Red Teaming Live Events: Why the Riskiest Moments Are the Transitions
Security testing for events and venues often starts with a familiar checklist: fake tickets, cloned wristbands, weaknesses in the entry system. But when T.E.A.M RACCOON, a red team firm that describes testing events, venues and buildings the way a real attacker would, was asked to assess a large outdoor electronic music festival, the team deliberately moved away from that script.
Two of the firm's department heads answered questions about that work. The team operates anonymously, so they are credited by codenames: VOID, Head of Physical Security Assessments & Social Engineering, and APEX, Head of Offensive Security & Infrastructure Testing. Examples were drawn from engagements with identifying details removed.
When the Usual Advice Doesn't Fit
For the festival, the conventional approach would have been to test ticketing technology. Instead, VOID said the team ran the assessment live, during the event itself, "because that's when real conditions apply."
What they found had little to do with technology. Setup ran to the last minute, perimeter fencing was still being closed, and entry checks were still being put in place as crowds arrived. Volunteer vests were handed out by calling names from a list, with no check that the person answering was actually that person. VOID said anyone standing nearby "could have answered to a name, put on a vest, and walked the site with apparent authority, without ever needing a ticket."
The problem went further. Vest-wearing volunteers were being asked for directions and instructions by artists' own security teams and production crew. VOID said someone with bad intentions "could easily have sent them to the wrong place or given them false information at a critical moment." The underlying issue was the absence of clear central authority. As VOID put it, "Nobody was sure who was in charge or who to call." Ticket fraud and technical attacks were unnecessary; arriving an hour early, before the perimeter was closed, would have been enough.
APEX described a related gap at a venue operator that asked for a corporate network test before a major ticketed event. Mapping the full environment revealed that the event itself ran on a temporary wireless network installed by a third-party supplier. Ticket scanners, card payment terminals and some digital signage were connected to it, none of it in the original scope, and the supplier's equipment still used setup credentials that had not been changed. The corporate network was reasonably well protected. "The temporary network sitting next to it was where the real exposure was," APEX said.
What Most Guidance Leaves Out
VOID argued that most guidance treats event security as something designed in advance and then checked. In reality, "the riskiest moments are the transitions: the last hour of setup, the shift changes, the rush when doors open." That is when procedures get skipped, temporary staff work things out as they go, and lines of authority blur. A uniform, a vest or a confident manner can then carry more weight than any access system. That is why the team tests live during those moments rather than only on a quiet day beforehand.
APEX pointed to temporary infrastructure and what happens to it afterwards. Event networks are often set up quickly by several suppliers, each responsible for their own piece, with no single person owning the whole picture. Default settings remain because there is no time to change them, and when the event ends, some equipment quietly stays connected for weeks or months. Most guidance, APEX said, focuses on permanent systems and does not mention what gets added for an event and then forgotten.
The Decision Clients Make Too Quickly
Asked what single decision they would stop, both heads pointed to scoping.
VOID said clients often assume the threat will be technical, focusing on ticketing systems and entry technology because that feels like security testing. But at a live event, "the easiest route in is often a person who looks like they belong." Before choosing what to test, clients should ask how someone could actually get where they shouldn't be on the day, and build the assessment around that.
APEX warned against cutting scope down to whatever is easiest to budget or organise. "The systems left out are often the ones an attacker would go after first, precisely because nobody's looking at them," APEX said, adding a preference for testing fewer things properly, with a clear picture of what each finding would mean for the business, over a long list of issues with no sense of which ones matter.
Practical Takeaways
- Test during live conditions, especially the last hour of setup, shift changes and door-opening rushes.
- Treat temporary networks and supplier equipment as in-scope, and confirm default credentials are changed.
- Check how authority is visually conferred, such as vests and uniforms, and whether anyone verifies identity.
- Establish a clear central authority and a known point of contact for the day.
- Scope around how an attacker could actually reach restricted areas, not only around the systems that feel like security.
For readers planning an assessment, the firm's own framing is a useful starting point: the riskiest moments are often the transitions, and the systems left out of scope are often the ones that matter most.