Grey teaming came out of our work at a ministry.
The three of us worked in the team of Oscar Koeroo, departmental CISO of the Dutch Ministry of Health, Welfare and Sport, on a range of offensive security assignments.
Each of us came from a different background and looked at things in a different way. We enjoyed working together and found out we were driven by the same things: wanting to understand how something really works, to keep digging and to leave the organisation better than we found it.
Red teaming had no room for the next step.
We had been combining techniques for some time, adding routes such as physical security, people and policy to the technical one. That work did not fit into conventional red teaming or cybersecurity assignments. Red teaming was already seen as progressive at the time, and for many clients the step beyond conventional information security that we proposed was too complicated.
Oscar saw what this approach could add before most of the market did. At VWS he gave us his trust and the mandate to investigate with a very broad scope. That mandate has to come from the top, from someone who oversees all teams and answers for them, such as a CISO, a CIO or the board.
Fewer boundaries, bigger findings.
That breadth soon paid off. We were no longer held back by the question of who a problem belongs to. Our most important findings came from the edges between disciplines, responsibilities and scopes. A digital, physical, human or procedural weakness was often unremarkable on its own. Connected to the others it became a route in, and far more dangerous than it is usually taken to be.
When we looked at what we were doing, we saw traits of red and black teaming, some overlap with purple and a good deal of white: we worked closely with management and much of our work was analysis. We could have called it hybrid. But security teams are described in colours, and if we wanted our work to fit that wheel and build on it, it needed a colour of its own. Mix red, black, white and a touch of purple and you get grey.
Where grey teaming sits between the other teamsA series of vulnerabilities in Cisco Webex.
In early 2024 Russia published a recording of senior German air force officers discussing possible missile deliveries to Ukraine over Webex. Our first thought was that this did not have to be very technical. Within two days we had built a man-in-the-middle method.
Then we bought a used Webex device: a 27-inch screen with a camera, a microphone and a big crack in it. While experimenting with it we found a number of vulnerabilities, including ways to become global admin and to use Webex screens to spy on meeting rooms and boardrooms unnoticed.
We reported every finding to our client and other involved government agencies, who in turn reported them to Cisco. Two and a half years later, on 6 October 2026, we were allowed to speak about it publicly for the first time, at ONE Conference.
Developing the grey-teaming method.
During the VWS assignment we started to write grey teaming down: how hybrid attacks work, which teams our methods overlap with and why it needed a name of its own. We keep developing it, both the method itself and the value it brings to an organisation.
Looking for a grey team?
The people who developed this approach to grey teaming founded OnyxTrace together. If you are looking for a grey team, OnyxTrace is one of the parties you can approach. If they are not the right fit, they will gladly help you find someone closer to home.
Talk to OnyxTrace