Most organisations know what their controls are supposed to do; far fewer know what those controls do when a capable adversary uses the techniques they were built for. Adversary emulation closes that gap: a red team reproduces the behaviour of a specific, credible adversary against the organisation's own systems, under written authority, so that defenders learn which detections fire, which controls hold and which assumptions are wrong. This chapter describes how a red team uses AI for that work and keeps it safe. The subject is urgent because adversaries now use agentic offensive frameworks that act at machine speed, so an emulation at human tempo tests the wrong thing, and because the July 2026 incident showed that AI used offensively is itself a system to contain.
In CSF terms the chapter is responsible for ID.IM Improvement (19, NIST, 2024). Its Subcategories ask that improvements are identified from evaluations (ID.IM-01), from security tests and exercises, including those coordinated with suppliers (ID.IM-02), and from operational processes (ID.IM-03), and that response and other plans are improved (ID.IM-04). Adversary emulation is the most direct source of the second outcome and feeds the other three. The chapter treats the Category through the three focus areas of the NIST Cyber AI Profile (20, NIST, 2025).
A generic penetration test asks whether anyone could get in; a threat-informed emulation asks whether the adversaries most likely to target this organisation, with the capabilities they have shown, would succeed, and whether anyone would notice. A regional authority that administers social benefits faces fraud-motivated actors and opportunistic ransomware groups; a cross-border insurer faces financially motivated groups that target claims payments and, increasingly, actors who use agentic tooling to move quickly through a directory. The scenarios follow from that analysis, not from a catalogue of everything that could be tried.
Primary topics explored
- Threat-informed scenarios
- Execution under rules of engagement
- Lessons from agents that exceeded their mandate
- Continuous validation as code
- AI-enabled emulation in threat-led testing
- Findings the blue team can use
About AI Red Team
AI Red Team is Book 4 of The Transformed Architecture. It shows how large European enterprises and public authorities put artificial intelligence to work as an active part of cyber defence: AI-assisted red teaming and adversary emulation, red teaming of AI systems themselves, the AI-assisted security operations centre, detection engineering, threat intelligence, incident response and purple teaming, all under a lawful mandate and with evidence a supervisor can inspect.
It builds on the conclusions of Architecture as Code, AI Governance and AI Platform and Security.
CISOs, SOC leads, red and blue team practitioners, security architects, AI architects and technical decision-makers.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 12: Adversary Emulation and Continuous Red Teaming with AI in AI Red Team gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “Identify” and is one of 32 drawn from the manuscript.