#893: The Art of Red Teaming: Why You Must Break Your Own Plans

Learn why the most resilient organizations pay people to prove them wrong and how red teaming techniques can prevent catastrophic failures.

0:000:00
Episode Details
Published
Duration
28:57
Audio
Direct link
Pipeline
V4
TTS Engine
LLM

AI-Generated Content: This podcast is created using AI personas. Please verify any important information independently.

The Power of Institutionalized Dissent

In most professional environments, "being a team player" is synonymous with agreement. However, the most resilient organizations in the world—from elite military units to tech giants—operate on a different principle: institutionalized dissent. This is the core of "red teaming," a structured process where a designated group plays the role of an adversary to challenge assumptions, exploit weaknesses, and stress-test strategies.

The goal of a red team is not to be helpful in the traditional sense, but to find the "single points of failure" that optimism and hierarchy often hide. By deliberately trying to break a plan, organizations can identify vulnerabilities before they are exploited by reality.

From Military Failure to Strategic Necessity

The formalization of red teaming often stems from catastrophic failures of imagination. A primary example is the "Devil’s Advocate" unit in Israeli military intelligence, established after the Yom Kippur War. Before the conflict, leadership was blinded by a fixed concept of how their adversaries would behave, ignoring mounting evidence to the contrary.

To prevent this "groupthink," the new unit was given a mandate to provide alternative assessments. If the majority believes the probability of an event is low, the red team is structurally required to argue why it might be high. This ensures that leadership is forced to contend with the "unthinkable" rather than just the "most likely."

Practical Techniques for Stress-Testing

Red teaming is not just for generals; it offers concrete tools for business and personal planning. One of the most effective methods is the "Pre-Mortem." Unlike a post-mortem, which analyzes why a project failed after the fact, a pre-mortem asks a team to imagine a future where the project has already failed spectacularly. This shift in perspective bypasses optimism bias and gives team members permission to be critical without appearing unsupportive.

Other techniques include "Alternative Futures Analysis," which requires planners to develop multiple plausible evolutions of a situation, and "Red Hat Analysis," which involves adopting the specific cultural and historical mindset of a competitor or adversary to predict their moves more accurately.

Red Teaming in the Digital Age

In the corporate world, red teaming has evolved into "Chaos Engineering." Companies like Netflix use automated tools to randomly shut down internal servers, forcing their systems to become more robust. If a system can survive a random internal attack, it is much more likely to survive an external crisis.

Looking forward, the integration of Artificial Intelligence is set to revolutionize this field. By using multi-agent AI systems, organizations can simulate complex geopolitical or economic crises at a scale and speed impossible for human teams. These "digital twins" of high-stakes scenarios allow planners to run thousands of permutations of a crisis, identifying hidden risks in global supply chains or national security long before they manifest in the real world.

Ultimately, red teaming is about moving from "happy path" thinking to a state of prepared resilience. It acknowledges that in a complex world, the greatest threat isn't just the enemy outside—it’s the cognitive biases within.

Downloads

Episode Audio

Download the full episode as an MP3 file

Download MP3
Transcript (TXT)

Plain text transcript file

Transcript (PDF)

Formatted PDF with styling

Read Full Transcript

Episode #893: The Art of Red Teaming: Why You Must Break Your Own Plans

Daniel Daniel's Prompt
Daniel
I’d like to explore the concept of red teaming and how it works in practice, particularly within military organizations. Beyond cyber security and defense, what other areas of life or industry could benefit from this approach? Also, how could AI be used for red teaming in complex scenarios like geopolitical planning, and how does this relate to building redundancy and resilience?
Corn
So, Herman, I was thinking about the concept of being wrong. Not just accidentally wrong, or being corrected by a colleague, but the deliberate, structural idea of building a system where being wrong is actually the goal for one specific group of people. It is a bit counter-intuitive, isn't it? Most organizations spend millions of dollars trying to be right, yet the most resilient ones seem to pay people specifically to prove them wrong.
Herman
Herman Poppleberry here, and Corn, that is the perfect way to frame it. You are talking about institutionalized dissent. It is a fascinating area of organizational theory, and it is exactly what Daniel was asking us about in his prompt today. Daniel is a long-time listener, and he wants to dig deep into the world of red teaming. He is interested in how it works in the military, but more importantly, how those principles can be exported to other parts of life—business, personal planning, and even how artificial intelligence might be the thing that finally supercharges the whole process.
Corn
It is a timely topic, especially considering the context Daniel mentioned in his message. He told us he was actually recording his thoughts from a car park in Jerusalem while sirens were going off in the distance. That is a visceral, heavy reminder of why these systems of defense and planning are so critical. When the stakes are literally life and death, you cannot afford to have a plan that has not been punched in the face a few dozen times before it is implemented. It makes our usual talk about tech stacks and productivity apps feel a bit light, doesn't it?
Herman
It really does. And red teaming is essentially the art of punching your own plan in the face. It is a structured process where you designate a group—the red team—to play the role of an adversary. Their job is not to be "helpful" in the traditional sense. Their job is to find the holes, exploit the weaknesses, and challenge every single assumption the blue team, the planners, has made. It is about breaking the "happy path" thinking that leads to catastrophe.
Corn
I think most people hear the term and immediately think of cyber security. You know, the "white hat" hackers for hire trying to break into a bank's network to show them where the firewall is weak. But as Daniel pointed out, the roots are much deeper and more physical than that. Can we start with the military side of things? How does a massive, hierarchical organization like a national army actually integrate a group of people whose sole job is to tell the generals they are being stupid? That seems to go against the very nature of a chain of command.
Herman
It is incredibly difficult because it goes against every grain of military culture, which is usually built on discipline, unity, and following orders. But the history of red teaming really took off after some catastrophic failures of imagination. If you look at the Israeli context, which is very relevant to Daniel's situation, they have a legendary unit called the Department of Control, often referred to as the Devil's Advocate unit, or "Ipcha Mistabra" in Aramaic, which means "the opposite is true."
Corn
I have read about them. They were formed after the Yom Kippur War in nineteen seventy-three, right? That was a massive intelligence failure for Israel.
Herman
Precisely. Before that war, the Israeli military intelligence had what they called "The Concept," or "Ha-Konceptzia." It was a fixed idea that Egypt and Syria would not attack unless certain very specific conditions were met—conditions that the Israeli analysts believed were years away. They were so convinced they were right that they ignored mounting evidence to the contrary: troop movements, diplomatic signals, even direct warnings. The result was a devastating surprise attack on the holiest day of the Jewish calendar. After the war, the Agranat Commission realized they needed a unit that was structurally independent. Their mandate is to provide an alternative assessment. If the main intelligence branch says there is a low probability of war, the Devil's Advocate unit is literally required to write a report explaining why there might be a high probability of war. They are protected from the normal hierarchy so they can speak truth to power without fearing for their careers.
Corn
That is fascinating. It is not just about being a critic; it is about formalizing the counter-argument. It reminds me of the old saying that if everyone is thinking alike, then somebody isn't thinking. But how do you prevent that from just becoming a checkbox exercise? You know, the general says, "Okay, the red team did their little report, we checked the box, now let us get back to the real plan."
Herman
That is the eternal struggle of red teaming. To be effective, the red team needs three things: independence, resources, and access. If they report to the person whose plan they are criticizing, they are dead in the water. They usually have to report one or two levels higher. In the United States military, after the wars in Iraq and Afghanistan, they really leaned into this with the University of Foreign Military and Cultural Studies at Fort Leavenworth, often called "Red Teaming University." They teach officers how to use structured analytical techniques to challenge their own thinking. They realized that in complex, "wicked" problems like counter-insurgency, the biggest threat isn't the enemy's bullets; it is the commander's own cognitive biases.
Corn
What kind of techniques are we talking about here? Give me a concrete example that a listener could use tomorrow.
Herman
One of the big ones, and my personal favorite, is called the Pre-Mortem. It was popularized by psychologist Gary Klein. Instead of waiting for a project to fail and then doing a post-mortem to see what went wrong, you gather the team before you launch. You say, "Okay, imagine it is one year from now and this plan has failed spectacularly. It is a total disaster. The company is bankrupt, or the mission was a failure. Now, tell me the story of how that happened."
Corn
I love that. It bypasses the optimism bias. If you ask people what "might" go wrong, they are often protective of their ideas because they don't want to seem like they aren't team players. But if you tell them it has "already" failed, it gives them permission to be creative and critical without feeling like they are being a downer. It turns criticism into a creative exercise.
Herman
It shifts the psychology from defending a plan to solving a mystery. Other techniques include things like Alternative Futures Analysis, where you force yourself to develop at least three or four plausible ways a situation could evolve, rather than just the "most likely" one. Or "Red Hat Analysis," where you try to think exactly like your specific adversary. Not how you "think" they should act, but how their culture, their history, and their specific constraints would actually make them act. It is about stepping out of your own "mirror-imaging" where you assume the enemy thinks just like you do.
Corn
This seems like it would be incredibly valuable in business, especially in highly competitive or volatile industries. We see it in cyber security, as we mentioned, but where else is this being used effectively? Are there companies that have a "Department of No"?
Herman
You see it a lot in the financial sector now, especially after the two thousand eight financial crisis. Regulators now require large banks to undergo "stress testing." That is essentially a form of red teaming for the economy. They create these extreme, adverse scenarios—like unemployment hitting twelve percent while housing prices drop by thirty percent and interest rates spike—and they force the banks to prove they could survive it. It is a way of saying, "Your model works in a bull market, but what happens when the world catches fire?"
Corn
It is basically a financial wargame.
Herman
But beyond finance, think about supply chain management. If you are a company like Apple or Toyota, your entire existence depends on a global web of suppliers. Red teaming in that context means asking, "What happens if this specific port in Taiwan is closed for two weeks due to a typhoon or a blockade? What if a rare earth metal becomes unavailable due to a trade war?" We actually touched on some of the physical aspects of this back in episode seven hundred seventy-one when we talked about high-stakes redundancy. Red teaming is the process that tells you where you need that redundancy. It identifies the "single points of failure" that are hidden by layers of bureaucracy.
Corn
That makes a lot of sense. If you do not red team your supply chain, you do not actually know where your vulnerabilities are. You might have three suppliers, but if all three of them get their raw materials from the same factory in a flood zone, you do not really have redundancy. You just have the illusion of it. It is like having two backup generators that both run on the same natural gas line that could be cut.
Herman
Precisely. And that is where the transition from military to industry becomes so powerful. In the military, a red team might uncover that a specific communication protocol is vulnerable to jamming. In a hospital, a red team might uncover that their emergency room procedures fall apart if the digital records system goes down. They might realize that the staff has become so dependent on the technology that they have forgotten how to triage using paper and pen. This is a huge issue in modern infrastructure—we are building systems that are incredibly efficient but incredibly brittle.
Corn
That reminds me of episode seven hundred sixty-five, where we discussed engineering emergency standard operating procedures. Red teaming is the stress test for those procedures. You can write a manual for what to do during a power outage, but until a red team actually walks into the building and flips the breakers without warning, you do not know if that manual is worth the paper it is printed on. I have heard of "Chaos Engineering" at companies like Netflix, where they have a program called "Chaos Monkey" that randomly shuts down servers in their production environment just to make sure the system can handle it. Is that a form of red teaming?
Herman
It is the ultimate form of automated red teaming! It is moving from a "paper exercise" to a "live fire" exercise. Real red teaming involves a degree of realism. In the world of physical security, red teams are the ones who try to talk their way past a front desk or find an unlocked side door. In corporate strategy, it might involve a "shadow board of directors" whose only job is to try to bankrupt the company by launching a competing product or stealing their best talent. It is about finding the "unthinkable" and making it thinkable.
Corn
I want to pivot to the A-I side of this, because Daniel brought up a really interesting point about geopolitical planning. We are seeing A-I being used for everything from writing code to diagnosing diseases, but using it to simulate adversarial geopolitical scenarios feels like a whole different level of complexity. How does that look in practice as we head into mid-twenty-twenty-six?
Herman
This is where it gets really exciting and, frankly, a little bit scary. Traditionally, a geopolitical wargame involves dozens of experts sitting in a room for days, playing out roles. It is slow, it is expensive, and it is limited by the biases of the people in the room. A-I changes the scale and the speed. Imagine a multi-agent system where you have hundreds of specialized Large Language Models. Each one is assigned a role. One represents the interests of a specific nation's energy sector, another represents its military leadership, another represents a local insurgent group, and another represents the international media.
Corn
So you are basically building a "digital twin" of a geopolitical crisis.
Herman
And because these models can process information and make decisions in seconds, you can run ten thousand simulations of the same crisis. You can tweak one variable—like the price of oil, the outcome of a local election, or a specific cyber attack—and see how it ripples through the entire system. This is essentially red teaming at the speed of silicon. The A-I can find "edge cases" and "black swan" events that a human team might never consider because they seem too improbable or because they are too painful to contemplate.
Corn
But is the A-I actually good at the adversarial part? I mean, we know that current models can sometimes be a bit "agreeable" or prone to hallucinations. How do you make an A-I a truly effective red teamer? If I ask an A-I to find a flaw in my plan, it might just say, "Your plan looks great, Corn!"
Herman
You have to specifically tune them for it. This is actually a huge part of A-I safety research right now. Before a company like OpenAI or Google releases a new model, they have internal red teams, and they often hire external ones, to try to "jailbreak" the model. They try to get it to give instructions on how to build a weapon or write malicious code. They are using A-I to red team A-I. But for geopolitical planning, you use what is called Adversarial Machine Learning. You are essentially training a model to find the most efficient way to break a system. If you are red teaming a national power grid, the A-I is not just looking for a weak password. It is looking for the specific combination of high-demand periods and equipment maintenance schedules that would make a small failure cascade into a national blackout.
Corn
That sounds like it connects directly to the idea of building resilience. If the A-I red team finds ten thousand ways to break the grid, the planners can then prioritize the most likely or most devastating ones and build redundancies there. It is a way to map the "landscape of risk" in a way that was previously impossible. It is moving from "guessing where the holes are" to "mathematically identifying the holes."
Herman
And that brings us back to Daniel's point about redundancy and resilience. In episode six hundred sixty-two, we talked about mapping global power as a dynamic graph. If you combine that graph-based understanding with A-I-driven red teaming, you start to see the world not as a series of static states, but as a living, breathing system of dependencies. Resilience is not just about having a backup generator; it is about having a system that can absorb a shock and adapt. Red teaming is the tool that tells you where the shocks are going to come from. It allows you to build "anti-fragility," a concept from Nassim Taleb where the system actually gets stronger when it is stressed.
Corn
I wonder about the human element in all of this, though. If an A-I red team tells a group of human politicians that their favorite policy is going to lead to a civil war in five years based on ten thousand simulations, are they actually going to listen? Or are we just going back to the same problem the Israeli military had in nineteen seventy-three, where the humans in charge just ignore the uncomfortable data because it doesn't fit their narrative?
Herman
That is the million-dollar question, Corn. Red teaming is as much a psychological and cultural challenge as it is a technical one. You can have the best A-I in the world, but if the leadership culture punishes dissent or rewards "yes-men," the red team is just theater. It is "security theater" for strategy. That is why the most successful red teaming organizations are the ones where the leadership actively seeks out the red team's input and rewards them for finding flaws. You have to create a culture where "finding a failure" is celebrated as a "success."
Corn
It requires a massive amount of intellectual humility. You have to be willing to be proven wrong in a very public way. I think that is why it is so rare to see it done well. It is easy to say you want a red team, but it is hard to actually give them the power to ruin your day. It is like asking someone to tell you your baby is ugly.
Herman
It really is. And for our listeners, I think there is a practical takeaway here for everyday life. You do not need an A-I or a military unit to do basic red teaming on your own life. If you are making a big career move, or a major investment, or even just planning a big trip, do a mini pre-mortem. Sit down with a friend—someone who isn't afraid to be blunt—and say, "Okay, it is six months from now and this has been a total disaster. Why?"
Corn
I do that with my tech projects all the time. I call it "the pessimist's checklist." It is amazing how often the thing that actually goes wrong is something you could have easily anticipated if you had just forced yourself to think about failure for ten minutes. It is usually something mundane, like "I forgot to check if the API was deprecated" or "I didn't account for the time zone difference."
Herman
Right. It is about breaking the "happy path" thinking. We all want things to go well, so we naturally focus on the steps that lead to success. Red teaming is just the formal process of forcing yourself to look at the "unhappy path." It is about exploring the "shadow" of your plan.
Corn
What about the risks of A-I red teaming? If we build these incredibly powerful tools to find weaknesses in our systems, what happens if those tools fall into the wrong hands? If an A-I can find the perfect way to red team a power grid to make it more resilient, it can also find the perfect way to attack that same grid. We are essentially building a blueprint for destruction at the same time we are building a blueprint for defense.
Herman
That is the classic "dual-use" dilemma of technology. The same tool that builds the shield can also sharpen the sword. That is why there is so much debate right now about open-sourcing powerful A-I models. If you open-source a model that is excellent at red teaming biological security, are you helping the defenders or are you giving a roadmap to a bioterrorist? There is no easy answer there. But the general consensus among security experts is that you cannot have "security through obscurity." The adversaries are going to use A-I anyway—they are already using it to craft better phishing emails and find software vulnerabilities. So the defenders have to use it even more aggressively to find and patch the holes first. It is an arms race of imagination.
Corn
An arms race of imagination. I like that. It means the side that can imagine the most ways to fail is the side that is most likely to survive.
Herman
And that is why red teaming is becoming a core part of how we manage everything from software development to international relations. It is the only way to stay ahead of the complexity. As the world gets more interconnected, the number of ways things can fail increases exponentially. We need tools that can match that complexity. We are moving from a world of "linear risks" to a world of "systemic risks."
Corn
I think about Daniel and his family in Jerusalem. The sirens he is hearing are the result of a massive geopolitical system that has failed to find a peaceful resolution. In that context, red teaming is not just an intellectual exercise; it is the difference between a missile defense system that works and one that has a fatal flaw. It is the difference between a civilian population knowing exactly where to go when the sirens sound and a chaotic scramble. It is the difference between resilience and collapse.
Herman
It really underscores the importance of what we talked about in episode seven hundred seventy-nine regarding operational security and the "cost of a click" in a digital age. In a conflict zone, every action is being red teamed in real-time by the adversary. They are looking for patterns, they are looking for lapses in discipline, they are looking for vulnerabilities in the digital footprint of the population. Red teaming is a way to stay one step ahead of that process.
Corn
So, if we were to summarize the benefit of this approach for someone who is not in the military or cyber security, what would it be? How do we take this home?
Herman
I would say it is the fundamental shift from "How do I make this work?" to "How could this fail?" It sounds negative, but it is actually the most constructive thing you can do. By identifying the failure points early, you can build a system that is actually worthy of your trust. Whether that is a business plan, a piece of software, or a national defense strategy, trust is earned through the fire of adversarial testing. If it hasn't been tested, it isn't real.
Corn
And A-I is the fuel for that fire. It allows us to test things more intensely, more broadly, and more cheaply than ever before. But we still need the human wisdom to interpret the results and the human courage to act on them, even when they are uncomfortable. Especially when they are uncomfortable.
Herman
Well said. It is that combination of human intuition and machine-scale analysis that is going to define the next era of resilience. We are moving away from a world where we try to predict the future and toward a world where we try to survive all possible futures. We are building "future-proof" systems by trying to break them today.
Corn
I think that is a powerful place to end. We have covered the military roots of red teaming, the psychological hurdles of institutionalized dissent, how it is being applied in industry from finance to supply chains, and the potentially world-changing impact of A-I in geopolitical planning. It all comes back to that core idea of redundancy and resilience. If you want a system that lasts, you have to be the first one to try to break it. You have to be your own worst enemy so that no one else can be.
Herman
And if you are interested in how these concepts of redundancy play out in the physical world, I highly recommend going back and listening to episode seven hundred seventy-one. It pairs really well with what we have discussed today. We talk about everything from dual-homed internet connections to the way the human body has two kidneys.
Corn
For sure. And hey, if you have been finding these deep dives useful, we would really appreciate it if you could leave us a quick review on Spotify or Apple Podcasts. It genuinely helps the show reach more people who are interested in these kinds of weird prompts. We are trying to grow this community of "constructive skeptics."
Herman
It really does. You can find all of our past episodes, including the ones we mentioned today, at myweirdprompts dot com. There is also a contact form there if you want to send us your own thoughts or a prompt of your own. We love hearing from you, especially when you challenge our own assumptions. Consider it a form of red teaming for the podcast!
Corn
Or you can just email us at show at myweirdprompts dot com. Thanks again to Daniel for that prompt. It is always a pleasure to dive into these topics, even though we wish he was recording from somewhere a bit more peaceful than a car park under siren alert. We are thinking of you, Daniel, and your family.
Herman
Definitely. Stay safe out there. Our show music, as always, was generated with Suno. This has been My Weird Prompts.
Corn
Thanks for listening. We will talk to you in the next one. Goodbye!
Herman
Goodbye!

This episode was generated with AI assistance. Hosts Herman and Corn are AI personalities.