For weeks, a red team breaks into a bank, in the live environment and with the resources of a serious attacker. Then comes the moment the ethical hackers have to stop, and usually not because they’re stuck. The next step would disrupt the production system that real customers rely on, so that’s where the engagement ends.
“With a red team, you attack an organisation to test its cyber resilience, in the live environment. At some point you reach a stage where you can’t go any further, because it would cause a production issue. That’s when you raise the white flag, but really, you’re not done yet.” – Kelvin Rorive, Director at CCRC
The report shows what was possible. What would have happened next is nowhere to be found. That missing piece is exactly what gold teaming lets you practise.
Gold stands for the board, not the technology
Most security professionals are familiar with red teaming, where a team attacks the organisation. Blue teaming is the defending side, and purple teaming brings the two together. Gold teaming belongs in the same series, although here the colour says something about the level rather than the technique. British emergency services have long used a structure in which bronze is operational, silver tactical and gold strategic. In its guide, De Nederlandsche Bank (DNB), the Dutch central bank, describes the gold team as the team with ultimate responsibility for managing cyber crises at a strategic level. In practice, that’s the crisis management team or the board.
The term itself comes from Australia: DNB cites the CORIE framework from 2020 as its first mention. In the Netherlands, gold teaming is an optional module within ART (Advanced Red Teaming), a more flexible framework DNB introduced in 2024. It was added alongside two existing forms of red teaming in the financial sector: TIBER (Threat Intelligence-Based Ethical Red Teaming), under which DNB has large financial institutions tested on a voluntary basis, and TLPT (Threat-Led Penetration Testing), which is mandatory under DORA for designated financial institutions. That explains why the term is mainly known in the financial sector here.
The scenario is what the red team actually found
Where many crisis exercises start from an invented scenario, a gold teaming exercise starts from what the red team actually found: the artefacts, the weak spots and the route it took to get in. The scenario picks up the attack where the red team had to stop and lets it play out, so the board isn’t discussing a hypothetical ransomware attack, but one that has already been shown to work against their organisation.
DNB distinguishes three formats, increasing in length and pressure. A walk-through of at least two hours is a discussion of the scenario. A tabletop of at least three hours adds injects (new information that comes in during the exercise). A simulation of at least four hours also brings in time pressure and stress. After a discussion, you know what you would do. A simulation shows what you actually do when you have to choose while the clock is ticking, the press is calling and the technical team still doesn’t know how deep the attacker is. Picture the moment, an hour and a half into the exercise, when the spokesperson reports that a journalist has screenshots of customer data and the team has to decide whether to confirm, deny or ask for time, without knowing whether the data is real.
That’s why participants are deliberately kept out of the preparation: a crisis team that knows the scenario rehearses the script, not the decision.
The report that stays on the CISO’s desk
As the second objective of the module, DNB states that the strategic implications of technical findings should become accessible to senior management. With that, the regulator touches on a pain point in many red teaming engagements. The report is technical and thorough, but it’s read by the people who already know how vulnerable the organisation is, while those who have to decide on downtime, communication and paying a ransom stop at the summary.
Not just for banks
The financial sector is ahead with these kinds of exercises partly because the regulator laid down the framework itself. The question gold teaming asks, namely whether the board has ever practised with an attack that actually keeps going, applies just as much to an energy company, a water authority, a manufacturer or a food producer. There too, the technology has often been tested, while the crisis organisation has never been put to the test.
There is one caveat, which we’d rather make up front: gold teaming works best when a red team comes first, because then the findings are real. An organisation that has never had a red team can also run a simulation on a threat landscape, although the scenario then remains an assumption. That’s fine as a starting point, but if you want to know whether your organisation would survive its own attacker, you’re better off with a scenario built on real findings.
What you can do with this tomorrow
If a red teaming engagement is underway or planned, now is the time to ask what happens once the attackers stop, who is up at that point and whether that person or team has ever practised it. If the answer is “we’ll see when we get there”, you know which exercise is still missing.
At CCRC, we build this as a simulation, in which the red team findings form the scenario and the crisis team or board works through it under time pressure. The red team doesn’t have to be ours, because we build on the findings of whichever party carried out your test. Curious how your red team findings become a scenario? Book a call.