When red teams go off the rails, who’s at fault?

This report analyzes annual incident data to show red teams often prioritize tactics (e.g., initial access, privilege escalation, lateral movement, credential dumping) that differ from real-world attacker activity (discovery, defensive evasion, persistence, impact, exfiltration), and recommends calibrating red team scopes, playbooks, and rules-of-engagement to mirror observed TTP frequency so defenses and detection efforts align with actual threats.