Red Team vs Blue Team: Network Intrusion Race

Red Team — Attacker

Exploit strength 55%

Attack tempo (hop attempts/s) 0.20

Blue Team — Defender

Detection sensitivity λ (/s) 0.12

Sensor / EDR coverage 65%

Exercise Status

Idle — press Launch Attack

Elapsed time

0.0 s

Compromised

0 / 15

Detected

Contained

Clean host Compromised (undetected) Detected — under investigation Contained / isolated Crown-jewel asset

How it works

A red/blue exercise on a segmented network is a race between two competing Poisson processes — one attacker clock per edge, one defender clock per compromised host:

P(event within dt) = 1 − e^(−rate·dt)

attacker: rate μ = tempo × exploit strength   (per reachable edge)
defender: rate λ = detection sensitivity      (per compromised host w/ sensor)

Each frame, every edge leading from a live compromised host to a clean host rolls against μ; every compromised-but-undetected host with EDR coverage rolls against λ. Whichever exponential clock fires first determines the next state change — this is exactly the memoryless "race of exponentials" used in real intrusion-detection modelling and in tabletop purple-team exercises to reason about Mean Time to Detect (MTTD) and Mean Time to Contain (MTTC).

A detected host is quarantined after a fixed 4 s SOC response delay, after which its edges can no longer be used for further lateral movement — but it stays counted as compromised, since containment stops the spread, not the breach itself. The attacker wins by reaching the crown-jewel asset (e.g. the domain controller) before it is cut off; the blue team wins by containing every compromised host, or by outlasting a 90 s exercise clock.

Exploit strength — probability the attacker's technique actually works against a given host once attempted (patch level, hardening).
Attack tempo — how many lateral-movement attempts per second the attacker throws at reachable hosts.
Detection sensitivity λ — how quickly monitored hosts surface an alert once compromised (EDR/SIEM quality).
Sensor coverage — fraction of hosts actually instrumented; an uncovered host is a blind spot with λ = 0.

Real-world relevance: this is the core dynamic behind MITRE ATT&CK lateral-movement tracking and why security teams invest in both faster detection (lower MTTD) and network segmentation (fewer reachable edges) rather than either alone.

Attacker packet Crown-jewel asset

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.