How Red Teams Get In

Initial access is the phase people imagine as technical and which is mostly social. The routes below are roughly in the order they succeed.

1. Phishing

Still first, and the pretexts that work are dull rather than clever: an internal system requiring re-authentication, a document shared by a name the recipient recognises, a payroll or benefits notice at the right time of month.

What makes a red team's phishing different from a commodity simulation is phase-one reconnaissance. A message referencing a real project, from a real supplier, to the three people who would plausibly receive it, is a different proposition from a generic template sent to two thousand mailboxes — and the click rate reflects that.

Multi-factor authentication changes this but does not close it. Prompt fatigue, real-time relaying of a one-time code, and session token theft all remain available, which is why the interesting question is not "do we have MFA" but "which kind, and what happens when someone approves a prompt they did not expect".

2. The service desk

Frequently the single most effective route, and the one organisations least expect.

Someone calls, gives a name and a plausible reason, and asks for a password reset or an MFA re-enrolment. The information needed to sound convincing — employee number, manager's name, office location — is usually obtainable from phase one.

The finding is rarely "the agent was careless". It is that the verification procedure relies on facts that are not secret. That is a process fix, it is cheap, and it is uncomfortable to hear because it names a team rather than a system. Scoping this route needs deliberate thought about how results are reported — see scoping a red team.

3. Something exposed

The technical route, and it is usually not an exploit chain. It is an appliance a version behind, a management interface reachable from the internet, a forgotten host from a project that ended, or a credential in a public repository.

Edge devices — VPN concentrators, file transfer appliances, remote access gateways — are the recurring theme, because they are internet-facing by definition and patched on someone else's schedule.

4. Through the front door

Where physical scope is permitted. Tailgating, a plausible pretext and a visible jacket, or an unlocked side entrance. Covered in physical penetration testing.

What this means for spending

Three of the four routes are people rather than technology, and the technical one is mostly patching discipline on things at the edge.

That is worth holding next to a security budget. An organisation that has spent heavily on endpoint tooling and nothing on how its service desk verifies a caller has bought a strong answer to the fourth-most-likely route.