Red teaming

Article 26 of DORA requires financial entities identified by their competent authority to run threat-led penetration testing (TLPT) at least every three years on live production systems, building on the TIBER-EU framework the ECB published in 2018. That is red teaming in the strict sense: a mandated team, under written rules of engagement, attacks the target the way a real adversary would, mixing technical intrusion, social engineering and sometimes physical access. A standard pentest lists vulnerabilities. The red team sets out to show what a compromise would cost the organization's mission, against a blue team trying to detect and contain it. When the two work side by side, it is called purple teaming. The term comes from military war-gaming. In AI, it means the systematic effort to get a model, before deployment, to produce harmful or biased outputs, or outputs that break its instructions. Seven providers made that commitment to the White House in July 2023, and the EU AI Act requires documented adversarial testing from providers of general-purpose AI models with systemic risk (Article 55). For the underwriter, a recent red-team report is part of the risk file. It gets read when pricing a cyber policy, and just as much when pricing an AI vendor's professional liability cover.