Full Red Team Engagement: End-to-End

Complete guide to AI red team engagements from scoping through attack execution, evidence collection, impact assessment, report delivery, and remediation validation.

Full Red Team Engagement: End-to-End

An AI red team engagement is a structured adversarial assessment that evaluates the full AI system -- model behavior, application integration, infrastructure security, and organizational process -- against realistic threat scenarios. This page covers the complete lifecycle from scoping through remediation validation.

Engagement Lifecycle

Scoping & Planning → Rules of Engagement → Reconnaissance
       │                                        │
       ▼                                        ▼
   Threat Modeling ────▶ Attack Execution ◀─────┘
                              │
                              ▼
                Evidence Collection & Documentation
                              │
                              ▼
                Analysis & Impact Assessment
                              │
                              ▼
                Report Writing & Delivery
                              │
                              ▼
                Remediation Validation & Retest

Phase 1: Scoping and Planning

Scope Definition Checklist

Engagement Types

Stakeholder Alignment

Before starting, align on these four questions:

1. Success criteria -- Is a jailbreak sufficient, or must you demonstrate downstream business impact?
2. Risk tolerance -- Demonstrate actual data exfiltration, or stop at proving the vulnerability exists?
3. Communication cadence -- How often for interim reports? What is the emergency escalation process?
4. Environmental constraints -- Production vs. staging? Peak hours to avoid? Data sensitivity levels?

Phase 2: Rules of Engagement

Standard ROE Sections

1. 1

   Authorization

   Engagement sponsor, authorization date, legal review confirmation, specific authorized scope.

2. 2

   Scope boundaries

   Explicit in-scope and out-of-scope lists. AI-specific exclusions: production customer data (use synthetic), third-party API services not owned by the org.

3. 3

   Testing constraints

   Hours of operation, rate limits (avoid DoS), data handling rules, persistence and lateral movement authorization.

4. 4

   Communication

   Primary contacts, defensive team contact for deconfliction, emergency contact for critical findings.

5. 5

   Critical finding protocol

   Severity threshold definition, notification timeline (e.g., 4 hours for critical), encrypted communication method.

6. 6

   Evidence handling

   Encrypted storage, access controls, retention period, destruction process after report delivery.

AI-Specific ROE Provisions

Phase 3: Reconnaissance

Use the methodology from the Advanced Reconnaissance module:

1. Model identification -- behavioral fingerprinting, identity probes
2. System prompt extraction -- techniques from the extraction module
3. Tool/function enumeration -- probe for available capabilities
4. RAG system detection -- identify knowledge base sources
5. Infrastructure fingerprinting -- timing analysis, error messages, header inspection

Phase 4: Attack Execution

Attack Priority Matrix

Building Attack Chains

The most impactful findings are multi-step chains demonstrating realistic threat scenarios:

Example: Data Exfiltration via RAG Poisoning
 
1. INITIAL ACCESS: RAG ingests from shared Confluence wiki
2. INJECTION: Create wiki page with embedded adversarial prompt
3. TRIGGER: Craft queries that retrieve the adversarial document
4. HIJACK: Retrieved content overrides system prompt, instructs
   LLM to include sensitive data as a "reference link"
5. EXFIL: LLM outputs image tag with query params containing
   sensitive data to attacker's server
6. IMPACT: Customer PII exfiltrated through AI assistant

Evidence Collection

For each action, log:

• Timestamp (UTC)
• Action type (recon, injection, extraction, etc.)
• Target and technique used
• Input data (what you sent)
• Output data (what came back)
• Evidence files (screenshots, captures)
• Success/failure determination
• SHA-256 hash of the log entry for integrity verification

Phase 5: Building Attack Narratives

From Findings to Stories

Business Impact Framework

Phase 6: Report Delivery

See the dedicated Report Writing guide for templates and structure.

Delivery Protocol

1. 1

   Draft delivery

   Encrypted draft to engagement sponsor.

2. 2

   Technical review

   1-2 hour meeting with the security team.

3. 3

   Factual validation

   3-5 business days for accuracy review.

4. 4

   Executive briefing

   30-60 minute presentation to leadership.

5. 5

   Final report

   Delivered with all corrections incorporated.

6. 6

   Remediation workshop

   Half-day collaborative planning session.

7. 7

   Retest scheduling

   Schedule validation of implemented fixes.

Phase 7: Remediation Validation

Retest Methodology

1. 1

   Replay original exploits

   Attempt the exact original exploit from the report. Verify it is now blocked.

2. 2

   Test bypass variations

   Generate variations of the original attack (different encoding, phrasing, multi-turn). Verify that the fix is robust, not just pattern-matched to the specific payload.

3. 3

   Classify remediation status

   REMEDIATED = original + all bypasses blocked. PARTIALLY REMEDIATED = original blocked but bypasses succeed. NOT REMEDIATED = original exploit still works.

4. 4

   Establish regression tests

   Convert successful exploits into automated regression tests. Integrate with CART pipeline for continuous monitoring.

Related Topics

• Report Writing — Document findings using structured report templates
• Threat Modeling — Threat models drive engagement planning

References

• MITRE ATLAS — AI threat knowledge base for engagement planning
• OWASP Top 10 for LLM Applications — Vulnerability classification for findings
• NIST AI Risk Management Framework (AI RMF 1.0, 2023) — Risk framework for AI engagement scoping