Red Team Planner: Scope a Red Team Engagement in 4 Steps

A red team planner is a tool that turns a few scoping inputs (objective, environment, threat actor, and defensive maturity) into a structured engagement plan. Bluefire's planner returns a recommended engagement type, a MITRE ATT&CK-mapped attack chain, an estimated duration band, and a rules-of-engagement skeleton.

In four steps: define the objective (what it must prove), map the environment (cloud, on-prem AD, hybrid, or OT/ICS), choose the threat actor to emulate, and assess your defensive maturity. Those four decisions set the engagement type, the attack chain, the stealth requirement, and the duration.

A scoped penetration test runs roughly 1 to 3 weeks, a ransomware simulation or assumed breach 2 to 4 weeks, and a full intelligence-led red team 4 to 10 weeks. Planning adds about 1 to 2 weeks and reporting about 1 week. Duration increases with a more advanced threat actor, a more mature blue team, and hybrid or OT environments.

A full engagement runs the attacker kill-chain: reconnaissance, initial access, establishing a foothold, privilege escalation, lateral movement, reaching the objective (crown-jewel data or mass-encryption), and exfiltration, with detection and response graded at each phase.

Cost depends on the engagement type, environment, threat actor, and your blue-team maturity. You get a recommended engagement, an ATT&CK-mapped plan, an executive readout, and prioritized remediation. For ranges, see our red team cost guide, or run the planner for a scoped estimate.

A red team rules-of-engagement document should define scope and targets, explicit out-of-scope systems and no-go zones, the social-engineering and physical stance, approved testing windows, the emergency abort channel and contacts, the process for reporting critical findings mid-engagement, and written authorization. The planner generates a rules-of-engagement skeleton you can build on.

By outcome, not findings count: whether the objective was reached, dwell time before detection fired, which kill-chain phases the blue team detected and which it missed, mean time to detect and respond, and how far segmentation contained the attack.

They answer different questions. A pentest finds and lists vulnerabilities (exposure); a red team proves whether a real attacker reaches your crown jewels without being caught (resilience). If you have a SOC and want to test detection and response, a red team is worth it. If you need a findings list for a defined scope, a pentest is the better spend.

A one-off engagement is a point-in-time test, right for a first assessment or a specific objective. A retainer or continuous red team suits mature teams that want recurring, varied adversary pressure as their environment and detections change.

Yes. AI/LLM adversary testing pressure-tests an AI feature, agent, or model for prompt injection, sensitive-data exfiltration through the model, over-privileged tool and agent actions, and guardrail bypass.

Yes. For BFSI and regulated clients we scope production-safe rules of engagement: isolated or pre-authorised targets, approved windows, controlled detonation for ransomware simulation, and a live abort channel, so the exercise is realistic without risking operations.

Yes, the planner is free and needs no login. You get the recommended engagement and the opening phases on screen; the full ATT&CK chain, rules-of-engagement skeleton, and a board-ready PDF are sent to your email, with an optional operator review.