Providing different services to the organization
A useful way to look at an offensive security program is that it is providing services to the organization. If the reader is familiar with red teams that focus on business processes or other aspects of an organization, this topic is primarily focused on the cybersecurity angle.
Providing service offerings means that other business groups, blue teams, and employees are our customers, so to speak. The modes of operation, responsibilities, and tasks of the penetration test team can differ quite a bit depending on what the scope and responsibilities are. It might or might not include design-level work and reviews such as threat modeling, but it certainly should include hands-on offensive penetration test work and finding and exploiting vulnerabilities for defensive purposes. Most of these services revolve around alternative analyses.
The following subsections are a list of services a penetration test team might provide to its customers...
