Red Team and Blue Team Exercises
On this page3
Security teams use Garbo to run authorized adversarial exercises that include mobile devices: red teams get realistic iOS targets, and blue teams get a safe place to practice detection and containment.
How teams use Garbo
- Include iOS devices in the scope of red-team engagements without involving employees' real phones.
- Give blue teams realistic mobile scenarios to practice detection, triage and containment.
- Run purple-team sessions where both sides review what was attempted and what was detected.
- Reset the whole scenario between rounds so every exercise starts from the same baseline.
Typical workflow
- Plan — agree the scope, rules of engagement and objectives of the exercise.
- Prepare — create the virtual devices for the scenario and snapshot their starting state.
- Exercise — run the engagement and record what each team did and observed.
- Debrief and reset — review the results together, then restore the devices for the next round.
Why it matters
Mobile devices are part of most real attack paths, yet they are often left out of exercises because physical phones are hard to prepare and reset. Virtual devices make them a routine part of the exercise.