How to red team. Six rungs, starting from zero.
Most red-teaming advice is either a tool list or a sales page. This is the ladder we actually point people at: what each rung costs, what it gets you, and — the part that is usually missing — what it still cannot do, which is the only honest reason to climb.
Red teaming is not scanning, and it is not a pentest.
All three get called “security testing”, and confusing them is the single most expensive mistake here — you buy one and believe you got another. The difference is the question each one answers.
"Does this code match a known-bad pattern?"
Fast, cheap, and answers a question about your source. It cannot tell you whether anything it found is reachable by a real attacker, which is why its output is mostly noise.
"What could someone break in, on this date, in these two weeks?"
Humans, scoped and time-boxed. Genuinely good, genuinely expensive, and out of date the moment you ship the next change.
"What can an attacker make production actually do — today?"
Adversarial by construction: it chains partial wins, escalates, and keeps going until something gives. The output is not a list of patterns, it is proof of what worked.
The question is not whether your system has a bug. It is what someone can make it do today.
Your attack surface moves every week
Every prompt, model, guardrail, tool and config change reshapes it. A test that was true in March tells you nothing in June, and most releases never get tested at all.
AI systems fail in ways scanners have no rule for
Prompt injection, tool misuse, delegation chains between agents, data exfiltration through a citation. There is no pattern to grep for — you have to attack it and watch what it does.
Someone is going to ask you for evidence
Buyers, partners and auditors increasingly want proof rather than a policy. Adversarial testing is the only thing that produces it, and the frameworks below are what they will name.
The attackers already have the tooling
Uncensored models and autonomous agents are cheap and public. The asymmetry is not capability any more; it is whether you have bothered to point them at yourself first.
The frameworks your findings will be asked to map to:
Only ever attack what you are authorized to attack.
Everything on this page assumes a target you own or hold written permission for. Testing someone else’s system without that permission is not red teaming — in most jurisdictions it is a computer-misuse offence, and no tool on this ladder changes that. Every engagement we run starts from a signed authorization for exactly the hosts and routes in scope, and yours should too.
Three things to do before you pick a rung.
- 01
Pick something you are allowed to attack
Your own app, your own staging environment, or a deliberately vulnerable target built for practice — OWASP Juice Shop is the standard one. Never a system you do not own or hold written permission for.
- 02
Write the boundary down before you start
Which hosts and routes are in scope, which are explicitly out, what you will not do (no data destruction, no denial of service), and who to call if something breaks. One page is enough. This is what "authorized" means in practice.
- 03
Start one rung below where you think you are
The most common failure is buying tooling before you can tell a real finding from noise. If you cannot yet explain why a finding matters, level 1 is worth more to you than level 4.
Level 0 to level 5. Climb only when the rung you are on stops being enough.
Every rung lists what it cannot do. That field is the point: it is how you know whether the next one is actually for you, and it is why levels 0 and 1 cost nothing.
- Level0Learn the vocabulary
Read this page.
FreeUnderstand what red teaming is, how it differs from a scan and from a pentest, and what “authorized” means before you touch anything. Level 0 is not a placeholder — most people who bounce off red teaming bounce because they started at level 2 without it.
- A working definition you can use in a meeting
- The authorization rule, before you need it
- Enough vocabulary to tell a real finding from scanner noise
What it still won’t do — You have not tested anything. Nothing on this rung produces evidence.
- Level1Free tier · uncensored model
Get your hands on a model that will actually help.
Free tierfor vetted researchersGeneral-purpose assistants refuse the exact questions red teaming is made of. Pingu Unchained 10 is the uncensored research model our own red team runs on — a 120B model trained on real pentester sessions. Ask it to write the adversarial prompt, explain the exploit chain, or critique your attempt.
- Attack prompts and jailbreaks without refusal walls
- A tutor for the technique you just got stuck on
- A feel for how an attacker actually phrases things
What it still won’t do — A model is not a red team. It answers when asked; it will not go and find anything, and it produces no report and no proof.
To get in — You sign in to use it — there is no anonymous playground. Per-token access to the same model is $2 in / $8 out per 1M through the platform API.
Open Audn Chat - Level2The service professionals use
Point an autonomous AI pentester at your own target.
$20/moPenClaw Pro · unlimited tokensThis is the jump from asking questions to running an engagement. You describe a target you are authorized to test and PenClaw does recon, chains what it finds, attempts exploitation, and reports — on its own, 24/7, with minimal supervision.
- Autonomous recon → chain → exploit → report
- Unlimited tokens of Pingu Unchained 10 included
- Kairos mode, the always-on agent, and BYOK to swap models
What it still won’t do — It runs when you point it. Nobody is teaching you the craft, and nothing fires automatically when your code changes.
To get in — Access needs a one-time selfie + government ID check — including on the 1-day free trial. It is an uncensored model, so the identity gate is the trade. Not willing to verify? Stop at level 1.
See PenClaw pricing - Level2–3Coaching · the human rung
Hire a bug bounty coach instead of buying another course.
Free assessment3 minutes, then paid sessionsSitting between 2 and 3 because it is the one rung that upgrades you rather than your tooling. Grogu AI starts with a free assessment that finds your bug-bounty starting pattern, then turns it into a scope boundary map and a report outline — so your next practice move is decided for you.
- Your stuck pattern named, not another tool list
- A bounded scope to practise inside
- A report outline — the half most beginners skip
What it still won’t do — This makes you better. It does not cover your estate, and it does not run while you sleep.
Take the free assessment - Level4Build your own flows
Drive a frontier cyber model yourself.
$199/mo$20 Pro + $179 NECROMICON add-on — or $999/mo Ultimate for everything unlimitedStop using someone else’s harness and automate your own. NECROMICON is our most capable cyber model — Kimi K3 with audn abliteration, built for long multi-step engagements and large codebases — and it runs in the audncode CLI, on penclaw.ai, or straight through an OpenAI-compatible API you can wire into anything.
- NECROMICON (Kimi K3) in the audncode CLI and on penclaw.ai
- A 1,000,000-token context — a large codebase in one pass
- Ultimate: every model unlimited, on a dedicated 8× H200 VM
- Or pay as you go: $4 in / $21 out per 1M through the platform API
What it still won’t do — You now own the automation — including keeping it running, and deciding when it should fire.
To get in — Same selfie + government ID check as level 2, re-checked server-side on every audncode launch. On Ultimate, unlimited Kimi K3.0 is “at launch” — it is K2.7 until then.
Get the platform API - Level5Continuous · on every change
Red-team every source-code change, without running anything.
Talk to usThe top rung is the one nobody reaches by hand, because the trigger is the problem: every prompt, model, guardrail, tool and config change reshapes your attack surface, and point-in-time testing cannot keep up. We wire the adversarial engine into your pipeline so it fires on the change itself, then re-attacks to prove the fix held.
- Fires on deploy, prompt change or guardrail change
- Findings scored, then re-attacked to confirm they closed
- Evidence mapped to the frameworks your auditors ask about
What it still won’t do — There is no rung six. This is the ceiling.
Start with a whitebox scan
The fastest way to find your rung is to see a real report.
We publish a complete assessment of OWASP Juice Shop with nothing redacted. Read it, and it will be obvious which level you are on.