A red-team tester has been contracted to emulate the threat posed by a malicious insider on a company's network, with the constrained objective of gaining access to sensitive personnel files. During…

Performing forensic analysis is an incident response activity and is outside the scope of a red team's contracted objective, which is to emulate threats and identify weaknesses, not to investigate actual breaches.

Incorporating a new compromise method without client consultation could worsen the situation or interfere with incident response, as the primary concern shifts from testing to active breach remediation.

While documenting findings is important, continuing the assessment before reporting a live compromise can lead to further issues or loss of critical evidence for the client's incident response team.

Discovering evidence of a prior compromise means the red team is no longer operating in a pristine environment and the client may be actively breached. Continuing the test could interfere with incident response efforts or compromise evidence, making it critical to halt operations and report according to the established contract protocols. This ensures the client can initiate proper incident response without further interference.