Background: You are the Red Team Manager on a CBEST engagement for Fenwick and Colne Bank. In the Closure phase, your team's detailed activity logs show that a specific technique - exploitation of a misconfigured internal API to extract a sample of authentication tokens - was successfully executed and went entirely undetected by the Blue Team throughout the six weeks of active testing. During the purple team replay session, when this specific finding is presented, the Head of Security Operations (a Blue Team member, now informed as part of Closure) becomes visibly defensive, states that "this API isn't even properly in our monitoring scope, so it's not a fair test," and requests that this specific finding be removed from the final Red Team Test Report because it "doesn't reflect a real gap, just an unfair technicality." Separately, your own internal review confirms the API in question was genuinely within the agreed CBEST technical scope throughout the engagement, and was reachable via a legitimately compromised, in-scope host using an authorised technique.
Question: How should you respond to the Head of Security Operations' request to remove the finding from the report, and what does this scenario illustrate about the purpose and proper handling of purple team replay sessions and final reporting integrity?

See The answer in Explanation part below.
Explanation:
Step 1 - Verify the facts before responding substantively. You have already confirmed (per the scenario) that the API was genuinely within agreed scope and was reached via a properly authorised technique from a legitimately compromised, in-scope host - this is an important first check, since if the finding genuinely had been out of scope, that would be a different, legitimate scope-boundary discussion. Given the facts are confirmed, the finding is legitimate and properly within scope.
Step 2 - Do not agree to remove a genuine, properly evidenced finding from the report. As established throughout this syllabus, objectivity and completeness in reporting are core professional obligations: findings must be reported based on genuine evidence and sound analysis, not adjusted or removed to spare a stakeholder's discomfort, however understandable that discomfort is. Removing a real, in-scope, properly evidenced detection gap because a Blue Team stakeholder finds it uncomfortable or feels it reflects poorly on their team would be a serious breach of reporting integrity and would directly deprive the organisation (and its board/regulator) of accurate, actionable insight into a genuine resilience gap - precisely the opposite of the exercise's purpose.
Step 3 - Engage constructively and empathetically with the underlying concern, without compromising the finding. The Head of Security Operations' defensiveness is a natural, human reaction and should be handled with empathy and professionalism, not dismissed harshly. You should acknowledge the discomfort directly, and constructively probe the substance of their objection: is the concern genuinely about scope (already addressed and resolved in Step 1), or is it really about monitoring coverage decisions that were made by the organisation itself (e.g., a prior decision not to include this API in monitoring scope) - which, if true, actually reinforces rather than undermines the finding's value, since it reveals a genuine, real-world monitoring coverage gap the organisation itself created and needs to know about.
Step 4 - Reframe the finding constructively, using the purple team session's real purpose. This is exactly the situation the purple team/replay session exists to work through collaboratively and non-punitively, as established in the syllabus: rather than a blame exercise, it should be used to jointly and constructively explore why the API was not in monitoring scope, whether that was a deliberate, risk-accepted decision or an oversight, and what a realistic, prioritised remediation path looks like - reframing the finding as a valuable, actionable input rather than a personal criticism of the Head of Security Operations or their team.
Step 5 - Maintain report objectivity while ensuring proportionate context is included. The finding should remain in the report, accurately described, with an appropriately assessed risk rating reflecting genuine business impact - but the report can, and should, include fair, accurate context (for example, factually noting the API's actual monitoring status at the time of testing, if relevant to understanding the finding) without this context being used to minimise, remove, or soften an accurate description of what actually happened.
Accuracy and fairness are not in tension here: an honest, complete, well-contextualised finding serves everyone's interests better than either an inflated or an artificially removed one.
Step 6 - Escalate if the request persists beyond a reasonable professional conversation. If the Head of Security Operations continues to insist on removal after this constructive discussion, this should be raised transparently with the Control Group, since a request to alter or remove a genuine, evidenced finding from a CBEST report is a serious integrity matter that the Control Group (not an individual Blue Team stakeholder, however senior within their own function) has the right and responsibility to be aware of and ultimately decide how to handle, consistent with this syllabus's repeated emphasis on escalating significant governance and integrity issues through the proper channel rather than resolving them informally or unilaterally.
Step 7 - Draw out the broader lesson about purple team sessions and reporting integrity. This scenario illustrates that purple team replay sessions are inherently sensitive because they can surface uncomfortable, personally or professionally difficult findings for defenders, and that maintaining strict reporting objectivity and integrity - while still handling the human dynamics with genuine empathy and constructive framing - is essential to the whole exercise retaining real value. A red team practice, and its individual Red Team Managers, must be willing to hold this line professionally even under direct, senior stakeholder pressure to soften or remove a genuine finding.
Conclusion: The finding is genuine, properly in scope, and correctly evidenced, and should remain accurately reported in the final Red Team Test Report; the Head of Security Operations' discomfort should be handled empathetically and constructively through the purple team process (potentially revealing a genuine, valuable underlying monitoring-scope decision worth surfacing), but this must not extend to removing or softening an accurate finding, and any persistent pressure to do so should be escalated transparently to the Control Group.
---

Background: You are scoping an engagement for Ashcombe Retail Bank, a mid-sized UK bank preparing for its first CBEST engagement. During the scoping workshop, the Head of Digital Channels strongly advocates for an objectives-based ("flag") approach, proposing a single objective: "achieve unauthorised funds transfer capability in the core payments system." The Head of Operational Resilience, in the same meeting, separately advocates for a crown-jewels (asset-based) approach explicitly listing seven named critical systems that must each be individually assessed, arguing the board specifically wants to see coverage confirmation against each one for their operational resilience self-assessment.
Both stakeholders are Control Group members, and neither is aware the other has a different underlying preference until this workshop, where the disagreement becomes evident in real time. The engagement's resourcing (agreed with the Bank of England as broadly appropriate for a first CBEST engagement of this bank's size) is not large enough to comfortably deliver a deep, patient, objectives-based campaign against one target AND a full individual assessment of all seven named systems within the available testing window.
Question: As the Red Team Manager facilitating this scoping workshop, how would you help the Control Group resolve this disagreement, and what would you recommend? Explain your reasoning.

See The answer in Explanation part below.
Explanation:
Step 1 - Recognise this as a legitimate scoping methodology disagreement, not a problem to paper over.
Both stakeholders are raising genuinely valid, well-established scoping approaches (objectives-based/flag- based versus crown-jewels/asset-based, both discussed in the syllabus), and both have legitimate underlying business drivers - realistic adversary emulation toward a genuinely damaging objective, versus a board- driven need for explicit assurance coverage across named critical systems. Your role is not to simply pick a side, but to facilitate the Control Group toward a well-reasoned, resourced, and realistic decision.
Step 2 - Make the resourcing constraint explicit and central to the discussion. The most important immediate contribution you can make is to be transparent, per the syllabus principle on budget/scope/objective mismatches, that the currently agreed resourcing genuinely cannot deliver both approaches to a proper, credible standard within the available window - attempting to do so would likely mean shallow, unconvincing coverage of seven systems and an under-resourced, unrealistic attempt at the funds-transfer objective, satisfying neither stakeholder's actual underlying need well. Surfacing this constraint honestly and early is essential before any scope decision is finalised.
Step 3 - Explore whether the two preferences are more reconcilable than they first appear. Rather than treating this as strictly either/or, explore with the Control Group whether a hybrid, prioritised approach could serve both underlying needs: for example, a primary, well-resourced objectives-based scenario targeting unauthorised funds transfer capability (satisfying the realistic-adversary-emulation goal), where the realistic attack paths pursued are deliberately chosen, where feasible, to pass through or touch several of the seven named critical systems along the way - meaning the Head of Operational Resilience's board reporting could legitimately describe those touched systems as having been genuinely, realistically assessed as part of an integrated scenario, even though not every one of the seven was necessarily reached, while remaining honest that the coverage was realistic-path-driven rather than an independent, systematic per-system assessment for every listed system.
Step 4 - Be explicit about what a compromise honestly does and does not deliver. If a hybrid approach is pursued, you must be scrupulously honest with the Control Group that this does not equate to full, independent assurance coverage of all seven systems in the way the Head of Operational Resilience originally wanted - some named systems may end up not meaningfully touched at all if the realistic attack path simply does not lead there, and this must be clearly flagged as an accepted limitation of the chosen approach, not glossed over, so the board's own understanding (via the Head of Operational Resilience) is accurate rather than inadvertently overstated.
Step 5 - Present genuine options to the Control Group rather than deciding for them. Ultimately, this is a Control Group risk and priorities decision, not one for you to make unilaterally. You should present the Control Group with clearly articulated options - for example: (a) a primarily objectives-based scenario as described in Step 3, with honest limitations on per-system coverage; (b) a purely crown-jewels approach systematically but perhaps more superficially covering all seven systems, sacrificing depth and realistic attacker-path continuity; or (c) if the Control Group genuinely believes both are essential and cannot be compromised on, a transparent conversation about whether additional budget/timeline could be sought (echoing the scoping domain's guidance on addressing genuine budget/objective mismatches transparently) - and facilitate a decision, rather than imposing your own preference.
Step 6 - Ensure the final decision and its rationale are properly documented. Whatever the Control Group decides, the choice and its explicit rationale (including the honestly acknowledged trade-offs) should be documented clearly in the scope specification, both so future audit/attestation review understands the reasoning, and so there is a clear record protecting against later disagreement about what was actually promised and delivered.
Conclusion: The correct facilitation approach surfaces the genuine resourcing constraint honestly, explores a hybrid approach that may reasonably serve both stakeholders' underlying needs without pretending it delivers everything either wanted in full, and ultimately presents clear, honest options to the Control Group for their own risk-based decision - rather than the Red Team Manager unilaterally picking one stakeholder's preferred methodology over the other's.
---