Over the past year I was asked by SURF to help set up a red-teaming framework specifically for the Dutch education and research sector. The outcome — ART-SURF (in Dutch) a sector-tailored implementation of the Advanced Red Teaming (ART) approach — takes the core strengths of TIBER (threat-intelligence led, realistic actor emulation, strong governance) and wraps them in a more modular, practical programme that fits universities, colleges and research institutes.
Why a sector-specific approach?
Education and research organisations have, because of their expertise and knowledge combined with an atmosphere of open collaboration, a distinctive risk profile. ART for this sector keeps the focus on threat intelligence and realistic testing while reducing unnecessary overhead. The framework is modular so institutions can choose the intensity and components that match their maturity, budget and governance needs.
How the ART-SURF programme works (high level)
ART-SURF is structured in three phases — Prepare, Test, Close — with clear milestones and optional and mandatory modules:
- Prepare (initiation & scoping, procurement): identify critical functions, assign codenames, set up the Control Team and agree the test scope and rules of engagement.
- Test (threat intelligence, red team execution, Purple team workshop): SURFcert produces the threat intelligence for the specific organisation; the red team convert that intelligence into realistic attack plans (mapped to frameworks such as MITRE ATT&CK); the red team test is executed and after the active phase the Red and Blue teams run a Purple team workshop to replay findings and maximise learning.
- Close (mitigation, board reporting, lessons sharing): institutions produce mitigation plans, present outcomes to their board level, and share lessons within SURF-facilitated sector forums so the whole community benefits.
This structure preserves TIBER’s high standards of testing while making participation more accessible for education & research organisations.
My role and cross-sector experience
I worked with SURF and its members to tailor the ART framework to the education and research sector: adjusting modules and governance so tests are safe, insightful and actionable. I’ve also helped other sectors — including the Central Government and the healthcare sector in the Netherlands— to set up ART-based red teaming. This framework builds upon the lessons from these other sectors. Across sectors the approach is consistent: start with threat intelligence, design realistic scenarios, ensure executive sponsorship and translate findings into funded mitigation work.
Practical benefits for participating organisations
- Threat-intelligence driven tests focused on an institution’s critical functions rather than generic checklists.
- Controlled, board-sanctioned exercises with test management to reduce escalation risk and maximise learnings.
- Concrete learning through Purple team workshops and a mitigation plan build upon root cause vulnerabilities, so findings become real security improvements rather than a report that sits on a shelf.
- Sector learning and collaboration via lesson sharing facilitated by SURF.
Want this for your organisation?
If your organisation would like help designing, scoping or running ART-style red teams (framework design, procurement guidance, test management or workshop facilitation), please contact me directly — I’m happy to discuss options and share lessons from recent sector roll-outs.
If you are an organisation in the education and research sector and want to start an ART assessment through SURF, contact SURF at [email protected].