An introduction to the series.
I am about to publish six posts on what goes wrong in security assessments. I want to spend a short post up front explaining why the series exists, what the six posts are going to cover, and the single idea that runs underneath all of them.
The Idea
The title of the series is obviously a play on words, and it has more layers in it than a quick read might catch. Let me unpack them.
Red versus blue, in the everyday sense, is the exercise. It is what happens when an attack team and a defense team agree to test each other in a controlled environment, with the goal of both sides getting sharper. The competition is the point. The friction produces learning. Both teams walk away better than they walked in. That version of red versus blue is healthy. It is also the version most people picture when they hear the phrase.
But even red versus blue carries an adversarial framing that I want to push back on, because the framing oversimplifies what is actually happening. The red team is not just the opponent of the blue team. The red team is assessing the organization. The whole organization. Administrators, system owners, users, leadership, processes, configurations, culture. The blue team is part of what we look at, but they are not the only thing we look at, and in many engagements they are not even the primary thing we look at. When the red team gets in through a misconfigured service account, that is a finding about the administrators. When the red team gets in because a legacy application was deployed with defaults nobody ever revisited, that is a finding about how the organization manages its software portfolio. The blue team is the team that responds to what we do. They are not the entire surface we are evaluating.
The play in the title is that red versus blue, even at its healthiest, is too narrow a frame for what an assessment actually does. The red team is not anyone’s opponent. The red team is an assessor. The assessment ranges across the whole organization. Calling it red versus blue is a useful shorthand for the on-keyboard portion of the engagement, but it misses the larger picture.
Red versus you is the failure mode I really want to write about. It is what happens when the people who received the assessment, anyone in the organization, treat the assessors as adversaries instead of as collaborators. The competition is no longer the exercise. The competition is the report. Findings become losses. The discussion becomes a debate. The energy that should be spent fixing problems gets spent arguing about whether the problems are real.
I have watched the second version happen, in different shapes, in every environment I have ever worked in. Military, government, Fortune 100, small business. The vocabulary changes. The pattern does not. The same instinct produces the same outcome, which is that the assessment fails to do the work it was supposed to do, the vulnerabilities stay open, and the organization is no better off than it was before the engagement started.
This series is about the shapes the failure takes, and how to recognize it early enough to do something about it.
The Thesis
The underlying argument across all six posts is the same. Take security seriously. Do not take it personally.
That sentence sounds simple. It is not. The culture of security fails in exactly the place where those two instincts get inverted. Organizations that take their image seriously and treat the actual security work as optional produce one kind of program. Organizations that own their security and accept the findings as gifts produce a fundamentally different kind of program. The difference between the two is rarely budget, rarely technical sophistication, rarely team size. It is almost always the culture, and the culture is set at the level of the small choices people make when they receive bad news.
The six posts in this series are about those small choices, broken into the specific shapes they take across the lifecycle of an assessment.
The Posts
The series moves through the lifecycle of an assessment in order, from before the engagement starts to after the findings are delivered. Each post handles one stage of the lifecycle and one specific failure mode that shows up at that stage.
Part 1: Friends, Not Enemies, We’re Here to Help, I Promise. The foundational post. What it looks like when assessors and recipients are on the same team, and what it looks like when they are not. The dynamic that produces every other failure mode in the series, and the move that resets it.
Part 2: The Truth Hurts, But It Makes Us Better. The practice that makes the collaboration valuable. How to deliver hard findings to people who do not want to hear them, and how to receive hard findings from people whose job is to find them. Including a specific conversational technique I use when I am about to give bad news.
Part 3: You’ll Never Be Ready. That’s the Point. The most common reason organizations postpone assessments, and why the reasoning is wrong. What real readiness actually means, and why the assessment is what gets you there.
Part 4: Can’t and Shouldn’t Are Not the Same Word. A specific linguistic move that derails assessments after they have already started. Why the words you use shape what the assessment is allowed to find.
Part 5: Classification Matters. Impact, Not Ego. What happens when findings are in the report and the organization tries to make them smaller. How to think about severity in a way the standards do not always capture, and what the conversations on both sides of a finding tell you about an organization.
Part 6: Fixing the Issue Is the Real Issue. The closer. What separates the organizations that get better from the organizations that do not. The diagnostic question that sorts every program I have ever assessed.
Who This Is For
If you run a security program, you are the primary audience. The series is built to help you recognize the failure modes early and steer your organization through them before they undermine the work you are trying to do.
If you do this work from the assessment side, the series is also for you. The patterns are easier to navigate when you have a vocabulary for them, and a lot of the moves in the series are ones I wish I had been taught earlier in my own career.
If you are a leader who funds, sponsors, or sets direction for a security program without doing the day-to-day work, the series is especially for you. Most of the failures the series describes get produced or prevented at the leadership level, sometimes through choices made offhandedly in meetings that did not feel like they mattered at the time.
What This Series Is Not
It is not a how-to guide for running a red team operation. There are good guides out there for that, and I am happy to point at them in other posts.
What this series is, and what I want to spend a moment on, is a set of posts about the part of offensive security work that does not usually get written about.
As I state in my introdution to ItsBroken, I have been doing communications and cybersecurity for over 15 years. I spent three years on the Marine Corps Red Team. I spent another three years as a consultant at SpecterOps. Across those six years I have done a lot of the technical work people associate with offensive security. The tooling, the tradecraft, the access, the report writing on the technical side. I have also done a lot of work that is not technical at all, and that part of the job is what this series is about.
The technical side of offensive consulting is important and it is well documented. There is a substantial library of public material on how to compromise an environment, how to operate inside a network without being caught, how to develop capabilities, how to use the tooling, how to think about the adversary models that drive an engagement. Researchers and practitioners publish constantly. Conferences are full of it. The technical conversation in this field is robust and self-sustaining.
The other half of the job is consulting. Talking to clients. Setting expectations. Delivering hard news. Reading the room before the outbrief begins. Negotiating scope with a leader who does not want the assessment to happen and a security team that is anxious about what it will find. Sitting with an administrator who is defending a position you can see is wrong. Walking a commander through a finding without making the commander defensive. Knowing when to push and when to back off, and recognizing that the goal is the work getting fixed, not the assessor getting credit. None of those skills are technical. All of them shape whether the technical work produces value.
That side of the job rarely gets written about. There is some published material on it, but the volume is a small fraction of what gets published on the technical side. The result is that practitioners often learn the consulting side the slow way, by making mistakes in front of clients and trying to remember what they wished they had done differently. The skills compound over time, but the compounding is private. The lessons do not get shared.
This series is part of an effort to share some of those lessons. The six posts are organized around specific failure modes in the assessor-client relationship, but the broader thread underneath them is the consulting side of the work. How to talk to people. How to listen to them. How to make sure the technical work, which most of us have already invested years in getting good at, actually produces the outcomes it was supposed to produce. That thread is going to keep showing up across my writing on this site, not just in this series. The technical work is well covered elsewhere. The other side of the job is what I want to spend my writing time on.
A few other things worth naming up front, since this is the introduction.
This series is not a critique of any specific institution. I am hardest on the Marines because the Marines are the institution I served in and the one I care most about getting right. The same patterns show up in private sector organizations, and the series names them in both contexts. The point is the pattern, not the institution.
It is not advice you can apply with one decision. The work of moving an organization from red-versus-you to red-versus-blue is sustained, deliberate, and usually slow. The series will give you a vocabulary and a set of diagnostics, not a magic phrase that fixes the culture overnight.
Start Here
If you read only one post in the series, read Part 1. It carries the thesis and most of the framing. The other five posts extend it in specific directions, and they can be read in any order once you have the foundation from Part 1.
If you read the series in order, the arc takes you through the full lifecycle of an assessment and lands the diagnostic question at the end of Part 6. That question is the test for whether your organization is doing this right.
I will be publishing the six posts on a regular cadence. This introduction is the front door.
Thanks for reading.
Red vs Blue is the exercise. Red vs You is the failure mode. The whole series is about how to stay on the right side of that line.