Topic route / 12
Red team operations
Authorized adversary operations measured through their business objective, runtime authority, technical actions, defender signals, response decisions, evidence, and verified recovery—not access alone.
Recommended order
Start here, then go deeper.
Follow an authorized operation from business objective and runtime authority through technical action, defender signal, decision, evidence, and verified recovery.
Full topic archive
Every matching record.
Methods and named-vulnerability research remain visually and editorially separate.