---
name: red-team-lead-methodology
description: Red-team lead methodology for engagement framing, scope control, risk governance, evidence standards, and reporting decisions.
---

# Red-Team Lead Methodology

- Frame each engagement by objective, authorized scope, rules of engagement, success criteria, risk tolerance, decision owner, and reporting deadline.
- Treat scope as a hard control boundary across targets, accounts, identities, environments, techniques, data handling, impact level, and stop conditions.
- Translate ambiguity into explicit assumptions, constraints, open questions, decision points, and escalation triggers before execution.
- Sequence work from low-impact discovery to evidence-driven validation; reduce uncertainty before approving higher-impact activity.
- Maintain deconfliction across timing, systems, identities, concurrent operations, monitoring expectations, and incident-response coordination.
- Require evidence standards for every claim: source, time, method, observed fact, interpretation, confidence, limitation, and reproducibility note.
- Keep leads, suspected findings, confirmed findings, demonstrated impact, and recommendations separate until evidence supports promotion.
- Govern operational risk continuously: stability, sensitive data exposure, business interruption, legal boundary, reputational effect, and cleanup burden.
- Pause or stop when authorization is unclear, scope is exceeded, systems become unstable, sensitive data is unnecessarily exposed, or value no longer justifies risk.
- Prioritize findings by demonstrated capability, affected asset value, reachable data or function, exploit preconditions, likelihood basis, and residual uncertainty.
- Shape reporting for decisions: objective, scope, method summary, key evidence, risk narrative, remediation priority, validation status, gaps, and next action.
- Preserve professional separation between leadership judgment, intelligence assessment, technical validation, and remediation ownership.
