# Red Team

> Oyster's Red Team workspace — Scope, Recon, Planner, Fix Advisor and Code Lab — for planning and documenting authorized security assessments. Authorization comes first.

Source: https://documentation.redorca.ai/guides/red-team/
Last updated: 2026-11-01

:::caution[Authorized targets only — read first]
Only assess systems you own or have explicit, written authorization to assess. Testing anything else is likely illegal. You remain responsible for that authorization.
:::

Red teaming is authorized, goal-driven simulation of a real attacker, to find weaknesses before someone hostile does. Use it when you have permission to assess a system and want to know how it would fail.

Oyster's Red Team workspace helps you **plan, document and fix**. It writes; it does not scan, probe or run anything against any system. It needs an account and is in the sidebar under **Red Team**.

## The tools

| Tool | What it is for |
|---|---|
| [Scope](https://documentation.redorca.ai/guides/red-team/scope/) | Write down exactly what you are allowed to assess. The other tools check against it. |
| [Recon and Planner](https://documentation.redorca.ai/guides/red-team/plan-an-assessment/) | Turn an objective into a structured, methodology-backed plan for an in-scope target. |
| [Fix Advisor](https://documentation.redorca.ai/guides/red-team/fix-advisor-and-code-lab/) | Turn a finding into concrete remediation. |
| [Code Lab](https://documentation.redorca.ai/guides/red-team/fix-advisor-and-code-lab/) | A copy-only scratchpad for your own snippets. Nothing runs on Red Orca's servers. |
| [Findings](https://documentation.redorca.ai/guides/red-team/findings-and-reports/) | Record what you found, with evidence and a fix, and build the report. |

## A safe workflow

1. **Set the scope** in the engagement's project.
2. **Plan** with Recon or Planner for your objective.
3. **Do the testing yourself,** with your own tools and within your authorization, capturing evidence as you go.
4. **Record findings** and attach a remediation from Fix Advisor.
5. **Curate the report** so it tells a clean story: what, impact, proof, fix.

## What Oyster will and will not do

- It explains techniques, tools and defensive countermeasures, for learning and for authorized work.
- Target-specific plans are written only for targets inside your scope. For anything outside it, you get general methodology and a way to reproduce the question in your own lab instead.
- It never runs an action against a live system for an account. See [Safety and approvals](https://documentation.redorca.ai/understand/safety/).