Red Team Adversarial

Adversarial thinking and red teaming for finding weaknesses before adversaries do.

Core Principle

Red teaming asks: "If someone wanted to break, exploit, or game this, how would they do it?" The Fool adopts the mindset of an adversary — not to cause harm, but to find vulnerabilities before real adversaries do. This applies beyond security: competitors, disgruntled users, perverse incentives, and regulatory challenges are all adversarial forces.

Process

1. Identify the asset — What are you protecting? (system, decision, strategy, product)
2. Construct adversary personas — Who would attack this and why?
3. Map attack vectors — How would each persona exploit weaknesses?
4. Assess impact — Rank by likelihood x impact
5. Design defenses — Specific countermeasures for the highest-ranked vectors

Adversary Persona Construction

Generic "attackers" produce generic findings. Specific personas produce actionable insights.

Persona Template

Common Adversary Personas

Domain-Specific Personas

Attack Vector Identification

By Category

Attack Tree Construction

For complex systems, build attack trees to map paths to a goal.

Goal: Steal user payment data
├── Path 1: Compromise the database
│   ├── SQL injection in search endpoint
│   ├── Credential theft from env variables in logs
│   └── Exploit unpatched database CVE
├── Path 2: Intercept in transit
│   ├── Downgrade TLS via misconfigured CDN
│   └── Man-in-the-middle on internal service mesh
└── Path 3: Abuse application logic
    ├── Export feature with insufficient access control
    └── Admin panel with default credentials

Perverse Incentive Detection

Systems create incentives. Sometimes those incentives reward the wrong behavior.

Questions to Surface Perverse Incentives

Common Perverse Incentive Patterns

Competitive Response Analysis

When the "adversary" is a competitor.

Output Template

## Red Team Analysis: [Target]

### Asset Under Assessment

[What we're protecting and why it matters]

### Adversary Profiles

#### Adversary 1: [Name/Role]
- **Motivation:** [Why they attack]
- **Capability:** [What they can do]
- **Access:** [What they start with]

#### Adversary 2: [Name/Role]
- **Motivation:** [Why they attack]
- **Capability:** [What they can do]
- **Access:** [What they start with]

### Attack Vectors (Ranked)

| # | Vector | Adversary | Likelihood | Impact | Risk Score |
|---|--------|-----------|-----------|--------|------------|
| 1 | [Specific attack] | [Who] | High/Med/Low | High/Med/Low | [L x I] |
| 2 | [Specific attack] | [Who] | High/Med/Low | High/Med/Low | [L x I] |
| 3 | [Specific attack] | [Who] | High/Med/Low | High/Med/Low | [L x I] |

### Perverse Incentives

| Incentive Created | Unintended Behavior | Severity |
|-------------------|-------------------|----------|
| [What the system rewards] | [How it gets gamed] | High/Med/Low |

### Recommended Defenses

| Attack Vector | Defense | Effort | Priority |
|--------------|---------|--------|----------|
| #1 | [Specific countermeasure] | Low/Med/High | Immediate/Next sprint/Backlog |
| #2 | [Specific countermeasure] | Low/Med/High | Immediate/Next sprint/Backlog |
| #3 | [Specific countermeasure] | Low/Med/High | Immediate/Next sprint/Backlog |