containment and response actually work under realistic conditions. RemoteThreat's approach signals that shift, and security leaders should be asking their vendors and internal teams the same question: what happens after we're breached?
