Red Team Analysis

The Analysis That Felt Too Clean

A proposal lands on the desk of a senior reviewer. It is well-written, internally consistent, supported by authoritative sources, and reaches a conclusion that confirms the organisation’s prior intuition. Everyone on the drafting team agrees with it. Stakeholders consulted in the drafting process signalled no reservations. The document moves toward endorsement.

A few months later, the initiative derived from the proposal fails — not dramatically, but in a way that retrospectively reveals a gap nobody thought to address. The adversary behaved in a manner the analysis did not anticipate. A load-bearing assumption turned out to be wrong. A compliance mechanism was exploitable in a way nobody had imagined until it was exploited. The post-mortem produces the same exasperated conclusion every post-mortem reaches: the analysis was clean, the team was confident, and the blind spots were obvious once the event exposed them.

This pattern repeats across space policy, space architecture, and space security with discouraging regularity. It is the characteristic failure mode of analyses that have been stress-tested from within their own worldview and never seriously tested from the outside. Red team analysis is the discipline of testing from the outside — not as contrarianism, not as devil’s advocacy, but as a structured inhabitation of the adversary’s perspective, reasoning from the adversary’s constraints and logic rather than from our own.

The method’s quiet claim is that an analysis confident enough to act on must have survived contact with an intelligent opponent. If it has not, confidence in it is premature.

From War Rooms to Red Cells

Red teaming has military origins that predate its analytical formalisation. The practice of designating a force to play the opposing side in war games goes back at least to nineteenth-century Prussian Kriegsspiel, and both world wars institutionalised the use of opposition teams in operational planning. The vocabulary of red versus blue entered American military practice through Cold War wargaming at RAND and the Naval War College, where opposing teams were colour-coded and the discipline of reasoning from the adversary’s position became a standard feature of strategic exercise design.

The intelligence community absorbed the practice later. The most cited institutional marker is the CIA’s establishment of a Red Cell shortly after the events of 2001, created in part as a response to the catastrophic surprise of that moment and in part as a deliberate institutional counterweight to the groupthink pressures that post-mortems had identified in the analysis of the preceding decade. The Red Cell’s charter was to produce unconventional, outside-the-consensus readings on the questions the larger analytic apparatus was handling — not to replace mainstream analysis, but to stress-test it.

Adjacent disciplines shaped the method’s modern form. Richards Heuer’s work on structured analytic techniques, developed inside the intelligence community and published in more accessible form in the late 1990s and 2000s, placed red teaming alongside other cognitive debiasing methods. The cybersecurity industry, from the 1990s onward, developed penetration testing as a technical cousin of red teaming. Military concept developers working on the offence-defence balance in new domains, particularly space and cyber, extended the practice into architecture and doctrine review.

What is common across these lineages is an insight that looks banal and is not: organisations systematically underestimate vulnerabilities that, from an outside perspective, are visible. The underestimation is not stupidity; it is a structural feature of analysis produced from inside an organisation’s own assumptions. Red teaming is the disciplined correction.

The Characteristic Move

What red teaming does that neighbouring methods do not is force the analyst to reason from within a specific adversary identity rather than from a general critical posture. This is the difference between red teaming and devil’s advocacy, and it is decisive.

Devil’s advocacy is adversarial from outside. It produces arguments against a position by looking for weaknesses, regardless of whether any real actor would exploit those weaknesses or could. It is cheap to produce and often unhelpful, because an analysis vulnerable to theoretically possible objections is not the same as an analysis vulnerable to actual adversaries. Red teaming demands more: it requires the analyst to inhabit a specific opposing perspective — a particular adversary state’s space command, a commercial competitor, a proliferator, a sceptical ally — and to reason from that actor’s goals, constraints, capabilities, and strategic culture. The vulnerabilities identified are those the adversary would actually perceive and could actually exploit.

What distinguishes red teaming from other critical methods is the combination of specific adversary inhabitation, assumption classification, and constructive output. Backcasting stress-tests milestones against logical consistency; scenario planning generates divergent futures for environmental variables; resilience analysis assesses performance under disruption. Red teaming is the one method whose explicit purpose is to make the analysis survive intelligent opposition.

The Method at Work: Testing a Data-Sharing Agreement

Consider a proposed international agreement for space situational awareness data sharing. The agreement envisages that participating states and commercial operators will contribute conjunction data into a shared repository, with the expectation that improved collective awareness will reduce collision risk and that transparency will dampen escalation risk during ambiguous events. The drafters are proud of the design; consultations with friendly states have produced no serious objections; the agreement moves toward adoption.

A red team is convened. The adversary identity is specified: a peer-state space command operating under competitive strategic posture, with its own independent situational-awareness capability, a clear interest in preserving operational ambiguity around its own assets, and a strategic culture that views information asymmetry as a strategic advantage to be preserved rather than surrendered.

The assumption extraction produces three load-bearing assumptions. First, participants will share data honestly — that is, the data contributed will be accurate and complete. Second, shared data will improve collision avoidance — that is, the combined data set will be operationally usable. Third, transparency will reduce escalation risk — that is, ambiguity reduction is net stabilising. Each of the three is load-bearing; each is assumed without verification; each is plausible from inside the drafting team’s worldview.

The red team, reasoning from the adversary’s perspective, attacks the first assumption. The adversary has no intrinsic reason to share accurate data on its own assets. Its operational security depends on preserving uncertainty about the precise orbital parameters of strategic satellites. The agreement lacks verification; there is no mechanism to audit shared data against independent observation. The adversary’s rational course of action is to participate, share selectively degraded data on its own sensitive assets, and consume high-quality data on others’ assets — gaining operational intelligence while preserving its own advantage. The agreement, read from the adversary’s perspective, is an opportunity to acquire information cheaply while surrendering little.

The red team’s alternative hypothesis challenges the third assumption as well. Transparency is not monotonically stabilising. In a context of strategic competition, partial transparency — where the adversary possesses more complete information than the original participants — can increase rather than decrease escalation risk, because it enables the better-informed actor to act with precision on ambiguities that would otherwise have been treated cautiously. The agreement, in the red team’s reading, may make the aggressive actor more confident rather than more restrained.

The vulnerability finding is sharp. The critical flaw is not the data architecture, nor the governance structure, nor the participation model; it is the compliance assumption. Without verification, the agreement rewards defection. The hardening recommendation follows naturally: introduce a verification layer that audits shared data against independently observable tracks from allied or commercial sensors, with consequences for detected discrepancies. The recommendation does not kill the agreement; it names the missing component whose absence would have allowed intelligent defection to hollow the benefit out.

The finding is one the drafting team could not have reached from within its own worldview, because the drafting team was reasoning from the assumption that participants would act as described. It is the finding a red team exercise is uniquely positioned to produce.

Where It Holds, Where It Limps

Red teaming holds where an analysis or architecture is well-developed enough to have specific load-bearing assumptions and where the adversary the red team inhabits is concrete enough to reason from. For strategic publications in review, for security architectures before commitment, for treaty drafts before signature, for deterrence postures before deployment, it is the method that most reliably surfaces the vulnerabilities that internal review has missed.

Its weaknesses are precise. Quality depends on genuinely adopting an alien perspective. A red team conducted by analysts who do not understand the adversary’s strategic culture, or who slip back into home-worldview reasoning under pressure, produces surface contrarianism dressed in adversary costume. The discipline of inhabiting the adversary demands investment in adversary study, and shortcuts degrade the method rapidly.

The method is vulnerable to over-rotation. An aggressive red team can make any analysis look vulnerable, because sufficiently creative adversaries can exploit any assumption. Unbounded red teaming produces paralysis rather than improved judgement. Good red teams operate with clear success criteria — what counts as a material vulnerability versus a theoretical one — and the discipline to distinguish critical from minor findings.

Intelligence gaps cannot be closed by red teaming. If the adversary’s capabilities, intentions, or strategic culture are genuinely unknown, reasoning from that adversary’s position is speculative and the findings are correspondingly uncertain. The method does not create intelligence; it exploits what is available. The discipline is to declare information boundaries explicitly and to scope findings to the evidence.

Red teaming works poorly on vague objects. An analysis that is still sketchy has not yet crystallised into specific load-bearing assumptions; challenging it produces vague counter-claims. The method should be reserved for well-developed objects whose load-bearing structure is clear enough to attack.

Finally, red team findings are useless if they are dismissed for being uncomfortable. The method’s value depends on organisational willingness to hear unwelcome conclusions. A red team whose findings are softened during consumption, or whose recommendations are selectively ignored, has produced diagnostic work that will not translate into hardened architecture.

The method pairs naturally with game theory (which formalises adversary courses of action into strategic interactions), with scenario planning (which uses adversary courses of action as seeds for worst-case branches), with backcasting (which stress-tests milestone assumptions), and with decision-process analysis (which identifies procedural vulnerabilities that become red team targets).

A Note for the Practitioner