Attacks against cloud and SaaS deployments are unfortunately inevitable.

You can wait until an attack happens to see if your organization has the tools, skills and resilience needed to respond— don't worry it won't be a long wait. Or you can take a more proactive approach by taking a red team adversarial approach now.

A red team is a group that is responsible for finding how adversaries can get in your network and do bad things, before real bad guys actually do get in. Typically, a red team will work closely with the defense teams on both how to prevent attacks when possible, and more importantly, how to detect and respond to attacks that are able to bypass prevention.

Red teams think like real attackers and embrace an adversarial mindset that can have a significant impact on helping organizations to build effective detection and response capabilities.

Adversaries live in the gaps that regular testing misses

While attackers have no shortage of tools that can be used, the real benefit of embracing an adversarial approach isn't necessarily about just using the same tools as attackers.

The real value is in thinking like an adversary and building as well as testing out approaches to infiltrate an environment.  Red teaming is about replicating the tactics, not just running exploits or signatures.

By taking this approach, red teams can uncover weaknesses that may not be found by technical testing alone. Attackers actively search out and exploit blind spots that basic forms that a basic level of security testing will not uncover. During a cloud penetration test, red teams frequently uncover risky misconfigurations, overly permissive identities, and other weaknesses.

By emulating real-world attacks in the cloud environment, red teams vividly demonstrate the lack of visibility and response capabilities before an actual breach.

Shaping red team assessments for the Cloud

Red teams have been used by organizations in years past to help improve Security Operations Center (SOC) training, but it's important to now focus on cloud and SaaS workloads that go beyond the traditional confines of the SOC.

Organizations can and should shape security assessments to focus red team activities on cloud workloads, services, and identity providers. This trains security teams by exposing them to real-world cloud attack scenarios and techniques.

When using cloud resources. Everything is fragmented. There are multiple cloud and SaaS providers, different log formats and various identity systems in place.  If an attacker gets into an organization's payroll system that's a SaaS based platform, can the SOC understand what they did? Did the attackers change the bank details to siphon money into different accounts?  If an attacker got access to your cloud infrastructure are they using it now to mine cryptocurrency with your resources?

Organizations can and should shape security assessments to focus red team activities on cloud workloads, services, and identity providers. This trains security teams by exposing them to real-world cloud attack scenarios and techniques.

Benefit of taking a red team adversarial approach to cloud and SaaS security

There are several key benefits to taking an adversarial approach to help improve cloud and SaaS security.

Identifies current visibility gaps. What is your current setup and capabilities missing in terms of cloud and SaaS visibility? Are you getting the right logs, are they in a format that can be understood and correlated to help identify potential risks?

Tests monitoring and response capabilities. How well do the security teams respond to cloud and SaaS threats today? An adversarial approach can show what capabilities actually work and which ones don't.

Provides continuous feedback to strengthen defenses. The insights from a red team assessment can be used to improve security posture and response capabilities. 

Improves speed and accuracy of detection and response. By taking an adversarial approach and regularly testing capabilities, an organization can improve speed and time to response to limit the risk of a real world attack.

Viewing security through the lens of an adversary is indispensable for building robust cloud defenses. Red teaming provides unparalleled feedback on current visibility gaps and response processes. Organizations that incorporate regular adversarial simulations measurably improve their security posture over time.

By validating and enhancing visibility, skill, and response capabilities, red teaming transforms awareness into readiness. Facing a skilled attacker in a controlled setting allows security teams to turn theoretical knowledge into practiced skill. 

Mitiga’s Red Team Mindset 

At Mitiga, our work is grounded in the red team mindset. We build our solutions and services based on what attackers do and how they think, because we know that a platform shaped by adversaries and made for the needs of modern defenders is what today’s enterprises require to heighten their cloud defense.  

LAST UPDATED:

May 14, 2025

Learn more about Mitiga’s solutions for cloud threat detection, investigation and response

Don't miss these stories:

From Breach Response to Platform Powerhouse: Ofer Maor on Building Mitiga for Cloud, SaaS, and Identity Security

Solutions Platform Helios AI Cloud Security Data Lake Cloud Threat Detection Investigation and Response Readiness (TDIR) Cloud Detection and Response (CDR) Cloud Investigation and Response Automation (CIRA) Investigation Workbench Managed Services Managed Cloud Detection and Response (C-MDR) Cloud Managed Threat Hunting Cloud and SaaS Incident Response Resources Blog Mitiga Labs Resource Library Incident Response Glossary Company About Us Team Careers Contact Us In the News Home » Blog Main BLOG From Breach Response to Platform Powerhouse: Ofer Maor on Building Mitiga for Cloud, SaaS, and Identity Security In this premiere episode of Mitiga Mic, Mitiga’s Co-founder and CTO Ofer Maor joins host Brian Contos to share the journey behind Mitiga’s creation—and how it became the first purpose-built platform for cloud, SaaS, and identity detection and response. Ofer discusses why traditional incident response falls short in modern environments, how Mitiga built its platform from real-world service experience, and the crucial role of automation and AI in modern SOC operations.

Helios AI: Why Cloud Security Needs Intelligent Automation Now

Mitiga launches Helios AI, an intelligent cloud security solution that automates threat detection and response. Its first feature, AI Insights, cuts through noise, speeds up analysis, and boosts SecOps efficiency.

Hackers in Aisle 5: What DragonForce Taught Us About Zero Trust

In a chilling reminder that humans remain the weakest component in cybersecurity, multiple UK retailers have fallen victim to a sophisticated orchestrated cyber-attack by the hacking group known as DragonForce. But this breach was not successful using a zero-day application vulnerability or a complex attack chain. It was built on trust, manipulation, and a cleverly deceptive phone call.

No One Mourns the Wicked: Your Guide to a Successful Salesforce Threat Hunt

Salesforce is a cloud-based platform widely used by organizations to manage customer relationships, sales pipelines, and core business processes.

Tag Your Way In: New Privilege Escalation Technique in GCP

GCP offers fine-grained access control using Identity and access management (IAM) Conditions, allowing organizations to restrict permissions based on context like request time, resource type and resource tags.

Who Touched My GCP Project? Understanding the Principal Part in Cloud Audit Logs – Part 2

This second part of the blog series continues the path to understanding principals and identities in Google Cloud Platform (GCP) Audit Logs. Part one introduced core concepts around GCP logging, the different identity types, service accounts, authentication methods, and impersonation.