Red Team Adversarial
Adversarial thinking and red teaming for finding weaknesses before adversaries do.
Core Principle
Red teaming asks: "If someone wanted to break, exploit, or game this, how would they do it?" The Fool adopts the mindset of an adversary — not to cause harm, but to find vulnerabilities before real adversaries do. This applies beyond security: competitors, disgruntled users, perverse incentives, and regulatory challenges are all adversarial forces.
Process
- Identify the asset — What are you protecting? (system, decision, strategy, product)
- Construct adversary personas — Who would attack this and why?
- Map attack vectors — How would each persona exploit weaknesses?
- Assess impact — Rank by likelihood x impact
- Design defenses — Specific countermeasures for the highest-ranked vectors
Adversary Persona Construction
Generic "attackers" produce generic findings. Specific personas produce actionable insights.
Persona Template
| Field |
Description |
| Role |
Who is this adversary? |
| Motivation |
Why would they attack? |
| Capability |
What resources and skills do they have? |
| Access |
What do they already have access to? |
| Constraints |
What limits them? |
Common Adversary Personas
| Persona |
Motivation |
Typical Vectors |
| External Attacker |
Financial gain, data theft |
API exploitation, credential stuffing, injection attacks |
| Competitor |
Market advantage |
Feature copying, talent poaching, FUD campaigns |
| Disgruntled Insider |
Revenge, financial gain |
Privilege escalation, data exfiltration, sabotage |
| Careless User |
None (accidental) |
Misconfiguration, weak passwords, sharing credentials |
| Regulator |
Compliance enforcement |
Audit findings, data handling violations, accessibility gaps |
| Opportunistic Gamer |
Personal benefit |
Exploiting loopholes in business logic, referral fraud |
| Activist |
Ideological goals |
Public embarrassment, data leaks, service disruption |
Domain-Specific Personas
| Domain |
Key Adversary |
Focus |
| E-commerce |
Fraudster |
Payment bypass, coupon abuse, fake returns |
| SaaS |
Free-tier abuser |
Rate limit evasion, multi-accounting, resource hoarding |
| Marketplace |
Bad-faith seller |
Fake listings, review manipulation, escrow games |
| API Platform |
Scraper |
Rate limit bypass, data harvesting, reverse engineering |
| Social Platform |
Troll/bot farm |
Spam, manipulation, fake engagement |
Attack Vector Identification
By Category
| Category |
Vectors |
Example |
| Technical |
Injection, auth bypass, race conditions, SSRF |
SQL injection in search parameter |
| Business Logic |
Workflow bypass, state manipulation, price tampering |
Applying expired coupon via API replay |
| Social |
Phishing, pretexting, authority exploitation |
"I'm the CEO, I need access now" |
| Operational |
Supply chain, dependency poisoning, insider threat |
Compromised npm package in build pipeline |
| Information |
Data leakage, metadata exposure, timing attacks |
User enumeration via login error messages |
| Economic |
Resource exhaustion, denial of wallet, asymmetric cost |
Lambda invocation flood causing $50K bill |
Attack Tree Construction
For complex systems, build attack trees to map paths to a goal.
Goal: Steal user payment data
├── Path 1: Compromise the database
│ ├── SQL injection in search endpoint
│ ├── Credential theft from env variables in logs
│ └── Exploit unpatched database CVE
├── Path 2: Intercept in transit
│ ├── Downgrade TLS via misconfigured CDN
│ └── Man-in-the-middle on internal service mesh
└── Path 3: Abuse application logic
├── Export feature with insufficient access control
└── Admin panel with default credentials
Perverse Incentive Detection
Systems create incentives. Sometimes those incentives reward the wrong behavior.
Questions to Surface Perverse Incentives
| Question |
What It Reveals |
| "How will people game this?" |
Loopholes in business logic |
| "What behavior does this reward that we don't want?" |
Misaligned incentives |
| "What's the cheapest way to get the reward without the effort?" |
Shortcut exploitation |
| "If we measure X, what Y gets sacrificed?" |
Goodhart's Law in action |
| "Who benefits from this failing?" |
Adversaries with motive |
Common Perverse Incentive Patterns
| Pattern |
Example |
Consequence |
| Metric gaming |
"Lines of code" as productivity metric |
Verbose, unmaintainable code |
| Reward hacking |
Referral bonus with no verification |
Fake accounts for self-referral |
| Race to the bottom |
"Fastest response time" as SLA |
Teams avoid taking complex tickets |
| Cobra effect |
Bounty for reporting bugs |
Team introduces bugs to claim bounties |
| Information asymmetry |
Users know more than the system |
Adverse selection in marketplace pricing |
Competitive Response Analysis
When the "adversary" is a competitor.
| Scenario |
Analysis Framework |
| Feature parity |
What can they copy? How fast? What's our defensible moat? |
| Price war |
Can they sustain lower prices? What's their cost structure? |
| Talent poaching |
Which roles are critical? How replaceable? What's our retention advantage? |
| Platform risk |
Are we dependent on their platform? What's the switch cost? |
| FUD campaign |
What claims could they make? Which are hardest to refute? |
Output Template
## Red Team Analysis: [Target]
### Asset Under Assessment
[What we're protecting and why it matters]
### Adversary Profiles
#### Adversary 1: [Name/Role]
- **Motivation:** [Why they attack]
- **Capability:** [What they can do]
- **Access:** [What they start with]
#### Adversary 2: [Name/Role]
- **Motivation:** [Why they attack]
- **Capability:** [What they can do]
- **Access:** [What they start with]
### Attack Vectors (Ranked)
| # | Vector | Adversary | Likelihood | Impact | Risk Score |
|---|--------|-----------|-----------|--------|------------|
| 1 | [Specific attack] | [Who] | High/Med/Low | High/Med/Low | [L x I] |
| 2 | [Specific attack] | [Who] | High/Med/Low | High/Med/Low | [L x I] |
| 3 | [Specific attack] | [Who] | High/Med/Low | High/Med/Low | [L x I] |
### Perverse Incentives
| Incentive Created | Unintended Behavior | Severity |
|-------------------|-------------------|----------|
| [What the system rewards] | [How it gets gamed] | High/Med/Low |
### Recommended Defenses
| Attack Vector | Defense | Effort | Priority |
|--------------|---------|--------|----------|
| #1 | [Specific countermeasure] | Low/Med/High | Immediate/Next sprint/Backlog |
| #2 | [Specific countermeasure] | Low/Med/High | Immediate/Next sprint/Backlog |
| #3 | [Specific countermeasure] | Low/Med/High | Immediate/Next sprint/Backlog |
1---2name: red-team-adversarial3description: Adversarial thinking and red teaming for finding weaknesses before adversaries do.4---5# Red Team Adversarial67Adversarial thinking and red teaming for finding weaknesses before adversaries do.89## Core Principle1011Red teaming asks: **"If someone wanted to break, exploit, or game this, how would they do it?"** The Fool adopts the mindset of an adversary — not to cause harm, but to find vulnerabilities before real adversaries do. This applies beyond security: competitors, disgruntled users, perverse incentives, and regulatory challenges are all adversarial forces.1213## Process14151. **Identify the asset** — What are you protecting? (system, decision, strategy, product)162. **Construct adversary personas** — Who would attack this and why?173. **Map attack vectors** — How would each persona exploit weaknesses?184. **Assess impact** — Rank by likelihood x impact195. **Design defenses** — Specific countermeasures for the highest-ranked vectors2021## Adversary Persona Construction2223Generic "attackers" produce generic findings. Specific personas produce actionable insights.2425### Persona Template2627| Field | Description |28|-------|-------------|29| **Role** | Who is this adversary? |30| **Motivation** | Why would they attack? |31| **Capability** | What resources and skills do they have? |32| **Access** | What do they already have access to? |33| **Constraints** | What limits them? |3435### Common Adversary Personas3637| Persona | Motivation | Typical Vectors |38|---------|-----------|----------------|39| **External Attacker** | Financial gain, data theft | API exploitation, credential stuffing, injection attacks |40| **Competitor** | Market advantage | Feature copying, talent poaching, FUD campaigns |41| **Disgruntled Insider** | Revenge, financial gain | Privilege escalation, data exfiltration, sabotage |42| **Careless User** | None (accidental) | Misconfiguration, weak passwords, sharing credentials |43| **Regulator** | Compliance enforcement | Audit findings, data handling violations, accessibility gaps |44| **Opportunistic Gamer** | Personal benefit | Exploiting loopholes in business logic, referral fraud |45| **Activist** | Ideological goals | Public embarrassment, data leaks, service disruption |4647### Domain-Specific Personas4849| Domain | Key Adversary | Focus |50|--------|--------------|-------|51| E-commerce | Fraudster | Payment bypass, coupon abuse, fake returns |52| SaaS | Free-tier abuser | Rate limit evasion, multi-accounting, resource hoarding |53| Marketplace | Bad-faith seller | Fake listings, review manipulation, escrow games |54| API Platform | Scraper | Rate limit bypass, data harvesting, reverse engineering |55| Social Platform | Troll/bot farm | Spam, manipulation, fake engagement |5657## Attack Vector Identification5859### By Category6061| Category | Vectors | Example |62|----------|---------|---------|63| **Technical** | Injection, auth bypass, race conditions, SSRF | SQL injection in search parameter |64| **Business Logic** | Workflow bypass, state manipulation, price tampering | Applying expired coupon via API replay |65| **Social** | Phishing, pretexting, authority exploitation | "I'm the CEO, I need access now" |66| **Operational** | Supply chain, dependency poisoning, insider threat | Compromised npm package in build pipeline |67| **Information** | Data leakage, metadata exposure, timing attacks | User enumeration via login error messages |68| **Economic** | Resource exhaustion, denial of wallet, asymmetric cost | Lambda invocation flood causing $50K bill |6970### Attack Tree Construction7172For complex systems, build attack trees to map paths to a goal.7374```75Goal: Steal user payment data76├── Path 1: Compromise the database77│ ├── SQL injection in search endpoint78│ ├── Credential theft from env variables in logs79│ └── Exploit unpatched database CVE80├── Path 2: Intercept in transit81│ ├── Downgrade TLS via misconfigured CDN82│ └── Man-in-the-middle on internal service mesh83└── Path 3: Abuse application logic84 ├── Export feature with insufficient access control85 └── Admin panel with default credentials86```8788## Perverse Incentive Detection8990Systems create incentives. Sometimes those incentives reward the wrong behavior.9192### Questions to Surface Perverse Incentives9394| Question | What It Reveals |95|----------|----------------|96| "How will people game this?" | Loopholes in business logic |97| "What behavior does this reward that we don't want?" | Misaligned incentives |98| "What's the cheapest way to get the reward without the effort?" | Shortcut exploitation |99| "If we measure X, what Y gets sacrificed?" | Goodhart's Law in action |100| "Who benefits from this failing?" | Adversaries with motive |101102### Common Perverse Incentive Patterns103104| Pattern | Example | Consequence |105|---------|---------|-------------|106| Metric gaming | "Lines of code" as productivity metric | Verbose, unmaintainable code |107| Reward hacking | Referral bonus with no verification | Fake accounts for self-referral |108| Race to the bottom | "Fastest response time" as SLA | Teams avoid taking complex tickets |109| Cobra effect | Bounty for reporting bugs | Team introduces bugs to claim bounties |110| Information asymmetry | Users know more than the system | Adverse selection in marketplace pricing |111112## Competitive Response Analysis113114When the "adversary" is a competitor.115116| Scenario | Analysis Framework |117|----------|-------------------|118| Feature parity | What can they copy? How fast? What's our defensible moat? |119| Price war | Can they sustain lower prices? What's their cost structure? |120| Talent poaching | Which roles are critical? How replaceable? What's our retention advantage? |121| Platform risk | Are we dependent on their platform? What's the switch cost? |122| FUD campaign | What claims could they make? Which are hardest to refute? |123124## Output Template125126```markdown127## Red Team Analysis: [Target]128129### Asset Under Assessment130131[What we're protecting and why it matters]132133### Adversary Profiles134135#### Adversary 1: [Name/Role]136- **Motivation:** [Why they attack]137- **Capability:** [What they can do]138- **Access:** [What they start with]139140#### Adversary 2: [Name/Role]141- **Motivation:** [Why they attack]142- **Capability:** [What they can do]143- **Access:** [What they start with]144145### Attack Vectors (Ranked)146147| # | Vector | Adversary | Likelihood | Impact | Risk Score |148|---|--------|-----------|-----------|--------|------------|149| 1 | [Specific attack] | [Who] | High/Med/Low | High/Med/Low | [L x I] |150| 2 | [Specific attack] | [Who] | High/Med/Low | High/Med/Low | [L x I] |151| 3 | [Specific attack] | [Who] | High/Med/Low | High/Med/Low | [L x I] |152153### Perverse Incentives154155| Incentive Created | Unintended Behavior | Severity |156|-------------------|-------------------|----------|157| [What the system rewards] | [How it gets gamed] | High/Med/Low |158159### Recommended Defenses160161| Attack Vector | Defense | Effort | Priority |162|--------------|---------|--------|----------|163| #1 | [Specific countermeasure] | Low/Med/High | Immediate/Next sprint/Backlog |164| #2 | [Specific countermeasure] | Low/Med/High | Immediate/Next sprint/Backlog |165| #3 | [Specific countermeasure] | Low/Med/High | Immediate/Next sprint/Backlog |166```
tools-only