1.1 Tool Classification

Tool Classification

A structured classification system is the foundation of responsible tool governance, enabling teams to manage risk, enforce access controls, and demonstrate compliance.

Why Classification Matters

Before a single tool leaves the cage or gets loaded onto a laptop, someone needs to know exactly what that tool is, what it can do, and who is allowed to use it. Tool classification is not a bureaucratic exercise – it is the mechanism that makes governance possible. Without a classification system, there is no rational basis for deciding who can check out a wireless analyzer, who needs manager approval to carry a bypass device, or how a credential-capture tool should be stored between engagements. Classification creates the shared language that connects inventory management, legal compliance, and operational authorization into a coherent whole.

Red team tools span an enormous range of capability and risk. A public record scraper used for passive reconnaissance carries fundamentally different risk than an implant device used for persistence. Treating both the same way – either with excessive restriction or insufficient control – creates problems. Over-restriction slows down legitimate operations; under-restriction creates liability. A four-category classification framework gives teams a calibrated way to apply controls proportional to actual risk.

The Four Classification Categories

Passive reconnaissance tools form the first category. These include OSINT platforms, search aggregators, social media analyzers, and public record scrapers. Because these tools operate without directly interacting with target systems, they carry the lowest operational risk profile. They are still tools requiring governance – their use must be authorized and their output must be protected – but they do not carry the same potential for direct harm as active tools.

Active scanning tools make up the second category. Network scanners, port mappers, vulnerability scanners, and WiFi analyzers all actively probe systems. They generate traffic that targets can observe, log, and potentially respond to. This active footprint means the authorization requirements are higher: the engagement must explicitly permit active scanning before these tools are deployed. The boundary between passive and active is not always obvious, and operators should err on the side of treating ambiguous tools as active.

Exploitation tools represent the third category and include credential tools, bypass devices, implant hardware, and social engineering kits. These tools are designed to circumvent controls and gain access that would not otherwise be available. They carry significant legal and operational risk if misused or mishandled. The classification system reflects this by requiring restricted storage, careful checkout procedures, and explicit authorization at an appropriate management level before deployment.

Persistence and command-and-control tools form the fourth category. Implants, callback mechanisms, command infrastructure, and exfiltration tools are the most sensitive class. These tools operate within compromised environments and can have lasting effects on target systems. They require the most stringent governance controls of any category, including dual-person accountability and isolated storage.

Sensitivity Levels

Categories tell you what a tool does; sensitivity levels tell you how carefully it must be handled. Three sensitivity levels apply across all four categories. Low sensitivity tools are publicly available, require no special handling beyond standard organizational security practices, and can be stored in ordinary secure locations. Many OSINT tools fall into this tier – they are freely downloadable, widely documented, and pose limited risk when used within authorized engagements.

Medium sensitivity tools require restricted access, a logged checkout process, and secure storage. These are tools that could cause harm if used improperly or if they fell into the wrong hands, but they do not require extraordinary controls. The checkout log creates accountability: it records who took the tool, when, and for what purpose. This creates a clear record for audit and investigation purposes.

High sensitivity tools require dual-person control, manager approval before checkout, and encrypted or physically isolated storage. The dual-person requirement is borrowed from high-consequence industries where a single individual should never have unchecked access to the most dangerous assets. Requiring two people to authorize and witness the checkout of high-sensitivity tools reduces the risk of both unauthorized use and honest mistakes.

Building a Tool Registry

Classification only works when it is recorded. A tool registry is the living document that makes the entire governance system function. Every tool in the organization’s inventory should have three groups of information recorded: identification data, classification data, and operational data.

Identification data includes the unique identifier assigned to the tool instance, the tool name and version, the vendor or developer, the acquisition date, and the license type. Version information matters because two versions of the same tool can have different legal statuses, different capabilities, and different storage requirements. The license type determines what uses are permitted and under what conditions the tool can be deployed.

Classification data records the category from the four-tier system, the sensitivity level, any known legal restrictions specific to that tool, and the authorized use cases. This section answers the question of what the tool is permitted to do and under what circumstances. Operational data covers the assigned custodian, the current storage location, the maintenance schedule, and the usage history. The usage history field is particularly valuable: it creates the audit trail that connects each tool use to the engagement and authorization that permitted it.

Key Takeaways

• Four classification categories structure risk. Passive reconnaissance, active scanning, exploitation, and persistence tools each carry different risk profiles that inform appropriate governance controls.
• Three sensitivity levels calibrate handling requirements. Low, medium, and high sensitivity tiers ensure that controls are proportional to actual risk rather than uniformly restrictive or uniformly permissive.
• A tool registry makes governance real. Identification, classification, and operational data for every tool creates the foundation for audit readiness, accountability, and compliance demonstration.
• Classification precedes authorization. You cannot make sound decisions about who can use a tool or under what conditions without first understanding what category and sensitivity level it falls into.
• Dual-person control protects against both misuse and error. The most sensitive tools require two-person oversight not only as a security measure but as a check on the human mistakes that happen even in high-performing teams.

Sources: PTES – Pre-Engagement  ·  NIST SP 800-115 – Technical Guide to Information Security Testing  ·  CREST – Red Teaming Guidance  ·  Physical Security Tools List