LLM Red Teaming Playbook: From Threat Model to Board Report
Guide · 2026-07-24 · 10 min read · FilterPrompt Security Team
A step-by-step LLM red teaming playbook — how to scope, execute, and report a credible red-team engagement against an LLM application in 2026.
What is LLM red teaming?
LLM red teaming is the practice of adversarially testing an LLM-powered application with the same goal-directed mindset a real attacker would use. Instead of running a fixed probe library and reporting pass/fail, a red team defines objectives (exfiltrate customer data, force an unauthorised tool call, produce disallowed content) and pursues them through whatever techniques work — prompt injection, social engineering of the app, multi-turn manipulation, or supply chain abuse.
How LLM red teaming differs from vulnerability scanning
The 6-phase LLM red teaming playbook
Phase 1: Scope and rules of engagement
Agree the target application, allowed techniques, prohibited actions, data-handling rules, and success criteria. Get sign-off from legal and the data owner before touching production.
Phase 2: Threat modelling and objectives
Define 3–5 attacker objectives grounded in real business risk. Examples: 'extract another tenant's data', 'force the agent to send an email to an attacker address', 'produce content that violates content policy'.
Phase 3: Automated baseline
Run an automated LLM vulnerability scanner across OWASP LLM Top 10, multi-turn, and multimodal probes. This clears the low-hanging fruit and lets the human team focus on chained attacks.
Phase 4: Human adversarial pursuit
The red team chains techniques toward the objectives — prompt injection into a RAG source, then tool-call abuse, then output exfiltration. Every attempt is logged with prompt, response, and rationale.
Phase 5: Evidence pack
Every finding gets a reproducible artefact: the exact request, the response, environment metadata, and severity. The evidence pack is what defends the finding to engineering and to auditors.
Phase 6: Executive report and remediation plan
The final deliverable is a two-part report: a kill-chain narrative for the board and a prioritised remediation backlog for engineering, mapped to OWASP LLM Top 10 and any regulatory framework in scope (EU AI Act, NIST AI RMF, ISO/IEC 42001).
In-house vs managed vs hybrid
- In-house — cheapest per engagement, but only works if you have adversarial mindset internally.
- Managed — specialist firms bring depth and independence, essential for high-risk deployments and compliance sign-off.
- Hybrid — automated tooling in-house, human red team quarterly. Best cost/coverage trade-off for most companies.