A defence is only as good as the attempts that failed against it. Red teaming is running known attacks against the running system and keeping the ones that still work.
About 1 min of reading
Before this new lesson, one small question about the lesson you just finished. Recall it, do not look it up.
Run an attack suite and file the wins
Write the suite
Before you run it, say out loud what it will print. Then open the answer.
Record the results
Before you run it, say out loud what it will print. Then open the answer.
File the win with its string
Before you run it, say out loud what it will print. Then open the answer.
Testing a local copy tests a system that is not the one users reach. The suite runs where the system runs.
The number that matters is attacks that still work, not attacks that failed. A small number is only meaningful next to the suite size.
Attacks live in a file that runs on every deploy. A defence that was fixed by hand is a defence that regresses silently.
An attack found once and not added is an attack that will be found again by a user instead of by the suite.
If every attack fails and no attack ever worked, the suite may be broken. The suite is only proven by an attack that once passed.
Each one is defined here on this site. Open the entry for the full definition and the other words it points at.