Phase 6: AI Red Teaming Methodology & Tools · 180 min · Garak · PyRIT · Python

Project: Full Red Team Engagement Report

Scope it. Scan it. Escalate it. Report it. Re-test it. That's the whole job.

Hiring signal: This is the project a hiring manager wants to see linked from a resume: a scoped engagement, a baseline scan, a deep multi-turn campaign, a severity-ranked report with a documented attack chain, and re-test evidence after fixes. It demonstrates the full lifecycle from lesson 1 executed end to end, not just one tool run in isolation — exactly what separates an AI Red Team Engineer candidate from someone who can only describe the tools in an interview.

What you will learn

Scope a full AI red team engagement with clear objectives, boundaries, and safe-testing constraints
Run a Garak-style baseline scan to establish the vulnerability surface, then a PyRIT-style multi-turn campaign targeting at least 2 weaknesses the scan surfaced
Consolidate scan and campaign results into a single severity-ranked report with at least one documented attack chain
Apply fixes and produce concrete re-test evidence, closing the full nine-stage engagement lifecycle from lesson 1

The Problem

Five lessons in this phase each taught one piece: the engagement lifecycle (lesson 1), a broad automated scan with Garak (lesson 2), a deep multi-turn campaign with PyRIT (lesson 3), the tool-selection framework spanning Promptfoo/Inspect AI/HarmBench (lesson 4), and how to write the report that makes findings actionable (lesson 5). None of those lessons alone is what a hiring manager asks to see. What they ask for is proof you can run the whole thing, start to finish, against a real target — because that's the actual job.

This project is that proof. You'll scope an engagement against a sample LLM application, run a Garak-style baseline scan to establish the vulnerability surface, run a PyRIT-style Crescendo campaign against the weaknesses the scan can't reach on its own (multi-turn trust drift, which requires conversational context a single-turn scan never builds), consolidate everything into one severity-ranked report with a documented attack chain, and produce concrete re-test evidence after applying fixes. This mirrors exactly what the Microsoft AI Red Team methodology (lesson 1) describes as a complete engagement — the difference is you're doing all nine stages yourself, on one target, in one sitting.

Scoping the Engagement

The target for this project is OpsAssistant v2, an internal IT helpdesk bot with password-reset and admin-escalation-adjacent tools — deliberately similar in shape to the SupportBot and OpsAssistant targets from earlier lessons, but with its own distinct weaknesses so this project surfaces genuinely new findings rather than replaying old ones. The scope, written before any testing starts (lesson 1's stage 1), is:

Objectives: establish a baseline vulnerability surface across injection, encoding-bypass, and data-leakage probe families; determine whether a multi-turn escalation can obtain admin access that a single-turn request cannot; produce a severity-ranked report with at least one documented attack chain and re-test evidence after fixes.

In scope: staging deployment, synthetic helpdesk accounts, the password-reset and admin-flag tools. Out of scope: production employee data, real SSO/identity provider integration, the underlying model provider's infrastructure.

Notice this scope is deliberately narrow and specific — it names the exact tools and data categories in bounds, which is what makes it possible to push back cleanly if a stakeholder later asks "did you test X?" (lesson 5's methodology-section rationale) rather than improvising an answer under pressure.

Scope before tools, tools before execution
It's tempting to open this project by picking probes and campaigns to run. Resist that. The Microsoft methodology places scoping first for a reason: without a written objective and an explicit in/out-of-scope boundary, there's no way to know when the engagement is done, and no way to defend the engagement's boundaries if a stakeholder pushes back later. Everything below flows from the three objectives stated above.

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers Stage 1: The Garak-Style Baseline Scan, Stage 2: The PyRIT-Style Crescendo Campaign, Stage 3: Consolidating Into One Report, Re-Testing After Fixes, Build It, What to Practice — plus a hands-on lab, quiz, and project artifact.

Create a free account to unlock Phase 0 and Phase 1 of every course — no credit card.

Key terms in this lesson

Token