15 best red teaming tools for 2026, ranked by attack phase

You can download a dozen red teaming tools in a weekend. The harder problem is knowing which one answers which risk question, and what evidence it actually produces.

Security programs stall not because teams lack tools, but because findings pile up disconnected from attack paths, owner teams, or remediation status. According to Fortra's 2024 Penetration Testing Report, 67% of security professionals said red team engagements were effective at preventing breaches, yet only 27% of organizations reported having a dedicated in-house red team, per Pentera's 2024 State of Pentesting Survey. The gap between knowing testing matters and running it well is real.

For product managers and security leads, red team findings carry direct implications: Authentication changes before a release, identity exposure in a new API, AI features with untested prompt behavior. This guide focuses on authorized software-based red teaming, adversary emulation, AI security testing, and continuous exposure validation. Physical covert-entry equipment is out of scope.

What's inside

This guide compares 15 red team tools for 2026, organized by attack phase and operational job.

• Who it's for: Security leaders, platform PMs, AppSec engineers, and technical operators evaluating tooling for authorized adversary emulation
• Selection criteria: Attack phase coverage, operator skill requirements, evidence quality, and reporting fit for engineering and product workflows
• How tools were chosen: Verified capabilities from official documentation, confirmed pricing from vendor pages, and G2 ratings checked at research time
• Scope note: This covers digital security software, not physical red team gear

TL;DR

• Best for network discovery: Nmap, the foundational first pass on live hosts and exposed services
• Best for identity attack paths: BloodHound, which maps privilege routes across Active Directory and Azure AD
• Best for exploitation labs: Metasploit, with structured modules for validating known vulnerabilities in controlled environments
• Best for mature adversary emulation: Cobalt Strike, for experienced teams running authorized exercises under strict controls
• Best for AI red teaming: Promptfoo for CI-integrated LLM testing, PyRIT for research-led generative AI risk assessment
• Best for continuous automated red teaming: FireCompass Automated Recon + Red Teaming, covering ongoing external attack surface validation

What is red teaming software?

Red teaming software is a set of authorized security tools used to emulate adversary behavior, test security controls, discover exploitable paths, and measure how well teams prevent, detect, log, alert, and respond to attacks.

It differs from adjacent categories in important ways. Penetration testing tools typically validate specific vulnerabilities in a defined scope. Vulnerability scanners enumerate weaknesses but do not chain them into realistic attack paths. Breach and attack simulation platforms run automated control checks without the creative judgment of a human tester. AI red teaming tools specifically probe language model and AI application behavior. Red teaming covers all these dimensions when executed as a full adversary-emulation exercise.

For product managers, red team findings often become the evidence behind roadmap decisions: Hardening an authentication flow, adding detection coverage to a new API endpoint, or setting a release gate for a feature with elevated privilege requirements.

Key capabilities to look for in red teaming software:

• Reconnaissance and attack surface discovery
• Attack-path mapping across identity, network, and cloud
• Exploitation and control validation
• Credential and authentication testing
• Command and control simulation
• Web application and API testing
• Packet capture and traffic analysis
• AI system testing (prompt injection, jailbreak, data leakage)
• MITRE ATT&CK technique mapping
• Reporting and remediation evidence

When to use red teaming tools

Validate high-risk releases before they ship

Authentication changes, new APIs, infrastructure migrations, and AI feature launches all introduce attack surface that standard QA does not cover. Red teaming tools give security and product teams a way to test privilege models, credential flows, and input handling before code ships. The earlier a finding arrives in the release cadence, the cheaper it is to fix.

Map attack paths before attackers do

A low-severity misconfiguration rarely lives alone. Combine it with an exposed service or a weak credential, and severity climbs fast. Tools like BloodHound and attack surface management software make this chaining visible before it becomes an incident. Mapping paths proactively is cheaper than reconstructing them from logs after the fact.

Measure controls after remediation

A red team exercise should produce more than a list of weaknesses. It should also confirm whether prevention, detection, logging, alerting, and response improved after the fix. Rerunning the same test scenario after remediation closes the evidence loop and gives PMs something concrete to report upstream.

Red teaming tools comparison

The table below covers all 15 tools ranked by relevance to attack phase. Pricing and G2 ratings reflect verified data from official vendor pages and live G2 listings.

#	Product	Best for	Key differentiator	Pricing	G2 rating
1	Nmap	Network discovery	Foundational port and service scanning	Free (open source)	4.5/5
2	BloodHound	Identity attack paths	Graph-based AD and Azure AD path analysis	Free (CE)	N/A
3	Metasploit	Exploitation labs	Structured exploit validation framework	Free / Contact sales (Pro)	4.6/5
4	Cobalt Strike	Adversary emulation	Malleable C2 with team server collaboration	Custom pricing	4.5/5
5	Burp Suite	Web app security	Intercepting proxy with deep scanner and extensions	Free / $499 (Pro)	4.5/5
6	OWASP Amass	External asset discovery	DNS enumeration and subdomain mapping	Free (open source)	N/A
7	Hashcat	Credential policy validation	GPU-accelerated hash recovery across 720+ modes	Free (open source)	N/A
8	Wireshark	Packet-level validation	Protocol analysis with display filters and stream reconstruction	Free (open source)	N/A
9	Mimikatz	Windows credential exposure	Authentication and Kerberos ticket testing	Free (open source)	N/A
10	Sliver	Open source C2	Cross-platform adversary emulation under GPLv3	Free (open source)	N/A
11	Mythic	Modular C2 framework	Web-based operator interface with extensible agents	Free (open source)	N/A
12	Promptfoo	AI red teaming in CI	LLM evaluation with CI/CD integration and red-team probes	Free / Custom (Enterprise)	N/A
13	PyRIT	Research-led AI risk testing	Python-native orchestration for generative AI assessments	Free (open source)	N/A
14	MITRE ATT&CK	Technique mapping	Globally shared adversary behavior taxonomy	Free	N/A
15	FireCompass Automated Recon + Red Teaming	Continuous automated red teaming	Agentic AI with exploit-validated attack surface discovery	Free (Explorer) / Custom (Enterprise)	N/A

Best 15 red teaming tools for 2026

1. Nmap

Nmap is the most widely used open-source utility for network discovery and security auditing. It maps live hosts, open ports, running services, and operating systems across a target environment. The Nmap Scripting Engine extends its core scanning with automation for tasks like vulnerability detection and banner grabbing. Zenmap provides a cross-platform GUI for teams that want visual output alongside raw results.

Best for: Security teams that need a reliable, well-documented first pass on exposed services before deeper testing begins.

Key features

• Port scanning and host discovery across IP ranges
• Service and application version detection
• Remote OS fingerprinting
• Nmap Scripting Engine for automated networking tasks
• Zenmap graphical interface for visual analysis

Why choose Nmap: It is foundational. Almost every red team workflow starts with understanding what is live and what is exposed, and Nmap is the most documented tool for that job. It is not a full adversary-emulation platform, so findings require skilled interpretation to become prioritized risk.

Nmap pricing: The core Nmap utility is free and open source. Commercial OEM redistribution licensing runs $9,980 per 3-month term, priced for vendors embedding Nmap in their products rather than end users.

G2 rating: 4.5/5

2. BloodHound

BloodHound uses graph theory to reveal hidden identity relationships and privilege paths across Active Directory and Azure AD environments. It enumerates users, groups, sessions, and permissions, then surfaces which combinations create a viable path to domain compromise. BloodHound Community Edition (CE) is open source and freely available; SpecterOps also offers a commercial BloodHound Enterprise product for managed programs.

Best for: Teams that need to understand lateral movement risk and identity privilege paths before an attacker does.

Key features

• Graph-based attack-path mapping across Active Directory and Azure AD
• Detection of abusable configurations in ADCS, NTLM, and Azure PIM roles
• BloodHound OpenGraph support for extended relationship mapping
• Community Edition available as open-source software
• Path prioritization for remediation planning

Why choose BloodHound: It bridges red and blue teams by showing both sides the same identity graph. A finding in BloodHound is immediately legible to a defender or an identity admin, which makes remediation conversations faster. Collection and graph interpretation still require identity expertise, so plan for that operator cost.

BloodHound pricing: The Community Edition is free and open source. BloodHound Enterprise pricing requires contacting SpecterOps directly.

3. Metasploit

Metasploit is one of the most recognizable exploitation frameworks in security. It provides structured modules for validating known vulnerabilities across a target environment, covering exploit, auxiliary, payload, and post-exploitation workflows. The open-source Metasploit Framework is maintained by Rapid7 and the community; Metasploit Pro adds a commercial layer with automation, reporting, and team management. For application security testing software workflows, Metasploit fills the controlled validation gap between finding a weakness and proving it is exploitable.

Best for: Security teams that need structured exploit validation in authorized test environments, including lab setups and controlled engagements.

Key features

• Exploit, auxiliary, payload, and post-exploitation modules
• Network scanning and service enumeration
• Session and credential management
• JSON-RPC and automation APIs
• Data import and export with reporting

Why choose Metasploit: Its module library covers a wide range of known vulnerabilities and is regularly updated. This makes it a practical choice for validating whether a patched system is actually protected, or whether a theoretical risk is exploitable in your specific configuration. All use should be in authorized environments with explicit scope documentation.

Metasploit pricing: Metasploit Framework is free and open source. Metasploit Pro is a commercial product; Rapid7 requires contacting sales for current pricing.

G2 rating: 4.6/5

4. Cobalt Strike

Cobalt Strike, now under Fortra, is a commercial adversary-emulation platform built for mature red team programs. It provides command and control simulation through a Beacon payload, collaborative team server operations, and malleable C2 profiles that let operators model realistic attacker behavior. It is widely used in authorized exercises to test whether security controls, detection logic, and incident response hold up against realistic threat simulation.

Best for: Experienced red teams running authorized adversary-emulation exercises with strict governance, logging, and operator controls in place.

Key features

• Beacon post-exploitation payload with malleable C2
• Team server for collaborative operations and shared sessions
• Arsenal Kit for customizable payload generation
• REST API and automation support
• Reporting and audit logging

Why choose Cobalt Strike: It is purpose-built for realistic adversary simulation at the program level, not one-off tests. Teams use it to model multi-stage attack chains that reflect named threat actors. The misuse risk is significant, so internal authorization, logging, and experienced operators are non-negotiable requirements before deployment.

Cobalt Strike pricing: Bundle options pair it with Core Impact or Outflank Security Tooling.

G2 rating: 4.5/5

5. Burp Suite

Burp Suite from PortSwigger is the dominant platform for web application security testing. Its intercepting proxy captures and modifies HTTP/S traffic, while Burp Scanner automates vulnerability detection across web apps and APIs. Repeater lets testers craft and resend individual requests manually. The BApp Store extension marketplace expands coverage significantly, with community-contributed checks for specific frameworks, authentication mechanisms, and vulnerability classes.

Best for: AppSec teams and product security engineers testing web applications, REST APIs, and browser-based workflows during development or pre-release.

Key features

• Intercepting proxy for HTTP/S traffic inspection
• Automated web vulnerability scanner (Professional tier)
• Repeater for manual request crafting
• Intruder for automated customized attacks
• BApp Store extension marketplace

Why choose Burp Suite: It maps findings to specific web flows and endpoints that engineers recognize, which shortens the time between finding and fix. The Community Edition covers manual testing workflows for free. Advanced scanning requires the Professional license at $499. API and enterprise-scale testing require the DAST product, which is priced on request.

Burp Suite pricing: Community Edition is free. Burp Suite Professional is $499 (subscription). DAST pricing requires a quote from PortSwigger.

G2 rating: 4.5/5

6. OWASP Amass

OWASP Amass is an open-source framework for external attack surface mapping through DNS enumeration, subdomain discovery, and asset reconnaissance. It pulls from multiple data sources to build a network map of internet-facing infrastructure, including forgotten subdomains, acquired domains, and cloud assets that may not have clear owners. For teams managing a fast-moving product portfolio, Amass surfaces exposure that internal asset inventories often miss. It pairs naturally with breach and attack simulation software workflows that need a clear picture of external exposure before validation begins.

Best for: Teams mapping internet-facing assets, acquired domains, and subdomains as part of recon or external attack surface management.

Key features

• DNS enumeration and subdomain discovery
• External asset mapping across multiple data sources
• Findings database for asset tracking
• Graph output for relationship visualization
• Integration support for external intelligence feeds

Why choose OWASP Amass: Its value comes from surfacing assets the organization did not know were exposed. The output requires ownership cleanup after discovery, so plan for a process to route findings to the right team. It is maintained under the OWASP umbrella and free for all users.

OWASP Amass pricing: Free and open source, available to everyone under the OWASP project umbrella.

7. Hashcat

Hashcat is the standard tool for password hash recovery and credential policy validation in authorized security engagements. It supports more than 720 hash modes and uses GPU, CPU, and FPGA acceleration to test password strength at scale. Rule-based attacks, dictionary attacks, and combinatorial attacks make it possible to model real-world credential cracking scenarios without touching production systems. For product teams building authentication features, Hashcat provides the evidence that password policy assumptions either hold or fail.

Best for: Security teams validating password policy strength and credential exposure in authorized engagements with explicit written scope.

Key features

• More than 720 hash mode support
• GPU, CPU, and FPGA acceleration via CUDA, HIP, Metal, and OpenCL
• 10 attack modes for password candidate generation
• Distributed cracking via the Brain feature
• Built-in benchmarking and automatic performance tuning

Why choose Hashcat: It turns credential policy assumptions into evidence. Knowing that a password policy passes configuration review is different from knowing it survives an optimized cracking attempt. All credential testing must be scoped, authorized, and conducted against non-production data.

Hashcat pricing: Free and open source under the MIT license.

8. Wireshark

Wireshark is the most widely used open-source network protocol analyzer. It captures live packets and lets teams inspect hundreds of protocols in depth, reconstruct streams, apply display filters, and export data for further analysis. During red team and purple team exercises, Wireshark helps validate whether detection controls are logging the right traffic, whether lateral movement signatures appear as expected, and whether encrypted channels behave correctly.

Best for: Teams that need packet-level evidence during security exercises, incident review, or detection engineering validation.

Key features

• Deep protocol inspection across hundreds of supported protocols
• Live capture and offline analysis
• Powerful display filters for traffic isolation
• Stream reconstruction for session-level review
• VoIP analysis and protocol decryption support

Why choose Wireshark: It moves conversations from assumptions to evidence. When a security control is supposed to detect a behavior, Wireshark confirms whether the right packets are visible. It is not a standalone red team platform, but it is an indispensable validation and troubleshooting layer in a broader program.

Wireshark pricing: Free and open source.

9. Mimikatz

Mimikatz is an open-source Windows security research tool for credential exposure testing. It demonstrates how Windows authentication mechanisms can expose plaintext passwords, hashes, and Kerberos tickets from memory in environments without sufficient endpoint defenses or privileged access controls. Security teams use it in authorized engagements to validate whether endpoint protection, privileged access management, and Windows hardening controls actually prevent credential extraction.

Best for: Experienced security teams validating Windows credential defenses in controlled, explicitly authorized environments with strict governance.

Key features

• Credential exposure testing across Windows authentication mechanisms
• Kerberos ticket extraction and validation
• Pass-the-hash and pass-the-ticket demonstration
• Golden Ticket construction for privilege escalation testing
• Defensive hardening evidence generation

Why choose Mimikatz: It is the clearest way to prove that credential hardening either works or needs attention. Without running a test like this, endpoint defense assumptions remain unvalidated. This tool carries significant misuse risk and must only be used under written authorization, in isolated lab environments, by experienced operators. For related coverage guidance, see access control software considerations.

Mimikatz pricing: Free and open source from the official GitHub repository.

10. Sliver

Sliver is an open-source cross-platform adversary emulation and command and control framework developed by Bishop Fox. It supports C2 communication over mTLS, WireGuard, HTTP/S, and DNS, with cross-platform agents for macOS, Windows, and Linux. Teams that need a commercial-grade C2 workflow without a commercial license use Sliver as an alternative, with the understanding that operator expertise requirements are equivalent to paid platforms.

Best for: Experienced red teams that want open-source C2 simulation under strict authorization, with the skills to configure and govern the environment safely.

Key features

• C2 communication over mTLS, WireGuard, HTTP/S, and DNS
• Cross-platform agent support (macOS, Windows, Linux)
• Native and shellcode payload support with userspace reflective loading
• BOF/COFF execution on amd64 and arm64
• Multi-operator support for collaborative engagements

Why choose Sliver: Its flexibility and open-source licensing make it an accessible option for skilled teams. The governance overhead is real: Authorized scope, operator logs, lab environment controls, and approval workflows are all necessary before use. Without those controls, flexibility becomes operational risk.

Sliver pricing: Free and open source under GPLv3.

11. Mythic

Mythic is an open-source post-exploitation and red-teaming framework with a collaborative web interface and modular architecture. It deploys via Docker and supports multiple installable payload types and C2 profiles, letting teams customize the adversary-emulation environment to match specific exercise objectives. The web UI gives operators a shared dashboard for session management, tasking, and collaboration during multi-operator engagements.

Best for: Red teams that want modular C2 workflows, extensibility across payload types, and a web-based interface for operator collaboration.

Key features

• Modular agent and C2 profile architecture
• Web browser UI for operator collaboration
• Docker-based deployment
• Installable payload types and scripting support
• API integration for automation

Why choose Mythic: Its modularity means teams can adapt it to specific threat scenarios without being locked into one payload type. The tradeoff is setup and governance complexity: More flexibility means more decisions about configuration, authorization, and audit trails. It suits programs with dedicated red team operators who have time to invest in environment management.

Mythic pricing: Free and open source from the official GitHub repository.

12. Promptfoo

Promptfoo is an open-source, local-first tool for evaluating, testing, and red-teaming large language model applications. It supports prompt injection, jailbreak, data leakage, toxicity, hallucination, and regression testing, with CI/CD integration that lets product and engineering teams run AI safety checks as part of their normal release pipeline. For PMs shipping LLM features, Promptfoo converts AI security from a one-off review into a repeatable test with version history and coverage tracking. See also ai software testing tools and best prompt management tools for adjacent capabilities.

Best for: AI product teams and engineering teams that need repeatable LLM security and behavior testing integrated into their development workflow.

Key features

• Prompt injection and jailbreak test suites
• Data leakage and toxicity detection
• CI/CD integration for automated test runs
• Multi-provider model comparison
• Reporting with assertion-based pass/fail tracking

Why choose Promptfoo: It fits how product and engineering teams already work. CI integration means tests run automatically, not only when someone schedules a manual review. The Community plan covers up to 10,000 red team probes per month for free, which is enough for most product teams to establish a baseline. It does not replace infrastructure red teaming, but it fills the AI application testing gap that most security programs leave open.

Promptfoo pricing: Community plan is free forever, including core evaluation and red teaming up to 10,000 probes per month. Enterprise and On-Premise plans are priced on request.

13. PyRIT

PyRIT (Python Risk Identification Tool) is Microsoft's open-source framework for proactively identifying risks in generative AI systems. It provides automated red-teaming orchestration through a CLI, a GUI called CoPyRIT, and a programmable framework mode for custom research workflows. PyRIT supports dataset-driven testing, attack scenario orchestration, scoring, and persistent memory across test runs, making it suited for systematic AI risk assessment rather than one-off prompt testing. For teams tracking best ai security posture management tools, PyRIT addresses the generative AI layer specifically.

Best for: AI security researchers and advanced teams with Python expertise conducting systematic generative AI risk assessments and red-team exercises.

Key features

• Automated AI risk testing via pyrit_scan CLI and CoPyRIT GUI
• Attack orchestration across scenarios and converters
• Dataset-driven testing with persistent memory
• Scorer framework for measuring model behavior
• Python-native programmable framework mode

Why choose PyRIT: It gives research-led teams a structured, extensible way to build and repeat AI red team exercises. The Python-native architecture means it integrates into existing data science and security tooling. Teams without Python expertise or dedicated AI security researchers will find the learning curve steep; Promptfoo may be a better starting point for those situations.

PyRIT pricing: Free and open source under the MIT license from the Microsoft Azure GitHub repository.

14. MITRE ATT&CK

MITRE ATT&CK is a globally accessible knowledge base of adversary tactics, techniques, and procedures based on real-world observations. It is not an execution tool, but a taxonomy that gives security teams a common language for planning exercises, mapping tool coverage, communicating findings, and tracking remediation. ATT&CK Navigator lets teams annotate matrices to show which techniques their current tooling covers and where gaps exist.

Best for: Teams that need a shared framework for adversary behavior, coverage planning, purple team collaboration, and risk reporting that all stakeholders can read.

Key features

• Enterprise, Mobile, and ICS technology domain matrices
• Tactics, techniques, sub-techniques, and procedures taxonomy
• ATT&CK Navigator for coverage annotation and gap analysis
• STIX-formatted downloadable datasets
• ATT&CK Workbench for custom knowledge-base extensions

Why choose MITRE ATT&CK: It solves the communication problem. Red team findings expressed as ATT&CK technique IDs are legible to defenders, detection engineers, compliance teams, and executives. Without a shared taxonomy, findings from different tools and engagements pile up in formats that cannot be compared or tracked over time. Use it to plan exercises, report results, and track coverage improvements across the program.

MITRE ATT&CK pricing: Free and open to any person or organization, with no license required.

15. FireCompass Automated Recon + Red Teaming

FireCompass is an agentic AI platform for autonomous penetration testing, external attack surface discovery, and continuous automated red teaming. It maps shadow assets, forgotten subdomains, exposed cloud infrastructure, and leaked credentials, then validates exploitability with proof-of-concept evidence across web applications, APIs, and infrastructure. MITRE-aligned multi-stage attack chains include credential reuse, lateral movement simulation, and privilege escalation, giving security teams a continuous view of external risk rather than a point-in-time snapshot. For product and security leaders evaluating breach and attack simulation software, FireCompass extends that category with exploit-validated evidence.

Best for: Security teams that need continuous, exploit-validated external attack surface validation with executive-ready reporting and risk prioritization.

Key features

• Automated attack surface reconnaissance with shadow asset and subdomain discovery
• Web application, API, and infrastructure penetration testing with exploit-validated proof of concept
• Continuous automated red teaming with MITRE-aligned attack chains
• Real-time risk prioritization with scope controls and audit trails
• Executive reporting with remediation tracking

Why choose FireCompass: It shifts external security validation from periodic to continuous, which matters for products that ship frequently and whose attack surface changes with each release. Automated validation should be treated as a complement to skilled human red teaming, not a replacement. Creative attack chaining, business logic testing, and context-heavy decisions still require human operators.

FireCompass pricing: Explorer plan is free with 4,000 credits, unlimited assets, and attack surface reconnaissance. Enterprise pricing requires contacting FireCompass sales.

Considerations when choosing red teaming tools

Attack phase coverage

No single tool covers every attack phase well. Start by identifying the top two or three risk questions your program needs to answer, then match tools to those jobs. Recon and asset discovery, identity and Active Directory paths, web application vulnerabilities, credential exposure, and AI system behavior each require different tooling and operator skills.

Operator skill and safety controls

Some tools in this list are appropriate for broad security use with minimal setup risk. Others require dedicated operators, written authorization, isolated lab environments, and audit logs before anyone touches them. Cobalt Strike, Mimikatz, Sliver, and Mythic fall in the latter group. Build the governance model before choosing the tool, not after.

Evidence quality and reporting

Prioritize tools that produce output a PM, an engineering manager, and a compliance team can all act on. Findings should map to affected services, specific attack paths, severity, owner teams, and validation status. A finding without an owner and a remediation path is noise, not evidence.

Integration with remediation workflows

Consider how findings reach the engineers responsible for fixing them. Jira integration, SIEM-compatible output, and MITRE ATT&CK technique mapping all reduce the translation cost between a security finding and a remediation ticket. Tools without structured output require manual reporting work that slows the feedback loop.

Maintenance and release cadence

Attack surface drifts with every release. Subdomains change, permissions expand, AI prompts evolve, and cloud assets spin up without formal registration. Choose tools that can be rerun regularly without significant setup overhead. A tool that requires two weeks of configuration before each use will not keep pace with a team shipping weekly.

Conclusion

Choose red teaming tools by attack phase and risk question, not by name recognition.

For external asset discovery, Nmap and OWASP Amass cover the recon layer. BloodHound maps identity privilege paths that connect low-severity misconfigurations to high-impact compromise routes. Metasploit and Burp Suite handle exploitation validation and web application security in controlled environments. Cobalt Strike, Sliver, and Mythic support mature adversary-emulation programs when authorization, governance, and experienced operators are in place. Hashcat and Mimikatz validate credential and authentication assumptions. Promptfoo and PyRIT address the AI red teaming gap that most traditional security programs do not cover. FireCompass brings automated, continuous external validation. MITRE ATT&CK provides the shared language that keeps findings legible across security, engineering, and product.

Start by mapping your top three risk questions to the attack phase they belong to. Then choose the smallest tool set that can answer those questions with evidence your team can act on.

FAQs