Which practice is part of red-teaming best practices?

• A. Publish threat models to inform independent assessments.
• B. Use a single attack surface to focus testing.
• C. Delay mitigations after testing.
• D. Leak weak points to external parties to speed up defense.

Answer: (A)

Red-teaming emphasizes testing defenses by simulating adversaries in a controlled way, and a key practice is publishing threat models to inform independent assessments. Threat models lay out what assets matter, who the potential attackers are, and what capabilities they might use. When assessors have access to these models, they can align their testing with real risks, understand the scope clearly, and avoid duplicating effort or missing critical attack paths. This transparency also provides a solid basis for evaluating whether defenses cover the intended scenarios, making the findings more actionable and credible.

Relying on a single attack surface narrows the view and leaves other vulnerabilities unexamined. Delaying mitigations after testing sustains risk and misses the chance to strengthen defenses promptly. Leaking weak points to external parties is unsafe and inconsistent with responsible testing practices, which rely on controlled engagements and agreed-upon disclosure channels.