Safeguard Red Team: Defensive Adversary Emulation

AdvancedFree5 modules · 15 lessons · ~2 min

About this course

Learn to run Safeguard's Red Team engine as defensive adversary emulation against assets your organisation owns and has explicitly authorised, building MITRE ATT&CK driven emulation plans, closing the loop with blue team detection engineering through purple team sessions, and reporting findings to technical and executive audiences. Authorisation discipline, in scope assets only and a strict no destructive technique rule are taught throughout, not as a preamble but as the frame the whole practice runs inside.

What you'll learn

Authorisation and Scope

Authorisation Discipline: Written Scope and In-Scope Assets Only
Rules of Engagement: No Destructive Techniques, No Third-Party Targets
Framing Red Team Work as Defensive Emulation

ATT&CK-Driven Emulation

Building an Emulation Plan from MITRE ATT&CK
Emulating Initial Access and Execution Techniques
Emulating Persistence, Privilege Escalation and Defense Evasion

Detection Engineering Value

Emulating Lateral Movement and Collection Safely
Command and Control Emulation Patterns
Mapping Emulation Results to Detection Coverage

Purple Team Loops

Running a Purple Team Session

01Authorisation and Scope3 lessons

Authorisation Discipline: Written Scope and In-Scope Assets Only
Rules of Engagement: No Destructive Techniques, No Third-Party Targets
Framing Red Team Work as Defensive Emulation

02ATT&CK-Driven Emulation3 lessons

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.

Measuring Detection Gaps and Mean Time to Detect

Iterating: From Gap to Detection Rule

Reporting and Program Maturity

Writing the Red Team Report for Technical and Executive Audiences
Prioritising Remediation from Emulation Findings
Building a Continuous Adversary Emulation Program

Building an Emulation Plan from MITRE ATT&CK

Emulating Initial Access and Execution Techniques

Emulating Persistence, Privilege Escalation and Defense Evasion

03Detection Engineering Value3 lessons

Emulating Lateral Movement and Collection Safely
Command and Control Emulation Patterns
Mapping Emulation Results to Detection Coverage

04Purple Team Loops3 lessons

Running a Purple Team Session
Measuring Detection Gaps and Mean Time to Detect
Iterating: From Gap to Detection Rule

05Reporting and Program Maturity3 lessons

Writing the Red Team Report for Technical and Executive Audiences
Prioritising Remediation from Emulation Findings
Building a Continuous Adversary Emulation Program2 min

What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.