Red Team Program Effectiveness Assessment

Welcome! This survey (approximately 14 minutes) asks about your experience with our red-team program over the past 12 months. Your participation is voluntary, and you may stop at any time. There are no right or wrong answers—we want your honest perspective based on direct experience. All responses are confidential and will be reported only in aggregate to improve the program.

Which best describes your primary involvement with red-team exercises in the past 12 months?

• Consume findings to make decisions
• Implement technical fixes
• Defensive operations / blue team
• Product or operations stakeholder
• Compliance / governance
• Executive / leadership sponsor
• Other

Approximately how many red-team exercises have you directly engaged with in the past 12 months?

• 0 (aware but not directly engaged)
• 1–2
• 3–5
• 6–10
• More than 10

The following questions ask how well red-team exercises covered key areas in the past 12 months. If you lack direct experience with an area, select the midpoint.

How well did red-team exercises cover application-layer security (web, mobile, APIs)?

How well did red-team exercises cover infrastructure and cloud environments?

How well did red-team exercises cover identity and access management (authentication/authorization)?

How well did red-team exercises cover third-party and supply-chain risks?

How well did red-team exercises cover social engineering and human factors?

How well did red-team exercises cover physical security?

Overall, how confident are you that red-teaming is currently focused on our highest-risk areas?

Please rank the following areas by where additional red-team focus would most reduce organizational risk over the next 6 months (top = highest priority).

1. Application layer (web, mobile, APIs)
2. Infrastructure and cloud
3. Identity and access management
4. Third parties and supply chain
5. Social engineering and human factors
6. Physical security

In your view, which specific areas are most under-tested relative to their potential business impact? (Select up to 3)

• Crown-jewel applications
• Secrets management
• Privilege escalation paths
• Data exfiltration routes
• Human factors / social engineering
• Third-party integrations
• Cloud control plane
• Lateral movement
• Other (please specify)

What reporting cadence do you prefer for red-team results and trends?

• After each exercise
• Quarterly rollup
• Biannual
• Annual
• On-demand only
• Not sure

Please rank the following elements of a red-team report from most to least valuable to your work.

1. Executive summary with business impact
2. Attack narrative / timeline
3. Evidence and impact detail
4. Reproduction steps / proof-of-concept
5. Exploitability / likelihood rationale
6. Prioritized remediation plan

Red-team reports are delivered in a timely manner relative to exercise completion.

Red-team reports clearly communicate business impact alongside technical findings.

Remediation recommendations in red-team reports are specific and actionable.

Red-team reports contain the right level of technical detail for my needs.

Findings in red-team reports are prioritized effectively by risk severity.

Overall, how valuable are red-team findings to your work?

In your experience, how quickly are teams typically able to act on red-team findings after report delivery?

What most commonly hinders follow-through on red-team findings? (Select up to 3)

• Limited engineering bandwidth
• Disagreement on risk or severity
• Unclear ownership of findings
• Tooling or visibility gaps
• Vendor or third-party dependency
• Competing priorities
• Budget constraints
• Other (please specify)

Please share one example from the past 12 months where a red-team finding led to a meaningful improvement or fix. If none comes to mind, you may skip this question.

How would you rate the overall maturity of our red-teaming program today?

If you could change one thing about the red-team program for the next cycle, what would it be?

You've shared thoughts on improving the red-team program. Could you elaborate on what specific changes would have the greatest impact on your team's security posture?

Based on your responses in this survey, please share any additional thoughts or suggestions about the red-team program that we haven't covered.

Which best describes your primary organizational function?

• Engineering / Development
• Security (including blue team)
• IT / Infrastructure
• Product / Operations
• Compliance / Risk / GRC
• Executive / Leadership
• Other

What is your role level?

• Individual contributor
• Manager
• Senior manager
• Director
• VP / C-level
• Other / Prefer not to say

How long have you been in your current role at this organization?

• Less than 1 year
• 1–2 years
• 3–5 years
• 6–10 years
• More than 10 years

Where are you primarily located?

• Americas
• EMEA
• APAC
• Prefer not to say

Thank you for your time. Your input directly informs how we improve red-team coverage, reporting, and overall program impact.