This week, Het Financieele Dagblad wrote about the rise of red teaming in the Netherlands. Security firms have seen demand for these tests increase by 25 to 100 percent over the past two years. The reason is simple: the threat has become more realistic, and therefore the testing must be as well.
Why now
Global unrest plays a major role. In its 2025 annual report, the AIVD described the threat landscape as the most significant to date, with specific warnings regarding cyberattacks from Russia and China. Additionally, new legislation—the Cybersecurity Act and the Critical Entities Resilience Act—requires critical companies to demonstrate their resilience. They are free to choose how they do so, and red teaming is one of the recognized methods.
Testing is becoming more rigorous
What stands out in the article is that scenarios are becoming more intensive. Companies are giving red teams more leeway to cause damage and no longer stop at the first layer of security. Tim Gerding of Cocoon notes: “For example, we are allowed to cause more damage.” The reason is that the threat itself has shifted: from theft to sabotage, and from isolated incidents to attempts to shut down critical processes.
This requires a broader team than just IT specialists. For these types of projects, Cocoon utilizes drone specialists, divers, actors, and individuals with police or intelligence backgrounds, tailored to the client’s risk profile.
Humans remain the weakest link
The article confirms something we have long emphasized at Cocoon: no matter how well the technology is tested, if employees click on a suspicious link or let an unknown technician in, security is still compromised. This is why red teams operate without the staff knowing it is a test. This is the only way to measure an organization’s true response.
This also requires careful aftercare. Testing can be confronting for those directly involved. Therefore, a successful project always concludes with the message that it is a learning opportunity, not a reprimand.
What this means
Red teaming is evolving from a tool for the financial sector into a broader practice in critical sectors such as energy. For organizations subject to the new legislation, it is no longer a question of whether they must test their resilience, but how thoroughly.
Source: FD, “Companies are allowing themselves to be attacked increasingly harder”