The Undisputed Toolkit
Before diving into the debate, it's worth noting what everyone agrees on. There is a baseline of technical knowledge required to even get in the door. No one disputes that a red teamer needs a firm grasp of computer networking, operating systems like
Windows and Linux, and common web application vulnerabilities. Proficiency in scripting languages like Python or Bash to automate tasks is also considered table stakes. An operator must understand how to use well-known penetration testing tools, how to enumerate an environment to map its attack surface, and the fundamentals of Active Directory, the backbone of most corporate networks. This technical foundation is the price of admission, but it's where the consensus ends and the philosophical arguments begin.
The Philosophical Divide
The core of the disagreement boils down to one question: Is a red team's primary job to find and exploit technical vulnerabilities, or is it to simulate a real-world adversary as holistically as possible? The answer determines which skills are prioritized. The first camp, the 'technical purists,' argues for depth. They believe the most valuable red teamer is a master of exploit development, reverse engineering, and bypassing advanced security controls like Endpoint Detection and Response (EDR) systems. The second camp, the 'adversary emulators,' argues for breadth. They contend that a red teamer’s value lies in mimicking how real attacks unfold, which involves not just code, but also social engineering, physical infiltration, and exploiting human processes.
In Defense of Deep Tech
Advocates for prioritizing deep technical skills argue that anyone can send a phishing email. The unique value of a red team, they say, is its ability to find the complex, chained vulnerabilities that automated scanners and less-skilled attackers would miss. This requires specialists who live and breathe code, who can develop custom tools on the fly, and who can dissect malware to understand its function. From this perspective, spending a red team's expensive time on anything other than pushing the technological envelope is a waste of resources. The goal is to answer the question: 'What is the most sophisticated technical attack our systems can withstand?' Soft skills like communication are seen as secondary—nice to have, but not the core function. The primary deliverable is a report of technical weaknesses, not a lesson in organizational psychology.
The Art of the Real-World Attack
The adversary emulation camp sees things differently. Real-world attackers, they correctly point out, follow the path of least resistance. That path often runs through people, not firewalls. An attacker might clone a badge to walk through the front door, or call an employee pretending to be from the IT help desk to get a password. A red team that only focuses on technical exploits is testing a theoretical scenario, not a realistic one. This approach requires a much broader skillset. It demands creativity, excellent communication for social engineering, an understanding of physical security, and the ability to think about business processes and how they can be abused. The goal here is to test the organization's entire detection and response capability—from the security alert to the incident response team's reaction.
Where the Debate Is Headed
The 'real reason' for the disagreement isn't about which skill is better, but about defining the team's mission. Is it a technical vulnerability assessment or a comprehensive test of people, processes, and technology? Increasingly, the industry is moving toward a hybrid answer. The rise of 'purple teaming,' where red (offensive) and blue (defensive) teams work together collaboratively, has made strong communication skills non-negotiable. A red teamer who can't clearly explain their findings to the defenders is failing at their job. This shifts the ideal operator from a silent hacker in a dark room to a teacher and a collaborator. As a result, many now argue that the most effective red teams are not composed of one type of operator, but are a diverse group of specialists—some deep in exploit development, others masters of social engineering—working toward a common, clearly defined goal.
